Man-in-the-Middle (MITM)

The foundational step where the adversary inserts themselves into the communication channel without detection. Common techniques include ARP spoofing on local networks, DNS cache poisoning to redirect traffic, or rogue access points that mimic legitimate Wi-Fi. In agentic systems, this extends to intercepting inter-agent gRPC streams or hijacking message queue connections.

The adversary terminates the original TLS session and establishes a separate encrypted session with each victim. This requires presenting a forged or compromised certificate that the client accepts. The attacker decrypts incoming traffic, inspects or modifies it, re-encrypts it, and forwards it to the destination. Certificate pinning and mutual TLS (mTLS) are primary defenses.

Beyond passive observation, the attacker actively alters data in transit. This includes:

• Payload injection: Inserting malicious commands into API calls
• Parameter tampering: Modifying transaction amounts or recipient addresses
• Protocol downgrade: Forcing connections to use weaker cipher suites In agent workflows, manipulating a tool-calling JSON payload can redirect an agent's actions to an attacker-controlled endpoint.

The attacker steals a valid session token or cookie after authentication completes, bypassing the need to crack credentials. Techniques include cross-site scripting (XSS) to exfiltrate cookies, session sidejacking on unencrypted Wi-Fi, or exploiting predictable session IDs. For autonomous agents, hijacking a JWT bearer token or OAuth 2.0 access token grants the attacker the agent's full authorized scope.

The attacker captures legitimate authentication material and replays it against the target service in real-time or after a delay. NTLM relay attacks in Windows environments and Kerberoasting are classic examples. In agentic architectures, an intercepted SPIFFE-issued SVID or DPoP-bound token could be relayed to impersonate a workload identity if time-window validations are insufficiently strict.

Sophisticated MITM attacks prioritize remaining undetected. Adversaries employ passive ARP monitoring rather than active probing, use kernel-level rootkits to hide network hooks, or maintain long-lived reverse shells through encrypted command-and-control channels. In agent networks, an undetected MITM can continuously poison retrieval-augmented generation (RAG) pipelines or corrupt agent memory stores over extended periods.

A technique where an attacker sends falsified Address Resolution Protocol (ARP) messages onto a local area network. This links the attacker's MAC address with the IP address of a legitimate host, such as the default gateway, causing all traffic intended for that host to be routed through the attacker instead. This enables packet sniffing, modification, or denial-of-service on a switched network. Defenses include static ARP entries and Dynamic ARP Inspection (DAI) on managed switches.

An attack that corrupts a DNS resolver's cache with a forged entry, causing it to return an incorrect IP address. When a user or agent requests a legitimate domain, they are silently redirected to a malicious server controlled by the attacker. This enables credential harvesting and pharming attacks. Countermeasures include DNSSEC (Domain Name System Security Extensions), which cryptographically signs DNS records to ensure data integrity and origin authentication.

A proxy-based attack where an adversary terminates the client's encrypted session and establishes a separate encrypted session with the destination server. The attacker decrypts, inspects, and potentially modifies traffic in plaintext before re-encrypting it. This is often executed using a rogue Certificate Authority (CA) installed on the victim's device. Certificate pinning and HTTP Public Key Pinning (HPKP) are defenses that restrict which certificates are accepted for a specific domain.

A security mechanism that hardcodes the digital certificate or public key of a trusted server directly into an application. During the TLS handshake, the application rejects any connection where the server's certificate does not match the pinned value. This defeats MITM attacks that rely on a compromised or rogue Certificate Authority to issue a fraudulent but otherwise valid certificate for the target domain. The primary risk is bricking if a legitimate certificate must be rotated without a client update.

The hierarchical framework of roles, policies, hardware, and software used to create, manage, distribute, use, store, and revoke digital certificates. A trusted Certificate Authority (CA) binds public keys to verified identities. A compromise of a root CA is catastrophic for MITM defense, as it allows an attacker to issue valid certificates for any domain. Modern PKI relies on Certificate Transparency (CT) logs to detect mis-issuance and hold CAs accountable.