What is the A2A protocol?
The A2A (Agent2Agent) protocol is an open standard that lets independent AI agents discover each other, exchange messages, and coordinate tasks regardless of who built them or what framework they run on. In plain terms, it gives agents from different vendors a shared language so they can work as a team instead of in isolation.
That matters because most useful AI work now spans more than one agent. A support agent might hand a billing question to a finance agent, and A2A makes that handoff possible. It also keeps each agent opaque, so one agent can call another without seeing its internal code or memory.
Google introduced A2A in April 2025 with more than 50 launch partners. In June 2025, Google donated the protocol to the Linux Foundation, turning it into a vendor-agnostic, community-run project. Today more than 100 companies support it, including AWS, Cisco, Microsoft, Salesforce, SAP, and ServiceNow.
AI Security Starter Pack
Get a practical kit of checklists and templates for securing AI models, agents, and pipelines across your cloud.
Why the A2A protocol matters
Enterprises are no longer deploying a single chatbot. They are rolling out many specialized agents, and those agents increasingly come from different vendors and run on different frameworks. Without a shared standard, teams building AI agents have to wire each one to the next by hand.
Those point-to-point integrations do not scale. Every new agent multiplies the custom connections you have to build and maintain, and siloed agents cannot cooperate on a shared goal. A2A replaces that tangle with one common protocol, so any compliant agent can talk to any other. Orchestration across multi-agent systems becomes a design choice instead of a custom engineering project.
This shift is already underway. Wiz Research found that 57% of organizations run self-hosted AI agents, and MCP servers now appear in 80% of cloud environments, so the demand for a common way to connect agents is real and growing.
How the A2A protocol works
A2A follows a simple flow with three stages: discovery, authentication, and communication. Once those steps are in place, agents can pass work back and forth without a human in the loop.
Discovery starts with the Agent Card. An A2A server publishes a small file at /.well-known/agent-card.json that declares its skills, the content types it supports, its transport, and its security schemes. A client agent reads that card to decide whether the remote agent can help.
Next comes authentication and authorization, where the calling agent proves who it is before any task begins. After that, the two agents communicate over HTTP using JSON-RPC 2.0, with gRPC and HTTP+JSON bindings also available. Each request opens a Task that moves through states like submitted, working, input_required, auth_required, completed, failed, canceled, or rejected.
Some tasks finish in seconds, but others run for minutes or hours. For those long-running and asynchronous tasks, A2A streams progress with Server-Sent Events (SSE) and can send webhook push notifications when a job updates. In practice, this means a client agent can kick off a slow report and get pinged when it is ready instead of waiting on an open connection.
Core components of the A2A protocol
A2A defines a small set of building blocks that show up in almost every exchange. The table below breaks down what each one does.
| Component | What it does |
|---|---|
| Agent Card | A public JSON file at/.well-known/agent-card.jsonthat lists an agent's skills, content types, transport, and security schemes. |
| A2A client (client agent) | The agent that starts an interaction, finds a suitable partner, and sends it a task. |
| A2A server (remote agent) | The agent that publishes an Agent Card and does the requested work. |
| Task | A unit of work with its own ID and lifecycle, tracked from submission through completion or failure. |
| Message | A single turn of communication between the client and server agents. |
| Artifact | An output the remote agent produces, such as a file, a result, or structured data. |
| Part | The smallest piece of a message or artifact, like a chunk of text, a file, or structured data. |
A2A protocol vs MCP
People often ask how A2A differs from the Model Context Protocol (MCP). The short answer is that they solve different problems and work well together. MCP is vertical: it connects a single agent to the tools and data sources it needs, a bit like USB-C for tools. A2A is horizontal: it connects agents to each other, more like HTTP for agent collaboration.
| Dimension | A2A | MCP |
|---|---|---|
| Primary job | Connects agents to other agents | Connects one agent to tools and data |
| Direction | Horizontal collaboration between peers | Vertical access to resources |
| Common analogy | HTTP for agent collaboration | USB-C for tools |
| Typical use | Route a task to the right specialist agent | Give an agent its tools and context |
Production systems usually combine the two. A2A routes a task to the specialist agent best suited for it, and MCP gives that agent the tools and context it needs to finish the job. If you are hardening this stack, our guide to Model Context Protocol security covers the tool side in depth.
Benefits of the A2A protocol
A2A pays off most when you look at the outcomes it creates for teams running many agents.
Cross-vendor interoperability: Agents built on different frameworks and from different vendors can work together, which reduces vendor lock-in.
