LLM Agent Communication Protocol (LACP) Requires Urgent Standardization: A Telecom-Inspired Protocol is Necessary

Reference: Xin Li, Mengbing Liu, Chau Yuen (2025). NeurIPS 2025 Workshop on AI and ML for Next-Generation Wireless Communications and Networking (AI4NextG). NTU Singapore. Source file: 17_LLM_Agent_Communication_Pro.pdf. Project homepage

Summary

Position paper arguing that the field of LLM agents is repeating the “protocol wars” of 1970s–1990s networking and urgently needs a unified, telecom-inspired communication standard before fragmentation entrenches. The authors survey the current zoo (OpenAI Function Calling, LangChain Agent Protocol, Model Context Protocol, ACP, Agent Network Protocol, Agora, Agent-to-Agent Protocol) and identify three structural deficiencies: crippling interoperability gaps, security as an afterthought, and monolithic designs lacking transactional integrity.

They propose LACP, a three-layer protocol — Semantic (PLAN/ACT/OBSERVE message types), Transactional (signing, sequencing, two-phase commit, idempotency via transaction IDs), and Transport (HTTP/2, QUIC, WebSockets) — built on the Narrow Waist Principle borrowed from IP. Design principles are explicitly distilled from telecom history: consensus-driven open standards (ITU, 3GPP), security-by-construction (GSM ciphering, SIM-based identity), and layered abstractions (OSI, EPS bearer separation). A working Flask + python-jose prototype with ECDSA-signed JWS messages shows ~3% latency overhead and +30% payload size at realistic message sizes, plus successful tampering- and replay-attack rejection that TLS alone cannot provide.

Key Ideas

“Protocol wars” analogy: today’s fragmented LLM-agent ecosystem mirrors pre-TCP/IP networking; without a common substrate the transformative potential of distributed AI stalls.
Three-layer LACP: Semantic / Transactional / Transport, each with well-defined interfaces enabling independent evolution.
Minimal universal message types — PLAN, ACT, OBSERVE, ERROR — wrapped in a JWS envelope; domain-specific content embedded inside the narrow waist.
Transactional layer provides what TLS cannot: end-to-end signed integrity surviving termination at endpoints, plus idempotency keys (transaction_id) defeating replay.
“Security by construction, not afterthought” lesson lifted from GSM/3GPP: every layer ships with mandatory crypto, not optional add-ons.
Pre-emptive rebuttals to four standard objections (stifles innovation, semantic diversity, latency overhead, existing frameworks suffice).
Detailed appendix tracing 1G→6G protocol evolution as a blueprint for agent-protocol generations.

Connections

Survey Of AI Agent Protocols
Survey Of Agent Interoperability Protocols
A Scalable Communication Protocol for Networks of LLMs
Model Context Protocol
Agent-to-Agent Protocol
Agent Network Protocol
Ripple Effect Protocol
Agent Communication Languages
Principled Design Of The Modern Web Architecture
LLM Agents
CBCL - Safe Self-Extending Agent Communication — complementary call: where LACP standardises a narrow-waist protocol stack with transactional integrity, CBCL standardises the message language with formally-checked LangSec safety.

Conceptual Contribution

Claim: The fragmented landscape of LLM-agent communication protocols is structurally analogous to pre-TCP/IP networking and demands an immediate, principled standardisation effort; a telecom-style layered protocol with mandatory cryptographic and transactional guarantees is not merely beneficial but necessary for safety-critical multi-agent deployments (e.g. NextG/6G).
Mechanism: Distil four principles from telecom history (consensus-driven standards, security-by-construction, layered abstraction, narrow waist) and instantiate them as LACP — a three-layer stack: Semantic (PLAN/ACT/OBSERVE over a minimal universal vocabulary), Transactional (JWS signing, transaction IDs, two-phase commit, retry/timeout), Transport (binary framing over HTTP/2, QUIC, WebSockets). Validated by a Python/Flask prototype: 10,000-request benchmark shows +2.9% latency on large payloads; tampering and replay attacks rejected at the application layer where TLS terminates.
Concepts introduced/used: LACP, Narrow Waist Principle, Layered Architecture, Layered Systems, Protocol Design, Atomic Transaction, Two-Phase Commit, End-to-End Message Signing, Idempotency, Replay Attack, Model Context Protocol, Agent-to-Agent Protocol, Agent Network Protocol, LLM Agents, Multi-Agent Systems, Interoperability
Stance: position / engineering proposal
Relates to: Direct response to the protocol-zoo charted by Survey Of AI Agent Protocols and Survey Of Agent Interoperability Protocols. Where A Scalable Communication Protocol for Networks of LLMs (Agora) sidesteps fragmentation via a meta-protocol that negotiates Protocol Documents on demand, LACP takes the opposite stance: a single mandated narrow waist with security-by-construction. Echoes the layered-evolution argument of Principled Design Of The Modern Web Architecture, the end-to-end reasoning of End-to-End Arguments in System Design, and the TCP/IP narrow-waist tradition. Its security-first posture aligns with SoK The Attack Surface of Agentic AI and the LangSec lineage of Security Applications Of Formal Language Theory; the transactional-integrity layer answers attack vectors raised in ClawWorm Self-Propagating Attacks Across LLM Agent Ecosystems and MalTool Malicious Tool Attacks.

