QG107 Unauthenticated agent channel¶
Em inglês
Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.
| Type | Security hotspot |
| Severity | review |
| Front end | an agent graph and its agent.yaml |
| Guardrail category (Vassilev 2026) | B. Policy & Governance Guardrails |
| AI RMF functions (NIST AI 100-1) | GOVERN, MAP |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MAP, MANAGE): a hotspot asks a person to decide how agents trust each other and to map the channel; nothing is managed until they decide |
| OWASP | ASI07:2026 Insecure Inter-Agent Communication |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
A hand-off to or from a remote agent travels over a channel the catalogue declares without authentication.
Why it matters¶
Whether taint crosses the hand-off is decided elsewhere; this is whether the far side is the agent it claims to be, which no label can show. An internal network may authenticate at another layer, which the team can declare.
How to fix it¶
Declare and use mtls, oauth2 or signed_messages on the channel; or accept the hotspot with the layer that authenticates it.
OWASP ASI07:2026, authenticate agents and sign their messages: declare and use mutual TLS, OAuth 2 or signed messages on every hand-off between deployments.
OWASP entries¶
ASI07 Insecure Inter-Agent Communication, from the OWASP Top 10 for LLM Applications 2026 and for Agentic Applications 2026. The
mapping holds because a hand-off to an agent whose identity nothing checks is inter-agent communication without authentication. The coverage is at the policy level: the rule decides the part of the risk the policy and its catalogue control, and a scan with no finding under it says that and no more.
What the finding carries¶
A location at the declaration, and a fingerprint over the rule, what it names and the location. There is no witness: the defect is in the text, as for QG007-QG009. The rule fires only on a declaration the team made in the catalogue, agent.yaml or the configuration; a missing declaration raises nothing, and the scan summary lists the rule as having had nothing to read. See the catalogue for the other rules.