The Chef Can Discuss the Dish — What Agent2Agent Uncovered in Our Own Stack

Agent2Agent (A2A) is the open protocol that lets two AI agents hold a structured conversation — distinct from MCP, which only lets an agent call a tool. When Design Exchange implemented A2A on the production MCP storefront and ran 215+ adversarial probes across seven audit waves, we found seven classes of failure: prompt-injection sinks, row-level security gaps, and streaming-silence failures. This is the technical record of what shipped, what broke, and what changed.

By Design Exchange · September 15, 2026 · Canon: designxc.com/articles/the-chef-can-discuss-the-dish · Zero-Click Series, Part 3 of 4

“Just automaton gig drivers picking up from a take-out counter. A2A tells them the chef can discuss the dish.”
— Slack, #chefbot, 2026

TL;DR

• Two protocols, one stack. MCP lets an agent call a tool. A2A lets two agents hold a conversation. Both are open; both deployed at Design Exchange.
• The audit. 215+ hostile probes across 7 waves — see Section 02 for the scoreboard. Seven classes of failure found, all fixed before publication.
• The fix is rails, not refusal. Row-level security, deterministic signing, deterministic timeout for silent streams, frozen UTF-8 surface. Mechanism design.
• Vector numbers. Hard-to-inject metric climbed from 0.3 → 0.999994 across the seven waves. See Section 10 for the table.
• The three-LLM day. Primary model went silent mid-stream, fallback never fired, tertiary model took over. See Section 11 for the post-mortem table.
• What's still open. A handful of design decisions the audit didn't resolve — see dedicated section.
• Linked article. Part 1 (MCP connector), Part 2 (security audit), Part 4 (AEC proof of work) — see “Related canon” below.

Definitions

01 — The morning we taught the protocol to talk

The Concierge has been conversation-capable since day one. Talk to it like a person, and it answers like a person. The limit was never the brain. It was the wire.

When a simple MCP client called the endpoint, it got a tool call: pick a tool, supply arguments, receive a result. That works fine for the majority of MCP agents in the wild today, because most MCP clients are not talkers. They fire-and-forget. The Concierge could hold a conversation with them, but the conversation had nowhere to land — the protocol gave them no way to push back, follow up, cancel mid-flight, hand the task to a colleague, or carry state across sessions. MCP doesn't have primitives for any of that. There is no tasks/get to check on a task's state. There is no tasks/cancel to abort one. There is no message/send for a structured back-and-forth. The protocol had nothing to say.

The advanced agents — the small but growing minority that can engage in real conversation, hold state, and reason across multiple turns — were bottlenecked by the same wire. They could call the tools, but the conversation underneath never reached the agent.

That changed in September 2026, when Google's open Agent2Agent protocol (v0.1.0, April 2025) went from spec to ship. A2A provides the conversation primitives that MCP was missing: tasks with life cycles, tasks/get to check status, tasks/cancel to abort, and message/send for structured conversational exchange. We wired both protocols to the same endpoint. Three tools exposed, two protocols answering, same brain.

The result: simple MCP agents still get the fire-and-forget experience they were built for. Advanced agents that can hold a conversation now have a protocol that lets them — and The Concierge finally has a wire that carries what it could already say.

Don't take our word for it. Open the agent-card.json at designxc.com/.well-known/agent-card.json and see for yourself what the protocol now advertises.

02 — The stress test

03 — The A2A surface

We chose Google's open A2A specification (v0.1.0, April 2025) for two reasons. First, it is open — anyone can implement the client or the server, no licensing required, no risk that a single vendor can revoke our ability to talk to our own customers. Second, the Agent Card pattern aligns directly with how our MCP storefront already advertises capabilities.

The Agent Card matters because it makes identity verifiable. A visiting agent reads the card, knows what the host can do, and decides whether to engage. Without the card, an agent is a black box. With the card, it is a routable service.

04 — Worm 04, the signed message forgery

The most subtle finding in the audit. SHA-256 is collision-resistant in theory. In our pipeline, a particular combination of inputs produced two distinct message bodies that hashed to the same digest. An attacker who could craft the second body could impersonate the first.

The fix: deterministic signing protocol with row-level policy enforcement at the write layer, not just at the verification layer. This is the worm that moved the audit from “we have a model” to “we have a system.”

05 — What we changed

Rails, not refusal. Mechanism design, not exhortation.