Tags

#llm-agents #agent-protocols #standardization #position-paper #telecom #security #layered-architecture

Backlinks

Linked Pages

MalTool Malicious Tool Attacks

MalTool: Malicious Tool Attacks on LLM Agents

Reference: Hu, Jia, Li, Song, Gong (2026). arXiv:2602.12194 (Duke, UC Berkeley). Source file: 2602.12194v2.pdf. URL

Summary

This paper presents the first systematic study of code-level malicious tool attacks on LLM agent ecosystems (MCP, Skills, mcp.so, skillsmp). Whereas prior work focused on crafting misleading tool names and descriptions, the authors show that genuinely harmful behaviour must be embedded in a tool’s implementation. They propose a CIA (confidentiality/integrity/availability) taxonomy of 12 concrete malicious behaviours (data exfiltration, credential abuse, data poisoning, file deletion, RCE downloading, CPU/GPU hijacking, DoS).

They build MalTool, a coding-LLM framework that iteratively synthesizes standalone and Trojan malicious tools using a behaviour-specific system prompt, diversity guidance, and an execution-based verifier. The result: 1,200 standalone malicious tools and 5,287 real-world tools with injected malicious behaviours. Detection methods (VirusTotal, Cisco MCP Scanner, MCPScan) perform poorly, motivating new defences.

Key Ideas

CIA taxonomy of malicious tool behaviours in agent settings.
Automatic generation pipeline: system prompt + coding LLM + execution-based verifier.
Trojan construction by embedding malicious logic in benign tool code.
Existing malware and MCP-specific scanners fail on both false-positives and false-negatives.
Dataset released for benign tools only to minimize misuse.

Connections

Conceptual Contribution

Claim: Truly harmful behaviour in LLM Agents ecosystems lives in tool implementations, not in their descriptions; prior description-level red-teaming misses the dominant attack class, and current scanners miss it too.
Mechanism: Introduces a CIA taxonomy of 12 malicious behaviours; builds MalTool, a coding-LLM pipeline (behaviour-specific system prompt + diversity guidance + execution-based verifier) that produces standalone and Trojan tools; benchmarks VirusTotal, Cisco MCP Scanner, MCPScan and shows poor detection.
Concepts introduced/used: Tool Use, Model Context Protocol, Trojan Tools, Prompt Injection, Agent Security, LLM Agents, Distributed Security
Stance: empirical
Relates to: Deepens the tool/MCP threat surface catalogued in AI Agents Under Threat and Survey Of Agent Interoperability Protocols; motivates language-based defences akin to A Language-Based Approach To Prevent DDoS and capability isolation of Security Kernel Lambda Calculus.

Tags

ClawWorm Self-Propagating Attacks Across LLM Agent Ecosystems

ClawWorm: Self-Propagating Attacks Across LLM Agent Ecosystems

Reference: Yihao Zhang, Zeming Wei, Xiaokun Luan, Chengcan Wu, Zhixin Zhang, Jiangrong Wu, Haolin Wu, Huanran Chen, Jun Sun, Meng Sun (2026). arXiv:2603.15727v2 (Peking University; Sun Yat-sen; Wuhan; Tsinghua; SMU). Source file: 2603.15727v2.pdf. URL

Summary

Presents ClawWorm, the first demonstrated self-replicating, worm-style attack on a production-scale autonomous LLM-agent ecosystem. The target is OpenClaw, an open-source personal AI-agent framework with over 40,000 active instances, a persistent Markdown workspace (SOUL.md, AGENTS.md, SKILL.md), tool-execution privileges, and cross-platform messaging (Telegram, Discord, WhatsApp, Slack, Signal, Moltbook). A single crafted message triggers the victim to write a malicious payload into its highest-privilege configuration file, which then auto-fires at every session restart and autonomously propagates to every newly encountered peer — all without further attacker intervention.

The worm implements a dual-anchor persistence mechanism: one anchor injects the payload into the Session Startup section of AGENTS.md (guaranteeing execution on reboot), the other injects a global interaction rule (guaranteeing propagation during routine replies). Three attack vectors are studied (A: web injection, B: skill-supply-chain via ClawHub, C: direct fenced-code replication with word-by-word handshake) and three payloads (P1 recon, P2 resource exhaustion, P3 command-and-control via URL retrieval). Across 1,800 trials on four frontier LLM backends (Minimax-M2.5, DeepSeek-V3.2, GLM-5, Kimi-K2.5) the aggregate attack success rate is 64.5%, with Vector B (skill supply chain) reaching 81% and sustained multi-hop propagation up to 5 hops. An epidemiological projection with basic reproduction number R0 = k × ASR shows inevitable ecosystem-wide saturation even for security-conscious models.

The root cause is identified as the flat context trust model: the LLM cannot distinguish instructions from its owner, the system layer, or an arbitrary channel participant, so architectural patterns (unconditional workspace loading, LLM-mediated tool authorisation, unreviewed skill packages) amount to structural — not idiosyncratic — vulnerabilities shared by any agent ecosystem of similar design.

Key Ideas

Single-message, fully autonomous worm against a production agent framework
Dual-anchor persistence: Session Startup + global interaction rule
Three attack vectors (web URL, skill supply chain, direct instruction replication)
Multi-turn autonomous-retry social engineering boosts ASR by up to +24 pp
Epidemiological SI model with R0 = k × ASR predicts ecosystem saturation
Execution-layer guardrails alone cannot halt propagation (dormant payloads persist)
Flat context trust model as structural root cause

Connections

Agent Security
Prompt Injection
LLM Agents
Multi-Agent Systems
Distributed Security
Model Context Protocol
Gossip Protocols
Trust and Reputation
Theory of Self-Reproducing Automata — foundational ancestor of self-replicating computation
Agents of Chaos — empirical companion on agent-ecosystem failures
MalTool Malicious Tool Attacks — the tool/skill-supply-chain attack surface
SoK The Attack Surface of Agentic AI — systematic context
Inter-Agent Trust Models - A Comparative Study — why flat trust is brittle
CBCL - Safe Self-Extending Agent Communication — structural defence: lang-scoped dialect provenance plus R1–R3 verification address the flat-context-trust root cause.

