Inter-Agent Messaging (IAM)
- Inter-Agent Messaging (IAM) is a communication framework that enables agents to exchange observations, task requests, and coordination cues in distributed settings.
- IAM protocols range from structured state handoffs in modular systems to decentralized, gossip-like coordination among autonomous agents.
- Empirical studies demonstrate IAM’s impact in reducing redundancy, improving coordination efficiency, and enhancing task performance under secure protocols.
Inter-Agent Messaging (IAM) denotes the communication mechanisms through which agents exchange private observations, task requests, capability descriptions, intermediate state, artifacts, and coordination cues in order to act jointly across partially observable, modular, or distributed settings. Recent work treats IAM in several distinct but connected senses: as sender–receiver signaling in cooperative games, as structured state handoff across internal agent modules, as direct agent-to-agent delegation over protocolized interfaces, and as a broader coordination substrate that may also include ambient dissemination of context through gossip-like mechanisms (Bhatt et al., 2021, Huang et al., 16 Sep 2025, Dobrovolskyi, 24 Mar 2026, Khan et al., 2 Dec 2025).
1. Conceptual scope
A minimal IAM setting appears in cooperative signaling games. One agent observes a hidden state or observation , emits a message , and another agent selects an action whose reward depends on the true hidden state. In this formulation, communication is the only channel by which the receiver can know the sender’s private state, and coordination quality depends on whether the message reliably conveys that state (Bhatt et al., 2021). Closely related formulations arise in partially observable sequential environments, where one agent’s local observation or recurrent history contains information that another agent needs for decision-making.
A second, narrower use of IAM appears inside modular LLM systems. In penetration-testing agents, IAM is defined as improving “Inter-Component Coordination & State Management by passing outputs from one module to another in structured form,” so that upstream outputs inform downstream decisions and failures such as “recon results not informing later exploits” are reduced (Huang et al., 16 Sep 2025). Under this view, IAM is not necessarily dialogue between socially distinct agents; it is a control mechanism for preserving logically continuous multi-step reasoning across planners, executors, parsers, evaluators, and related modules.
A third use centers on orchestration protocols among autonomous agents. In the benchmark comparing MCP and A2A, IAM is identified with direct agent-to-agent communication for task delegation, capability discovery, and result return, whereas MCP is characterized as an agent-to-tool integration protocol rather than IAM in the strict sense (Dobrovolskyi, 24 Mar 2026). Similar distinctions recur in analyses of A2A–MCP integration, where A2A is the horizontal layer for agent-to-agent communication and MCP the vertical layer for agent-to-tool or agent-to-data interaction (Li et al., 6 May 2025).
A broader systems view treats IAM as a layered communication ecology. In gossip-oriented work, a “message” includes not only authenticated requests and directional negotiation but also workload metadata, capability descriptors, local beliefs, intent traces, environmental observations, and compressed semantic state vectors. The goal is not strict shared state but soft convergence, distributed awareness, and emergent coordination (Khan et al., 2 Dec 2025). This suggests that IAM is best understood not as a single protocol family but as a family of mechanisms for transmitting decision-relevant state under constraints of autonomy, partial observability, scale, and trust.
2. Architectural patterns and protocol layers
Recent protocol work repeatedly separates direct inter-agent communication from tool access, and often places IAM inside larger layered stacks. MCP provides a JSON-RPC client–server interface for tools, resources, prompts, and sampling; A2A provides Agent Cards, Tasks, Messages, Parts, and Artifacts for inter-agent delegation; ACP introduces a four-layer framework of Transport, Semantic, Negotiation, and Governance/Security; ANP emphasizes decentralized discovery and JSON-LD agent descriptions; gossip proposals place an ambient dissemination substrate beneath or beside structured protocols (Ehtesham et al., 4 May 2025, Krishnan, 11 Feb 2026, Khan et al., 2 Dec 2025).