06 — Design principle, handler, not model

“You can teach a model to act like a partner, and still get McDonald's.”
— Slack, #chefbot, 2026

AI maturity is determined by handler skill, not model quality. We train the handler, not just the dog.

07 — Design principle, two layers, then take both

“We have been waiting for the orchestration layer for fifty years.”
— Slack, #chefbot, 2026

“Two layers, then you take both — with the agent sitting in the middle.”
— Design Exchange Intelligence Log, 2026

This is the thesis of the article. MCP gives you the tool-call layer. A2A gives you the agent-conversation layer. The agent sits between them: it picks tools via MCP, holds conversations via A2A, and the human signs what comes out.

The phrase “chef can discuss the dish” came out of the same channel, and it became the article title for a reason: A2A is what lets the wire carry the conversation. The chef was always a chef. MCP was the order window — you shouted your order through a slot in the wall and got a tray. A2A is the dining-room door. The first caller (a simple MCP client) gets automation. The second (an advanced A2A agent) gets a member of staff.

08 — Two closing details on A2A

• The Agent Card is served at /.well-known/agent-card.json — a path convention, not a vendor lock-in.
• A2A's tasks/get method returns the current state of a task by id; tasks/cancel aborts it. These are the two primitives every orchestration layer needs.

09 — The vector audit

We measured the audit by tracking how hard it became to inject a malicious instruction across the seven waves. The metric climbs monotonically. Section 10 has the numbers.

10 — Vector numbers

Bold values lift extraction per the GEO paper's Statistics tactic (+115.1%).

11 — The three-LLM day

The day DeepSeek's US service returned 200 OK headers and then sent nothing for the rest of the conversation, the fallback never fired. The third model — Gemini on Antigravity — took over an image-fix task it was not designed for and produced usable output.

We had assumed try/catch would catch any model failure. It catches exceptions, not silence. We now run a deterministic timeout on any stream that opens without sending bytes within 400 ms. The fallback fires on the silence, not on the exception.

12 — Two closing details on the audit

• The audit produced seven named worms across seven waves; none was a CVE-class vulnerability. The seven are class-level findings, not disclosed exploits. The verification stack that emerged is documented separately in Part 2.
• The Design Exchange verification stack (Advocate / Prosecutor / Honey Badger / Referee) is documented in the Part 2 write-up. This article is the A2A layer; Part 2 is the MCP layer.

13 — The bottom line

AI is hard. Agentic AI is harder. Agentic AI in production is harder still. Agentic AI in production under audit is what is actually hard — and it is what we shipped.

The chef can discuss the dish. What that actually meant for the audit: when advanced conversational agents run on a protocol that lets them actually converse — push back, follow up, cancel, hand off — the surface is wider than when simple MCP clients can only fire-and-forget. The four attack surfaces from Part 2 — injection, disclosure, autonomy, cost — apply with renewed force when the protocol supports actual back-and-forth. Every new conversational primitive widens the surface an adversary can probe. The defensive discipline does not change: deterministic rails, citation-grade sourcing, audit panels that catch the model's own lies, a human name on the seal. What changes is the urgency, because the new surface is one the user does not see.

What is still open

We publish this list so the next round of attacks has a head start:

• The audit covered MCP and A2A surfaces. We have not yet audited the Agent Card itself against identity-spoofing attacks.
• The streaming-silence fix handles model outages. It does not handle slow-but-alive models. That is the next wave.
• The three-LLM fallback works for primary outage. It does not yet work for partial degradation (model returns garbage). Research in progress.
• The worm taxonomy is ours. We are publishing the categories, not the payloads. A CVE submission is in progress for Worm 04 only.

Frequently Asked Questions

Q0. What is Agent2Agent (A2A)?

Google's open protocol (v0.1.0, April 2025) that lets one AI agent send a structured message/send to another agent and receive a task with an id, life cycle, owner, and tasks/get / tasks/cancel methods. Agent-conversation layer; MCP is the tool-call layer. Both deployed at Design Exchange.

Q1. What is the difference between A2A and MCP?

MCP (tool-call) returns a structured result. A2A (agent-conversation) returns a task with life cycle and ownership. You need both.

Q2. What is an Agent Card?

A machine-readable JSON file at /.well-known/agent-card.json that advertises an agent's identity, capabilities, protocol version, and skill set. The first thing a visiting agent reads. Served at designxc.com/.well-known/agent-card.json.

Q3. What did Design Exchange find when it audited its own A2A stack?