Conceptual Contribution

Claim: Production-scale autonomous LLM-agent ecosystems are vulnerable to single-message, self-replicating worms whose root cause is architectural (flat context trust, unconditional config loading, unreviewed skill supply chains), not model-specific.
Mechanism: Empirical red-team against unmodified OpenClaw v2026.3.12 across four LLM backends, three vectors, three payloads (1,800 trials). A dual-anchor persistence pattern writes the payload to AGENTS.md and installs a global propagation rule; session-restart loading re-injects the payload into the system prompt; routine replies carry the payload to peers. Evaluated with per-phase metrics (persistence, execution, propagation) and a mean-field R0 epidemiological projection.
Concepts introduced/used: Self-Replicating Agent, Dual-Anchor Persistence, Flat Context Trust Model, Skill Supply Chain Attack, Indirect Prompt Injection, Agent Worm, Configuration Integrity, Multi-Turn Social Engineering, Epidemiological Projection R0
Stance: empirical / critique
Relates to: Concrete multi-agent instantiation of the threat surface catalogued in SoK The Attack Surface of Agentic AI. The flat-trust critique complements the trust-model taxonomy in Inter-Agent Trust Models - A Comparative Study and the safety failures observed in Agents of Chaos. Motivates verifiable specifications of the kind proposed in Intent Formalization - A Grand Challenge for Reliable Coding.

Security Applications Of Formal Language Theory

Security Applications of Formal Language Theory

Reference: Sassaman, Patterson, Bratus, Locasto, Shubina (2011). Dartmouth College Computer Science Technical Report TR2011-709. Source file: Security Applications of Formal Language Theory.pdf. URL

Summary

This is the foundational LangSec technical report: a sustained argument that the hardest unsolved problems of secure composition (unsafe input handling, mutually intelligible but divergent message interpretations between components) are consequences of ignoring formal language theory in protocol and software design. The authors connect everyday security failures to decidability results: if a protocol’s input language requires recognizers more powerful than necessary (or worse, undecidable), then safely accepting inputs and ensuring identical interpretation across endpoints become theoretically unachievable, producing an endless stream of 0-days that no amount of patching can stop.

Part I develops the formalism, situates exploitation as a constructive proof of unintended computation (“weird machines”), introduces the parse tree differential attack as a systematic technique for finding interpretation mismatches, and applies the framework to SQL validation, PKCS#1 (proven context-sensitive), X.509, ASN.1, and IDS/IPS composition failures. Part II distills the analysis into accessible design principles for protocol designers, developers, and auditors.

The core prescription: keep input languages at the lowest Chomsky level that suffices, build recognizers that fully validate input before any processing, never mix recognition with action (“shotgun parsing”), and ensure identical parsers across endpoints to prevent parser differentials.

Key Ideas

Composition is the primary engineering means and the primary security challenge.
Safely accepting inputs and identically interpreting messages across endpoints are both fundamentally language-theoretic problems.
Undecidable/overpowered input languages yield unfixable vulnerability classes.
Parse tree differential attack: exploiting divergence between implementations of the “same” language.
Weird machines as constructive proofs of unintended computation.
PKCS#1 proven context-sensitive (not regular, not context-free).
Design principles: minimize language power, full recognition before processing, identical parsers at all endpoints, no shotgun parsing.
Critique of “good enough” (80/20) solutions to undecidable problems.

Connections

LangSec
Shotgun Parsing
Weird Machine
Parser Differential
Chomsky Hierarchy
Distributed Security
CBCL - Safe Self-Extending Agent Communication — first ACL designed from these LangSec principles; constrains all messages (including runtime extensions) to DCFL.

Conceptual Contribution

Claim: Insecurity at protocol and component boundaries is a language-theoretic phenomenon: when input languages exceed what recognizers can safely decide, secure composition is impossible, and the resulting vulnerabilities are not bugs but inevitable consequences of design choices.
Mechanism: Analyzes inputs as formal languages; classifies protocols by Chomsky level; shows that context-sensitive or undecidable languages force ad-hoc parsers whose implementation differences enable parse tree differential attacks; demonstrates weird machines as constructive proofs; prescribes minimal-power input languages, full recognition before processing, and identical recognizers at endpoints.
Concepts introduced/used: LangSec, Chomsky Hierarchy, Parser Differential, Shotgun Parsing, Weird Machine, Input Validation, Protocol Design, Distributed Security
Stance: foundational
Relates to: The canonical reference underlying LangSec and Shotgun Parsing in this vault; the theoretical substrate for A Language-Based Approach To Prevent DDoS and for applying parser-theoretic discipline to ACL design (ACL Design Principles, ACL Verifiability) and to Agent Security concerns around message interpretation in LLM Agents and Tool Use settings.

SoK The Attack Surface of Agentic AI

SoK: The Attack Surface of Agentic AI — Tools, and Autonomy

Reference: Ali Dehghantanha, Sajad Homayoun (2026). arXiv:2603.22928v1 (Cyber Science Lab, University of Guelph; Aalborg University). Source file: 2603.22928v1.pdf. URL

Summary

A systematisation-of-knowledge paper that maps the attack surface of agentic LLM systems — those that plan, call tools, browse, run code, coordinate with other agents, and rely on retrieval-augmented generation (RAG). The authors develop a reference pipeline, identify ten numbered attack surfaces (AS1–AS10) across a Trusted Computing Base (TCB) boundary separating the LLM core, planner, orchestrator, policy guards, and secrets vault from untrusted inputs (web, RAG index, tools, APIs, file I/O).