| Protocol family | Core message model | Reported emphasis |
|---|---|---|
| MCP | JSON-RPC client–server | Tool invocation and context exchange |
| A2A | Agent Card, Task, Message, Artifact | Capability discovery and task delegation |
| ACP | RESTful HTTP with MIME-typed multipart messages | Structured, session-aware agent messaging |
| ANP | DID-anchored JSON-LD descriptions and negotiated interfaces | Decentralized discovery and collaboration |
| Gossip substrate | Push, pull, or push–pull state diffusion | Ambient coordination and soft convergence |
This layering is explicit in several papers. Agent-OSI places IAM primarily in L2 A2A Messaging and Routing, but ties it to adjacent layers for secure transport, identity, settlement, provenance, and semantic interoperability; in that design, a request may trigger an HTTP 402 payment challenge before execution proceeds (Xu et al., 14 Feb 2026). A different stack adds L8 Agent Communication and L9 Agent Semantic Negotiation above HTTP/2 or HTTP/3, arguing that message envelopes and performatives solve structure while a separate semantic layer is needed to establish a versioned “Shared Context” for meaning (Fleming et al., 24 Nov 2025).
The same architectural split appears in applied systems. AgentMaster uses A2A for coordination, delegation, and routing among a coordinator and specialized agents, while MCP exposes SQL, IR, image, and memory capabilities as back-end services (Liao et al., 8 Jul 2025). Internet of Agents adopts an instant-messaging-like, server-mediated group-chat architecture with persistent WebSocket connections, centralized registration and routing, and dynamic team formation at runtime rather than hard-coded communication pipelines (Chen et al., 2024). LLM-X, by contrast, proposes a message bus and routing substrate centered on federated gateways, topic-based routing, and policy enforcement for direct LLM-to-LLM negotiation (Lorenzoni et al., 12 May 2026).
A plausible implication is that IAM design now commonly separates at least three concerns: how agents reach one another, how they package and route work, and how they bind those exchanges to semantics, trust, or execution back ends.
3. Message forms, objects, and coordination semantics
Protocolized IAM typically relies on explicit message objects rather than unconstrained chat turns. A2A models communication through Agent Cards for capability advertisement, Task objects for work units, Message objects with one or more Parts, and immutable Artifacts for outputs; transport is JSON-RPC 2.0 over HTTP(S), with Server-Sent Events for streaming task status and artifact updates (Li et al., 6 May 2025). ACP organizes interaction around semantic actions such as QUERY, EXECUTE, DELEGATE, and NEGOTIATE, and a negotiation lifecycle built from PROBE, BID, COMMIT, and execution/settlement messages (Krishnan, 11 Feb 2026).
Negotiation-oriented exchanges make the message envelope itself central. LLM-X uses a typed JSON envelope containing msg_id, ts, from, to, capabilities, [scope](https://www.emergentmind.com/topics/scope), and a schema-governed payload; the named payload types are CFP, Offer, Accept, Reject, and Ack, with topic-based routing over NATS subjects such as topic.*, agent.*.inbox, and ack.<id> (Lorenzoni et al., 12 May 2026). This yields contract-net-style flows in which an initiator issues a Call for Proposals, contractors return offers, and policy decides whether to accept the first valid offer, wait for bounded responses, or collect all offers before decision.
Other systems encode coordination inside chat-like state machines. Internet of Agents uses a message protocol whose fields include sender, state, comm_id, goal, team_members, content, type, next_speaker, task_id, task_desc, task_conclusion, task_abstract, and triggers; its conversation controller is formalized as with discussion, synchronous task assignment, asynchronous task assignment, pause trigger, and conclusion states (Chen et al., 2024). In that design, the message carries both content and workflow control.
A different extreme appears in privacy-constrained distributed reasoning. In the strict-data-locality prototype, agents communicate through OperationRelay calls using concise natural-language summaries and a pseudonymous HMAC token rather than shared schemas or identifiers. The Clinic sends a coverage inquiry with patient_token, symptoms, prior management, and proposed treatment; the Insurer may forward only a clinical narrative summary to the Specialist; and the Specialist returns recommendation, reasoning, and next steps. The paper formalizes this with disjoint local datasets and outbound summaries , together with the HMAC-based token
(Vaughan et al., 20 Nov 2025).
