UNB Researchers Threat-Model the Protocols That Let AI Agents Act

What happens when an AI agent picks the right tool — but pulls it from the wrong provider? That question sits at the heart of a poster from UNB's Canadian Institute for Cybersecurity, set for the PST Cybersecurity Summit 2026 in Fredericton on Aug. 20.

Security Threat Modeling for Emerging AI-Agent Protocols, by Zeynab Anbiaee, Mahdi Rabbani, Ali A. Ghorbani — the institute's founding director and Order of New Brunswick recipient — and Sajjad Dadkhah, uncovers hidden security risks across the protocols now defining how AI agents talk to each other and to the tools they control.

The problem: agents acting on borrowed identity

Enterprise AI agents don't just answer questions — they retrieve documents, call tools, and take actions on behalf of users. That makes the plumbing between them security-critical. The researchers studied the emerging agent protocols — MCP, A2A, Agora, and ANP — across their full lifecycles, from discovery and handshake through execution and updates.

The sharpest risk they flag is identity ambiguity: an agent may select the right tool but bind to the wrong provider, and a malicious or look-alike provider can redirect the agent's actions before anyone notices. In an experimental MCP case study, the team demonstrates how that ambiguity plays out in practice.

The fix: trust controls before scale

Threat modeling points to controls that have to be built into agent protocols rather than bolted on later:

• Stronger identity — agents and providers must know exactly who they are talking to
• Provenance — where a tool, model, or update actually came from
• Authorization — what an agent is allowed to do, and with what
• Update controls — verified, authenticated updates across the ecosystem

Without those, the researchers argue, agent ecosystems can't be trusted at the scale enterprises are pushing toward.

Why it matters

Agent interoperability protocols are being standardized right now, and the security decisions made early will be hard to reverse. For a province that anchors a cybersecurity cluster built on exactly this kind of research, the work is a preview of where the next generation of secure-by-default enterprise AI tooling comes from.

Sources

• Canadian Institute for Cybersecurity: Research Spotlight post — project summary, authors, protocols studied, and the MCP case study