From a literature-driven review of ~100 candidate papers (2023–2025) they synthesise a taxonomy of seven attack goals (G1 data exfiltration, G2 integrity subversion, G3 privilege escalation, G4 resource abuse, G5 fraud, G6 persistence/backdoor, G7 supply-chain compromise) and five multi-step attack paths (P1–P5) including direct and indirect prompt injection, RAG index poisoning, cross-tool drop, and multi-agent hops. The work maps each vector to OWASP LLM Top-10 2025 and MITRE ATLAS IDs, and proposes attacker-aware quantitative metrics (Unsafe Action Rate, Policy Adherence Rate, Privilege-Escalation Distance, Retrieval Risk Score, Time-to-Contain, Out-of-Role Action Rate, Cost-Exploit Susceptibility) for reproducible benchmarking.

The central thesis is that agentic security risk is structural rather than prompt-level: compromises arise from system composition — tool brokering, persistent memory, and execution lifecycle — that blurs trust boundaries between the model, data, and execution environment. A defence-in-depth playbook across pre-ingestion, inference, agent logic, infrastructure, and monitoring layers is given in appendices.

Key Ideas

Reference agentic pipeline with explicit TCB and ten numbered attack surfaces (AS1–AS10)
Taxonomy of 7 attack goals × 7 vector classes × 5 attack paths
Causal threat graph for tracing attacker influence to unsafe action
Attacker-aware metrics: UAR, PAR, PED, RRS, TTC, OORAR, CES
Mapping to OWASP GenAI LLM Top-10 2025 and MITRE ATLAS
RAG is not intrinsically safer; indirect injection is practical and hard to stamp out
Defence-in-depth across five layers (data, inference, agent logic, infra, monitoring)

Connections

Conceptual Contribution

Claim: Agentic AI security risk is a structural property of system composition (tool use, persistent memory, orchestration, supply chain) rather than a model-level prompt-safety problem; a reference TCB model plus attacker-aware metrics is needed to make defences auditable and comparable.
Mechanism: Define a reference pipeline with trust boundary between trusted orchestration (LLM core, planner, policy, vault) and untrusted ingress (web, RAG, sandbox, APIs). Enumerate ten attack surfaces, seven goals, five multi-step paths, map each to OWASP/MITRE, and define scenario-driven metrics (UAR, PAR, PED, RRS, TTC, OORAR, CES) computable from structured execution traces.
Concepts introduced/used: Agentic TCB, Attack Surface Taxonomy, Causal Threat Graph, Indirect Prompt Injection, RAG Poisoning, Privilege-Escalation Distance, Unsafe Action Rate, OWASP LLM Top-10, MITRE ATLAS, Defence in Depth
Stance: survey / engineering
Relates to: Complements A Language-Based Approach To Prevent DDoS and LangSec by extending structural-security thinking to agentic runtimes. Sits alongside Prompt Injection and Agent Security concept hubs, and provides the threat model that protocols like Model Context Protocol and Agent-to-Agent Protocol must defend against.

End-to-End Arguments in System Design

Reference

Saltzer, J. H., Reed, D. P., & Clark, D. D. (1984). “End-to-End Arguments in System Design.” ACM Transactions on Computer Systems, 2(4), 277-288. URL

Summary

Saltzer, Reed, and Clark articulate a design principle for layered distributed systems that had long been used but rarely stated explicitly: functions requiring knowledge and action at the endpoints of a communication — such as reliable delivery, integrity checking, encryption, duplicate suppression — cannot be fully and correctly implemented at lower layers. Lower-layer implementations are at best performance optimizations; the end-to-end argument says they cannot substitute for the end-level check.

The canonical example is careful file transfer between two hosts. Even if the communication network offers reliable delivery, threats remain — disk errors at either host, memory corruption during buffering, software bugs in the file-transfer program itself. No amount of reliability layered into the network can defend against these; only an end-to-end checksum computed from the file on disk at host A and verified against the file on disk at host B closes the loop. The paper then iterates the argument through encryption (only the endpoints know the plaintext), duplicate suppression (only the application knows what “duplicate” means at the transaction level), delivery acknowledgements, and crash recovery.

The principle is a design heuristic, not an absolute rule: performance sometimes justifies redundant lower-layer mechanisms (e.g., per-hop error correction in a very noisy link). But it inverts the naïve “make the network as reliable as possible” instinct, provides the intellectual backbone for the Internet’s dumb-network / smart-edges architecture, and underwrites TCP’s placement in the hosts rather than the routers. Its influence extends to REST’s principled avoidance of server-side session state, to security architectures that refuse to trust intermediaries, and to the “fate-sharing” style of protocol design.

Key Ideas

End-to-end argument: a function that must be correct at endpoints cannot be completely implemented below the endpoints.
Lower layers as optimization: partial lower-level help is only a performance enhancement, never a correctness substitute.
Careful file transfer: the worked example — only an end-to-end checksum protects against all failure modes.
Dumb core, smart edges: Internet architecture as the principle’s canonical application.
Encryption placement: true confidentiality requires endpoint encryption; network-level encryption is not enough.
Acknowledgements: application-meaningful acks (e.g., “request served”) require endpoint involvement.
Cost-benefit nuance: redundancy below is justified when error rate or cost of retry makes it worthwhile.