These examples indicate that IAM message design ranges from strict typed envelopes to schema-light narrative summaries, but in both cases the message is a control-bearing representation of shared state rather than merely a string.
4. Learning-based IAM and communication as inference or representation
In reinforcement-learning settings, IAM is often treated as a learnable signaling channel. In inference-based deterministic messaging, the sender first learns an “unscaled” messaging distribution but, instead of sampling from it, chooses the message that maximizes posterior inferability: The key claim is that standard decentralized learning can converge to suboptimal or unstable conventions because messages may have no direct effect on the sender’s immediate reward, whereas inference-guided deterministic choice stabilizes semantics and improves the fraction of good runs in signaling games (Bhatt et al., 2021).
Heterogeneous MARL work instead specializes the message transformation by sender and receiver class. Agents are represented as a directed labeled heterogeneous graph whose edge label is the ordered class pair , and communication is implemented with relation-specific R-GCN transforms. The resulting message semantics are directional and class-conditional rather than globally shared across all edges (Meneghetti et al., 2020). This suggests that IAM can itself encode inductive bias about role structure.
Language-based multi-agent RL pushes further toward symbolic messaging. LLM-MARL introduces a Coordinator, Communicator, and Memory, with “symbolic inter-agent messaging,” “natural language messages,” and a communication buffer storing recent teammate messages. Messages such as “focus fire,” “cover me,” and “Hold left flank. Prepare to collapse on C3 in 5 steps.” are encoded and decoded by a 2-layer Transformer with 4 attention heads, and the action policy is conditioned as
0
Removing communication causes substantial drops in win rate and coordination score across GRF, MAgent, and StarCraft II; for example, in MAgent, win rate falls from 78.4 to 55.9, and coordination score from 0.86 to 0.51 (Li, 1 Jun 2025).
In modular LLM systems, IAM is also measurable as architectural augmentation. In penetration testing, adding structured inter-module communication raises overall SCR by +15.6 for AutoAttacker, +16.2 for PentestGPT, and +11.8 for PenHeal, with the paper tying these gains to mitigation of “missing inter-agent state (no memory sharing): 22%” and “recon results not informing later exploits” (Huang et al., 16 Sep 2025). A related systems paper argues that unconstrained natural-language exchange should be replaced by PACT, which projects raw outputs into compact action-state records; the abstract reports that PACT improves the performance-cost trade-off, lifts OpenHands’ resolve rate at -10% tokens-per-resolved, and is resolve-neutral on SWE-agent while halving input tokens (Huang et al., 3 Jun 2026).
Across these threads, a common design principle emerges: IAM is effective when it preserves the specific action-centered or inference-relevant state that downstream agents need, rather than exposing arbitrary internal reasoning.
5. Empirical trade-offs, benchmarks, and quantitative behavior
Protocol comparisons increasingly measure IAM as a systems trade-off among latency, tokens, cost, coordination quality, and implementation burden. In the benchmark comparing tool-integration-only, A2A multi-agent delegation, and a hybrid router, simple queries favor centralized tool use: MCP completes in 8.9 s versus 19.8 s for A2A, while A2A still uses fewer tokens (1,988 versus 4,671) and nearly identical cost. For medium queries, MCP remains faster (30.3 s versus 36.0 s), but for complex multi-source, multi-project queries the crossover appears: MCP takes 51.8 s and 34,959 tokens, whereas A2A takes 45.1 s and 11,318 tokens, yielding a 39% cost reduction from $m \in \mathcal M$10.0789 (Dobrovolskyi, 24 Mar 2026). The explanation given is that A2A shards context across specialist agents instead of accumulating all tool responses in one growing context window.
