title: A2A Agent Card Discovery Request
id: 938e96f4-dc7e-4b0e-9750-e95ccc55c612
status: experimental
description: Detects requests for /.well-known/agent.json, the Agent Card discovery document of the Agent2Agent (A2A) protocol. Agent Cards advertise an agent's identity, skills, and endpoint; fetching one is a precondition for agent-to-agent task delegation and therefore also for agent-card spoofing, skill-survey reconnaissance, and task-replay attacks. Log at hunt level and correlate with subsequent POSTs to the advertised A2A endpoint.
references:
    - https://developers.googleblog.com/2025/04/a2a-a-new-era-of-agent-interoperability.html
    - https://arxiv.org/html/2504.16902v1
author: Agentic Threat Lab
date: 2026-10-22
tags:
    - attack.discovery
    - attack.t1595
atlas:
    - AML.T0116
    - AML.T0132
logsource:
    category: web
detection:
    selection:
        - cs-uri|contains: '/.well-known/agent.json'
        - c-uri|contains: '/.well-known/agent.json'
        - uri|contains: '/.well-known/agent.json'
        - request|contains: '/.well-known/agent.json'
    condition: selection
falsepositives:
    - Legitimate A2A client agents beginning a delegated task (expected inside agent-enabled environments)
    - Researchers and scanners enumerating well-known paths
level: informational