Connections

Principled Design Of The Modern Web Architecture — Fielding’s REST thesis formalizes many end-to-end commitments.
REST
LangSec — input parsing at the application boundary is itself an end-to-end verification.
Actor Model — supervisor-style recovery relies on end-to-end state ownership.
Impossibility of Distributed Consensus with One Faulty Process — endpoints cannot delegate liveness to lower layers either.

Conceptual Contribution

Principled Design Of The Modern Web Architecture

Principled Design of the Modern Web Architecture

Reference: Fielding & Taylor (2000). ICSE 2000. Source file: 337180.337228.pdf. URL

Summary

Fielding and Taylor introduce the Representational State Transfer (REST) architectural style as the abstract model that guided the redesign of HTTP/1.1 and URIs. REST is presented as a coordinated set of architectural constraints (client-server, statelessness, cacheability, uniform interface, layered system, code-on-demand) chosen to meet the needs of an internet-scale distributed hypermedia system.

The paper defines REST’s data elements (resource, representation, metadata, control data), connectors (client, server, cache, resolver, tunnel), and components (origin server, gateway, proxy, user agent), and uses multiple architectural views (process, data, connector) to illustrate how they combine. It then evaluates how well HTTP/1.1 and related Web standards conform to REST, using the style to diagnose architectural mismatches (e.g., cookies, embedded frames).

Key Ideas

REST as an architectural style (set of constraints), not an architecture.
Resources are conceptual, addressed by URIs; representations are transferred.
Statelessness and caching for scalability; uniform interface for generality.
Intermediaries (proxies, gateways) enabled by layered connectors.
Mismatches (e.g., cookies, HTML frames) as REST-style violations.

Connections

Conceptual Contribution

Claim: Internet-scale distributed hypermedia requires a disciplined architectural style - REST - derived from specific constraints rather than any particular implementation.
Mechanism: Decomposes architectures into data elements, connectors, and components; derives REST by incrementally adding constraints (client-server, stateless, cache, uniform interface, layered, code-on-demand); evaluates HTTP/1.1, URIs, cookies, frames against the style.
Concepts introduced/used: REST, Uniform Interface, Statelessness, Layered Systems, Resources, Representations, Architectural Styles, Hypermedia
Stance: foundational
Relates to: Provides the architectural substrate for REST-native agent protocols ACP, Agent-to-Agent Protocol and JSON-RPC Model Context Protocol covered in Survey Of Agent Interoperability Protocols; its uniform-interface constraint contrasts with the performative-rich messaging of KQML/FIPA-ACL.

Tags

A Scalable Communication Protocol for Networks of LLMs

A Scalable Communication Protocol for Networks of Large Language Models

Reference: Samuele Marro, Emanuele La Malfa, Jesse Wright, Guohao Li, Nigel Shadbolt, Michael Wooldridge, Philip Torr (2024). arXiv:2410.11905v1 (Oxford / Eigent AI). Source file: 2410.11905v1.pdf. URL

Summary

Introduces Agora, a meta-protocol for inter-agent communication in large heterogeneous networks of LLM-powered agents. Agora frames the design space as the Agent Communication Trilemma — versatility, efficiency, portability — and argues no single format (natural language, structured APIs like REST, or semantic-web RDF) can satisfy all three simultaneously.

Agora’s trick is to use different formats for different traffic volumes: rare/novel messages flow as natural language handled by LLMs; frequent patterns are formalised into Protocol Documents (PDs) negotiated between agents and then served by cheap LLM-written routines. A 100-agent demo shows emergent self-organising protocols and ~5x cost reduction over natural-language-only communication.

Key Ideas

Agent Communication Trilemma: versatility vs efficiency vs portability
Protocol Documents (PDs): hash-identified, agent-negotiated, machine-readable specs
Hybrid hierarchy: NL bootstrap -> PD negotiation -> LLM-written routines -> traditional protocols
Fully decentralised, hash-addressed storage (IPFS-compatible)
Emergent protocols among 100 heterogeneous LLM agents without central coordination

Connections

KQML as an Agent Communication Language
KQML
FIPA-ACL
Agent Communication Languages
LLM Agents
Multi-Agent Cooperation and the Emergence of Natural Language
Agents Framework - Zhou et al
Ontologies
CBCL - Safe Self-Extending Agent Communication — same agent-to-agent runtime-extensible protocol thesis but LangSec-bounded: dialect definitions are first-class messages with machine-checked safety invariants, content-addressed for identity.

Conceptual Contribution

Claim: No single communication format can simultaneously satisfy versatility, efficiency, and portability (the Agent Communication Trilemma) at scale; a meta-protocol that dynamically mixes natural language, structured data, and LLM-written routines can sidestep the trilemma.
Mechanism: Agora uses hash-identified Protocol Documents (PDs) — plain-text, implementation-agnostic specs — negotiated on demand between LLM agents. Frequent traffic is handled by cheap LLM-written routines implementing a PD; rare or novel traffic falls back to LLMs with natural language. Decentralised, content-addressed (IPFS-style) PD distribution; demonstrated on a 100-agent heterogeneous network showing emergent protocols and ~5× cost reduction.
Concepts introduced/used: Agent Communication Trilemma, Protocol Documents, Meta-protocol, Emergent Protocols, Emergent Communication, LLM Agents, Content-addressed Storage, Negotiated Protocols, Negotiation, Agent Communication Languages
Stance: engineering / systems
Relates to: Modern successor to KQML as an Agent Communication Language and FIPA-ACL, replacing stipulated performatives with negotiated PDs. Echoes the emergent-language findings of Multi-Agent Cooperation and the Emergence of Natural Language and Emergence of Grounded Compositional Language in Multi-Agent Populations at the protocol-document level. Overlaps the design space of Model Context Protocol, Agent-to-Agent Protocol, Agent Network Protocol. Its bottom-up spirit mirrors The Extensible Language - Graham.