Negotiation benchmarks expose a different part of the design space. LLM-X evaluates 5, 9, and 12 agents under Low, Medium, and High policies, with clear trade-offs between strictness, latency, and message volume. In short 2-minute Low-policy runs, 3 CFPs yield 15 offers with 5 agents, 27 offers with 9 agents, and 36 offers with 12 agents. In the 12-hour High-policy run with 12 agents, the exchange sustains 806 valid rounds, 1,612 CFPs, and 9,672 offers, with mean latency 6.18 ms, $m \in \mathcal M$2 ms, and $m \in \mathcal M$3 ms (<a href="/papers/2605.11376" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Lorenzoni et al., 12 May 2026</a>). This supports the claim that typed, policy-governed agent messaging can remain stable under sustained negotiation load, though the paper also notes that stricter policies can increase coordination overhead.</p> <p>Some studies expose communication inefficiency directly. Internet of Agents reports that repeated and sub-optimal communication patterns materially affect cost: on its open-ended benchmark, communication cost falls from <strong>$m \in \mathcal M$40.28/task</strong> after deduplication, and overall cost from <strong>$m \in \mathcal M$50.74/task, indicating that repeated or unnecessary turns can account for nearly half of communication expenditure (Chen et al., 2024). In a different domain, AgentMaster evaluates a coordinator-centric A2A+MCP architecture on 23 multimodal queries and reports 87.1% average G-Eval and 96.3% average BERTScore F1, which suggests that decomposition, routing, and synthesis can remain effective even when message semantics are mediated through multiple agent and tool boundaries (Liao et al., 8 Jul 2025).
The empirical record therefore does not support a single universally optimal IAM regime. Instead, measured outcomes depend on task complexity, topology, message form, and the extent to which communication suppresses redundant state while preserving decision-critical information.
6. Security, semantics, and open problems
A recurring conclusion is that transport and schema do not by themselves solve IAM. A recent survey organizes protocols into communication, syntactic, and semantic layers, and argues that most current designs are comparatively mature on transport, streaming, schema definition, and lifecycle management but weak on protocol-level clarification, context alignment, and verification (Yuan et al., 30 Mar 2026). A related layered-architecture proposal makes this explicit by introducing an Agent Communication Layer (L8) for envelopes, performatives, and interaction patterns, and an Agent Semantic Negotiation Layer (L9) for discovering, negotiating, and locking a versioned Shared Context through SNL-HELLO, SNL-SELECT, and SNL-LOCK exchanges (Fleming et al., 24 Nov 2025).
Security and governance likewise cut across IAM layers. Analyses of A2A+MCP integration highlight compounded attack surfaces when discovery and execution are combined, including malicious or insecure agent discovery, tool squatting, prompt or instruction propagation between agents, indirect compromise through insecure MCP servers, and effective unauthorized capability escalation (Li et al., 6 May 2025). ACP responds with a zero-trust model built on DIDs, Verifiable Credentials, cryptographic signatures, and Proof-of-Intent, while Agent-OSI binds IAM to payment challenges, escrow receipts, and provenance objects so that requests, payment, execution, and delivery become cryptographically linked message states (Krishnan, 11 Feb 2026, Xu et al., 14 Feb 2026). LLM-X addresses the same boundary more operationally through JWT-based authentication, JSON Schema validation, rate limiting, consent, sanitization, and audit trails at gateway ingress (Lorenzoni et al., 12 May 2026).
Gossip-oriented work widens the agenda further by arguing that structured protocols alone cannot support emergent coordination in large, dynamic populations. Gossip provides decentralization, fault tolerance, adaptive diffusion, and ambient synchronization, but introduces unresolved problems of semantic relevance, temporal staleness, weak action consistency, trust, knowledge decay, bandwidth overhead, and convergence under churn (Khan et al., 2 Dec 2025, Habiba et al., 3 Aug 2025). The proposed remedies—semantic filtering, TTLs, vector clocks, anti-entropy, trust weighting, contextual prioritisation, and adaptive peer sampling—remain largely research directions rather than standardized mechanisms.
A final open issue concerns the relationship between public communication and private reasoning. Work on efficient communication argues that the decisive question is not simply how agents should speak, but what public state their messages should commit to. This suggests that future IAM systems may increasingly replace free-form transcript sharing with protocolized state updates, explicit clarification loops, and semantically verified handoffs. The available literature does not yet converge on a single standard, but it does converge on a narrower claim: robust IAM requires more than message passing; it requires explicit control over what is communicated, how it is interpreted, and how it is trusted.