Reference Grafting in A2A: Cross-Principal Task-Data Exfiltration via referenceTaskIds

Abstract

In Agent2Agent (A2A), one AI agent asks another to do work. Reference Grafting steals a victim's private task data from that exchange. The victim's agent correctly refuses to hand over the data — but it does hand over the task's ID, which looks like harmless coordination metadata. The attacker sends that ID back to the server in the referenceTaskIds field. The server checks ownership when a task is requested directly (denied) but not when it's referenced (allowed), so it loads the victim's task and returns the contents.