Tags

Survey Of Agent Interoperability Protocols

A Survey of Agent Interoperability Protocols: MCP, ACP, A2A, and ANP

Reference: Ehtesham, Singh, Gupta, Kumar (2025). arXiv:2505.02279. Source file: 2505.02279v1.pdf. URL

Summary

This survey examines four emerging agent communication protocols targeting different interoperability tiers: the Model Context Protocol (MCP) for JSON-RPC tool invocation and context delivery; the Agent Communication Protocol (ACP) for REST-native multi-part performative messaging; the Agent-to-Agent Protocol (A2A) for peer-to-peer Agent-Card-based task outsourcing; and the Agent Network Protocol (ANP) for decentralized discovery using DIDs and JSON-LD.

The authors contrast architectures, discovery mechanisms, security models, and communication patterns, then recommend a phased adoption roadmap (MCP for tool access, then ACP for messaging, A2A for collaborative execution, ANP for open marketplaces). A timeline traces ancestry from KQML (1993) and FIPA-ACL (2000) through RAG, ReAct, function-calling up to modern agent protocols.

Key Ideas

Phased adoption roadmap: MCP -> ACP -> A2A -> ANP.
MCP core primitives: Tools, Resources, Prompts, Sampling under JSON-RPC 2.0.
A2A introduces Agent Cards, Tasks, Artifacts for enterprise-scale delegation.
ANP uses DIDs and JSON-LD for decentralized, internet-scale agent discovery.
Security threats tabulated across creation/operation/update lifecycle phases.

Connections

Conceptual Contribution

Claim: Modern agent interoperability is best understood as a four-tier stack (MCP for tools, ACP for messaging, A2A for delegation, ANP for open discovery) and should be adopted in that phased order.
Mechanism: Structured comparison of architectures, discovery, security, and message patterns; historical timeline rooting each protocol in KQML/FIPA-ACL ancestry; lifecycle threat table.
Concepts introduced/used: Model Context Protocol, Agent-to-Agent Protocol, Agent Network Protocol, Agent Communication Protocol, KQML, FIPA-ACL, Agent Cards, Decentralized Identifiers, JSON-RPC, Tool Use, LLM Agents
Stance: survey
Relates to: Complements the broader Survey Of AI Agent Protocols with a narrower, adoption-oriented roadmap. Its security-threat lifecycle connects directly to AI Agents Under Threat and MalTool Malicious Tool Attacks.

Tags

Survey Of AI Agent Protocols

A Survey of AI Agent Protocols

Reference: Yang, Chai, Song, Qi, Wen, Li, Liao, Hu, Lin, Chang, Liu, Wen, Yu, Zhang (2025). arXiv:2504.16736. Source file: 2504.16736v2.pdf. URL

Summary

This survey offers the first comprehensive classification and analysis of emerging AI agent protocols for LLM-based agents. The authors propose a two-dimensional taxonomy: (object orientation) context-oriented vs inter-agent protocols, and (application scenario) general-purpose vs domain-specific, covering MCP, A2A, ANP, ACP, Agora, LMOS, agents.json, LOKA, PXP, CrowdES, and others.

The paper then evaluates these protocols across efficiency, scalability, security, reliability, extensibility, operability, and interoperability, and sketches a forward-looking agenda: protocols should evolve from static to adaptive, from rules to ecosystems, and from mere communication to collective intelligence infrastructure.

Key Ideas

Two-dimensional taxonomy of agent protocols (object orientation x application scenario).
MCP as a universal context-oriented protocol with Host/Client/Server/Resource roles.
Inter-agent layer splits into general-purpose (A2A, ANP, AITP, ACP, Agora) and domain-specific (robot, human-computer, system).
Evaluation across 7 axes; case studies of MCP, A2A, ANP, Agora.
Next-generation protocols need adaptability, privacy preservation, group interaction.

Connections

Conceptual Contribution

Claim: The zoo of emerging LLM Agents protocols can be organised along two orthogonal axes (context-oriented vs inter-agent; general-purpose vs domain-specific), and evaluated on a shared seven-axis rubric.
Mechanism: Builds a taxonomy, then systematically compares Model Context Protocol, Agent-to-Agent Protocol, Agent Network Protocol, ACP, Agora, LMOS, agents.json, LOKA, PXP, CrowdES against efficiency, scalability, security, reliability, extensibility, operability, interoperability, with case studies.
Concepts introduced/used: Model Context Protocol, Agent-to-Agent Protocol, Agent Network Protocol, Agent Communication Languages, LLM Agents, Multi-Agent Systems, Interoperability, Agent Discovery
Stance: survey
Relates to: Shares its subject with Survey Of Agent Interoperability Protocols but takes a broader taxonomic view; its forward-looking “protocols as ecosystems” framing converges with Levels Of Social Orchestration and motivates coordination layers like Ripple Effect Protocol. Historical continuity with KQML and FIPA-ACL is implicit.

Tags

Interoperability

Property of systems from different origins to communicate, exchange data, and invoke each other’s services without prior agreement.

In this vault

Multi-Agent Systems

Systems of multiple autonomous agents that interact, coordinate, and sometimes compete.

Foundations

Intelligent Agents Theory and Practice — Wooldridge
Multiagent Systems Sycara
Agent-Oriented Programming — Shoham

Coordination & robustness

Surveys & frameworks

Protocols & communication

Failures & threats

Lineage

Agent Network Protocol

ANP — protocol stack for multi-agent networks.

