A2A workflow security: 10 classes of flaws for code review

On November 12, 2026, at 16:56, the AI section of DEV Community published an article titled "A2A Workflow Security: 10 Defect Categories Code Review Should Watch." The author argues that when two AI agents are connected across a network, it is easy to assume that HTTPS and a Bearer token are enough to keep things secure. Transport encryption, however, only verifies where a packet originated. It cannot reveal whether the caller has been manipulated through prompt injection, nor confirm that the caller actually owns the task it is trying to read. On that basis, the piece contends that A2A connections require additional security checks beyond transport-level protections.

Drawing on the A2ABreak research conducted by Purdue and UT Dallas, along with real-world remediation records from SDKs, the article identifies ten recurring risk categories and the review points developers should pay attention to when auditing A2A workflow code. As one example, it points to the risks that arise when an A2A service describes its own capabilities in the /.well-known/agent-card.json file, a self-declared mechanism that can itself become an attack surface. The discussion closes with a set of defect classifications and review recommendations rather than new incident data or vendor responses. At this point, only this single article covers the topic, and no follow-up developments, public statements, or corrective actions have been reported. The piece therefore leaves the discussion at the stage of a proposed checklist of security defects and review priorities for A2A workflows.