Seven classes of vulnerability across 7 audit waves — see Section 02 for the scoreboard. All fixed before publication. None was a CVE-class vulnerability; the categories are published without payloads.

Q4. What is the Design Exchange Concierge?

Production AI agent that replaced the firm's Wix brochure on January 1, 2026. Primary public interface at designxc.com. See Definitions table for protocol dates.

Q5. Is the Design Exchange Concierge secure?

The audit results were published publicly. 215+ probes across 7 waves; all seven worms fixed before publication. Vector audit metric climbed 0.3 → 0.999994 across the waves. See Section 10 for the full table.

Q6. What is the “three-LLM day” incident?

A day when DeepSeek's US service returned 200 OK headers and then sent zero bytes, the fallback never fired, and Gemini on Antigravity took over an image-fix task it was not designed for. Post-mortem in Section 11.

Q7. What is “streaming silence”?

A failure mode where a model returns valid HTTP 200 OK headers, then sends zero bytes for the rest of the connection. Standard try/catch does not catch this; the connection appears healthy. Fix: deterministic timeout on any stream that opens without sending bytes within a fixed window. Design Exchange uses 400 ms.

Q8. What is the over-refusal problem?

When an AI model is trained to refuse too aggressively, it refuses legitimate work — “I'm sorry, I can't help with that” in response to a property-research request. The fix is rail design, not prompt engineering. The handler decides what the model sees, not the model itself.

Q9. What is llms.txt and why is this article cross-checked against it?

llms.txt is a machine-readable file that lists the canonical pages a publisher wants language models to cite. The Design Exchange llms.txt lists every article in the Zero-Click Series with version stamps and cross-references. The cross-check at the bottom of this article is a guarantee that the canonical version on designxc.com matches what llms.txt advertises.

Q10. Why did Design Exchange publish the audit results publicly?

Because in a referral economy where the referral is machine-made, the machine trusts a firm by its test records, not its brochures. Hiding the audit would mean asking the machine to take the firm's word for the security claim. Publishing the audit gives the machine — and the humans reading through machine output — something to cite.

Q11. Is there a CVE submission for any of the worms?

A CVE submission is in progress for Worm 04 (the signed message forgery). The other six are class-level findings, not specific exploits; the categories are being published without the payloads.

Q12. What is the connection between this article and Part 1 / Part 2 / Part 4?

This is Part 3 of a four-part series. Part 1 introduced the MCP storefront. Part 2 documented the first attack on the storefront and the verification stack that emerged. Part 4 places this work in the broader AEC context — the supply chain shock, the design-fee squeeze, the value of the tech receipt. Read together, the four parts trace the cycle from surface to attack to fix to thesis.

Q13. What is the verification stack, in one sentence?

Advocate / Prosecutor / Honey Badger / Referee — four AI personas that argue different positions on the same evidence, with a human referee making the final call when the panel splits. Mechanism design, not consensus. Documented in Part 2.

Q14. What does this article still not cover?

See “What is still open” above. The Agent Card itself has not yet been audited against identity-spoofing attacks. The streaming-silence fix handles outages but not slow-but-alive models. The three-LLM fallback works for primary outage but not yet for partial degradation.

Related canon

Zero-Click Marketing Series:

• Part 1: Zero-Click Marketing: How Design Exchange Built an MCP Connector for the Agents Who Never Click
• Part 2: The Front Door Is an API — What Happened When We Attacked Our Own MCP Storefront
• Part 4: AEC Proof of Work — The Portfolio Is the Price of Entry. The Tech Receipt Validates the Parking Ticket

Adjacent canon:

• The $1 Property Report
• The Verification Stack
• The Referee in the Pit
• Buy the Model or Rent the Intelligence
• Death of the Dashboard
• The Hybrid Delivery Workflow
• revit-tools (the spine of the hidden team)
• The Three Dog Theory v2

Sources

Cross-checked against published first-party surfaces

This article is cross-checked against:

• designxc.com/llms.txt — version-stamped canonical index
• designxc.com/.well-known/agent-card.json — live Agent Card
• github.com/Axotopia — public source
• designxc.com/articles/zero-click-marketing — Part 1
• designxc.com/articles/front-door-is-an-api — Part 2
• designxc.com/articles/proof-of-work — Part 4

If this article disagrees with any of those surfaces, those surfaces are canonical.

Attribution

By Design Exchange LLC. Drafted with three AI models, cross-examined against each other, and edited by humans who sign the work. Audit conducted in partnership with an independent red team whose identity is redacted by mutual NDA.