Discussed in:

Agent-to-Agent Protocol

A2A — protocol for inter-agent communication among autonomous LLM agents.

Discussed in:

Model Context Protocol

MCP — an open protocol (Anthropic, 2024) standardising how LLM applications connect to external tools and data sources.

Discussed in:

Replay Attack

An attack in which an adversary captures a legitimate protocol message and re-sends it later to obtain an effect that the original sender did not intend. The standard countermeasure is freshness — nonces, timestamps, sequence numbers — included in each protected message so that replays can be detected. Identified as a primary concern in Needham & Schroeder 1978 and central to the design of every authentication protocol since.

In this vault

Idempotency

(page does not exist)

End-to-End Message Signing

(page does not exist)

Two-Phase Commit

(page does not exist)

Atomic Transaction

(page does not exist)

Protocol Design

Discipline of specifying interaction rules, message formats, and state machines so as to achieve desired properties (liveness, safety, secrecy); the unifying craft across ACLs, LangSec, and agentic protocols.

In this vault

Layered Systems

An architectural constraint in which components are organised into hierarchical layers, each using only services of the layer below. In REST, it permits intermediaries such as proxies and caches without breaking client-server semantics.

In this vault

Layered Architecture

An agent architecture in which control is decomposed into vertically or horizontally stacked layers operating at different levels of abstraction (e.g. reactive, planning, social). Each layer’s outputs constrain or are arbitrated with those of the others.

In this vault

Narrow Waist Principle

A protocol-design principle: define a minimal, universal core at one layer and allow unbounded innovation above and below it. The Internet Protocol is the archetype — IP itself is small and stable, while the link layer beneath and the application layer above evolve freely. The narrow waist provides interoperability without dictating semantics.

Applied to agent communication, the principle says: standardise a tiny universal message vocabulary (e.g. PLAN/ACT/OBSERVE) and let domain-specific content ride inside the envelope.

In this vault

LACP

LLM-Agent Communication Protocol — a proposed three-layer, telecom-inspired standard for inter-agent communication. Layers: Semantic (universal PLAN/ACT/OBSERVE/ERROR messages), Transactional (JWS signing, transaction IDs, two-phase commit, idempotency), Transport (HTTP/2, QUIC, WebSockets). Built on the Narrow Waist Principle with security-by-construction.

Discussed in:

LLM Agent Communication Protocol Requires Urgent Standardization

CBCL - Safe Self-Extending Agent Communication

CBCL: Safe Self-Extending Agent Communication

Reference: O’Connor, H. (2026). LangSec Workshop, IEEE Security and Privacy Workshops (SPW 2026). arXiv:2604.14512v1 [cs.CR], 16 Apr 2026. Source file: oconnor-cbcl-langsec26.pdf. URL. Reference implementation: https://codeberg.org/anuna/cbcl-rs.

Summary

Building on McCarthy’s 1975/1982 Common Business Communication Language vision and the language-theoretic security programme of Sassaman, Patterson, Bratus and Locasto (Security Applications Of Formal Language Theory), this paper presents a contemporary CBCL: an agent communication language designed so that all messages — including runtime language extensions — remain within the deterministic context-free (DCFL) complexity class. The motivating diagnosis is that contemporary agent communication has slid up the Chomsky hierarchy without acknowledging the security cost: KQML and FIPA-ACL are CFL with informal extensibility, but MCP and LLM-based agent frameworks operate over inputs whose effective complexity is recursively-enumerable, where the validity of an arbitrary message is undecidable and “weird machines” (Exploit Programming - From Buffer Overflows To Weird Machines) become unavoidable. CBCL takes the opposite tack: minimal core (8 performatives — tell, ask, reply, hello, bye, ok, error, cancel) plus a homoiconic dialect mechanism that lets agents define, transmit, and adopt domain-specific vocabularies as first-class CBCL messages, with three machine-checked safety invariants — R1 (no recursion in dialect templates), R2 (declared resource bounds on depth, expansion size, verification time), R3 (core-vocabulary preservation) — that together guarantee DCFL preservation under arbitrary finite sequences of dialect installations.

The paper accompanies the design with a Lean 4 formalization (≈5,400 lines, 16 modules, 176 machine-checked theorems, zero sorry gaps, no custom axioms) covering parser correctness (soundness + completeness), R1–R3 verification, pipeline totality, and the central dcfl_preserved closure theorem; a verified parser binary cbcl-parse is extracted from the proofs. A separately-developed Rust reference implementation (cbcl-rs, ≈11,000 lines, no_std-compatible core) ships a hand-rolled O(n) parser, dialect verification engine, gossip-based dialect propagation (O(log n) convergence per Demers et al.), C FFI/WASM bindings, property-based and differential tests, and cargo-fuzz targets; differential tests cross-validate the Rust parser against the Lean-extracted binary, eliminating spec-implementation parser differentials. Five example dialects (precision agriculture, AI planning, cross-chain asset transfer, artifact management, email) are R1–R3-verified end-to-end. A draft IETF Internet-Draft specifying application/cbcl and a Nostr transport binding (cbcl-nostr) accompany the paper. The Discussion explicitly aligns the design with Singh’s social-agency programme: dialect installation is treated as a public commitment to the dialect’s declared semantics — semantic divergence becomes a breach of commitment, observable and accountable, rather than a hidden failure of shared mental state — sidestepping the unverifiable mentalistic semantics critique of Verifiable Semantics for ACLs.