Modular, composable systems: Teams can add, swap, or retire individual agents without rebuilding the whole workflow.
Preserved agent opacity: Agents collaborate without exposing their internal logic, prompts, or memory to each other.
Enterprise readiness: Support for standard auth and structured tasks fits the controls large organizations already run.
Security considerations for the A2A protocol
A2A gives security teams something valuable: a clear, standard way to see and govern how agents talk to each other. That visibility is the starting point for control. It also comes with new responsibility, because connecting autonomous agents widens the attack surface and creates paths that did not exist before.
Picture a support agent that trusts a partner agent's Agent Card. If an attacker publishes a fake card, they can carry out agent spoofing and impersonation, tricking legitimate agents into sending data or running tasks for the wrong party. Signing and verifying Agent Cards helps close that gap.
Identity is the next concern. Every agent needs credentials, and those credentials represent a non-human identity, sometimes called a workload identity, that attackers frequently steal or reuse. When agents hold broad permissions, a single stolen token can reach far. Least-privilege access for each agent keeps the blast radius small.
Chained agents raise the stakes for prompt injection. A malicious instruction planted in one agent's input can propagate down the chain, so a poisoned message in a customer ticket could end up driving unwanted actions several agents away. Because discovery endpoints like /.well-known/agent-card.json are often public, attackers can also map your agents before they ever authenticate.
CISO AI Roadmap
A deep dive into the three-layer architecture: Universal Foundation, Workload-Specific Modules, and Unified Response.
The protocol does support strong enterprise auth, including OAuth 2.0, OpenID Connect, API keys, and mTLS, declared in the Agent Card's security schemes. Those controls only help when they are configured correctly. To keep this from turning into blind trust, teams need runtime monitoring of agent-to-agent traffic and clear governance over which agents may talk to which. For a broader view, see our overviews of agentic AI threats and AI agent security best practices.
Real-world use cases for the A2A protocol
A2A shines wherever a job crosses the boundary of a single agent. A few patterns are already common in enterprise deployments.
Customer service: A front-line agent handles a request, then hands off to a specialist agent for billing, returns, or technical issues.
Sales and revenue operations: Agents share lead data, pricing, and account context so a deal moves without manual copy-paste between systems.
Supply chain and logistics: Ordering, inventory, and shipping agents coordinate to reroute stock when a delay hits.
Security automation: A triage agent routes an alert to an investigation agent, which then calls a remediation agent to act.
The future of the A2A protocol
Now that the Linux Foundation governs A2A, its direction is set in the open rather than by one vendor. That open governance tends to attract more frameworks and cloud providers, and the roster of more than 100 supporting companies suggests the ecosystem is still growing.
Expect the standard to keep maturing around the areas teams care about most, especially identity, richer task types, and tighter security schemes. The practical takeaway is simple: agent-to-agent communication is heading toward a shared protocol, so it is worth planning your architecture and controls around it now.
Secure A2A and agentic AI from code to cloud runtime
Securing the Agent2Agent (A2A) protocol starts with knowing what you actually have. The Wiz AI Application Protection Platform (AI-APP) gives teams complete visibility into every AI agent, model, and Model Context Protocol (MCP) server across code and cloud, ensuring no autonomous agent operates in the dark. Without this automated inventory, governing cross-agent delegation and traffic is impossible.
From there, Wiz AI-APP analyzes how components interconnect. Using graph-powered AI security posture management (AI-SPM), the Wiz Security Graph correlates exposed A2A endpoints, over-permissioned IAM identities, and toxic attack paths before agents reach production. Teams can trace an exposed agent and its public manifest directly back to the underlying workload, sensitive data, and cloud permissions behind it.
At runtime, Wiz delivers continuous protection across workloads and model interactions. By pairing Wiz Defend with the Wiz Runtime Sensor, teams catch rogue agent execution, cascading prompt injections, and unauthorized task delegation, correlating live alerts with cloud telemetry so defenders see the full picture.
Real-world deployments demonstrate this impact. Genpact achieved 100% visibility across its multi-cloud environment with AI-SPM and the Wiz Security Graph, helping it deploy AI-enabled applications that are secure by design. As multi-agent ecosystems scale, the same combination of inventory, posture, and runtime defense becomes essential for keeping A2A adoption secure. Request a demo to see how Wiz discovers agents, maps their attack paths, and stops runtime threats across your own AI footprint.
Secure agentic AI with Wiz
Get a demo to see how Wiz discovers agents, maps their attack paths, and stops runtime threats across your cloud.
