A2ABreak found 11 protocol-level flaws in A2A that an attacker can exploit while following the spec.

The researchers turned 929 formalized statements from the Linux Foundation's A2A specification into a verified model with 37 states and 76 transitions, then searched it adversarially (arXiv 2609.10871). The flaws include cross-client context injection through unprotected context IDs, and data theft by rogue agents that advertise capabilities nobody verifies. A zero-shot LLM reading the same spec confirmed none of them. The formal model scored 84.6% F1 against expert review. Treat context IDs and agent cards as untrusted input.