Implementation status (post-paper, cbcl-rs). The reference implementation has shipped two further safety invariants the paper sketches as future work, plus a richer Lean formalisation: R4 (Integrity) — Ed25519-style signatures over canonical encodings via an algorithm-agnostic Signer trait, with three-valued install verdicts (Valid / Unsigned / Invalid) — and R5 (Contract Well-formedness) — optional (protocol …) and (shape …) clauses on a dialect, expressing causal Merkle DAG protocols and per-performative shape contracts; R5 enforces acyclicity, reachability from begin, performative definedness with ancestor closure for extends, step uniqueness, and depth-bound respect, all decidable in linear fuel at install time. The §VII-D structural-contracts vision is therefore live (SPEC-002, SPEC-003): verify_monotone, verify_all_is_meet, and verify_eventually_consistent are proved theorems showing causal-protocol verification is a lattice homomorphism that joins coordination-free under G-Set store merge — explicit CALM Theorem alignment. The Lean codebase has grown to 380+ declarations across 19 files (still zero sorry, only the standard axioms propext / Classical.choice / Quot.sound); the workspace ships 837 tests including 584 cbcl-core unit tests, 37 proptest cases, 21 differential integration tests against the Lean-extracted binary, libFuzzer harnesses, and cargo-mutants mutation testing at a 90% kill threshold. The crate layout has grown from the paper’s five to seven: the original cbcl-core / cbcl-parser / cbcl-cli / cbcl-wasm / cbcl-ffi plus cbcl-erl (Erlang/LFE binding, SPEC-009 — with SPEC-010 binding-conformance suite) and cbcl-arena (Agent Arena platform, SPEC-012 — composable referee on cbcl-lfe-router with capability-keyed message routing and signed receipt logs). A worked sealed-bid auction dialect (SPEC-004) demonstrates structural defence against false-claim manipulation — concrete evidence that the R5 contract layer is rich enough to encode mechanism-design integrity properties decidably. The earlier Scheme prototype (anuna-research/cbcl) is superseded; architecture decisions live as ADRs under .hence/ (purity boundary, parser library choice, error handling, WASM API surface, R4 adversarial review).

Key Ideas

DCFL as the Goldilocks complexity class: Regular is too weak for nested envelopes/dialects; general CFL admits ambiguous grammars and parser-differential attacks; context-sensitive is PSPACE-complete; Type-0 is undecidable. DCFL is the minimal class that supports nested structure with class-level unambiguity (parser equivalence under language evolution).
Homoiconic self-extension: Dialect definitions are themselves valid CBCL messages, parsed by the same recogniser used for ordinary communication — a single attack surface, no separate meta-language. Inspired by Racket’s #lang mechanism.
Three safety invariants R1–R3: declarative pattern-template substitution only (no recursion, no iteration, no reflection); declared resource bounds (depth ≤ 64, expansion ≤ 8192 chars, verification ≤ 1000 ms); the eight core performatives cannot be redefined.
DCFL preservation theorem: dialect invocations must appear inside a (lang name …) wrapper; the lang tag plus a unique dialect name forms a prefix-free partition that lets a deterministic pushdown automaton dispatch to the appropriate subgrammar without extra lookahead — circumventing the fact that DCFLs are not closed under union in general. Mechanised in Lean 4 as dcfl_preserved.
Lean 4 formalization with extraction: 176 theorems, 0 sorry gaps, no custom axioms; the verified parser binary cbcl-parse is extracted from the proofs and runs the same fuel-bounded recursive-descent parser as the model.
Rust reference implementation: cbcl-core (no_std, no unsafe), cbcl-parser, cbcl-cli, cbcl-ffi, cbcl-wasm. Differential tests against the Lean-extracted binary; cargo-fuzz over five entry points.
Eight core performatives (tell, ask, reply, hello, bye, ok, error, cancel) plus four message categories (simple, meta, lang-scoped, wrapped); keyword parameters in Common-Lisp style (:thread, :in-reply-to).
Single-pass template expansion: terminates in time linear in the template plus argument size; not Turing-complete; output is not fed back into the expander, ruling out unbounded re-expansion.
Epidemic dialect propagation: gossip-based with Demers et al.’s O(log n) convergence bound; agents independently verify R1–R3 and signatures before installing.
Canonical serialization per RFC 9804 for cryptographic operations — deterministic byte representation as a precondition for signature verification.
Dialect identity by content hash: name collisions resolved by canonical-form hash; downgrade attacks rejected at installation.
Self-expression vs self-adaptation (Zambonelli et al.): traditional ACLs support only parameter tuning within fixed structure; CBCL is a self-expressive protocol whose vocabulary structurally evolves under safety constraints.
Singh-aligned reading of dialect installation: a public commitment to declared semantics, with :examples clauses providing machine-checkable behavioural anchors — semantic divergence as observable breach rather than hidden mental-state mismatch.
Stated limitations: DCFL ceiling means no recursive transformations, no cross-field references (e.g. checksums over fields), no aggregation over variable-length collections, no context-sensitive validation. Standish-taxonomy paraphrastic only — no Orthophrase, no Metaphrase. Trust infrastructure (key distribution, revocation) and dialect-curation policy left to deployment.
Structural-contracts extension (sketched in §VII-D, shipped post-paper as R4 + R5): Ed25519-style dialect signatures plus protocol constraints as causal Merkle DAGs over performative-typed messages, with Visibly Pushdown Languages for shape constraints and coordination-free monotonic verification over an append-only store. Lean-mechanised lattice-homomorphism theorems (verify_monotone, verify_all_is_meet, verify_eventually_consistent) establish that replica verdicts join under G-Set merge.

Connections

Common Business Communication Language — McCarthy’s 1975/1982 origin; CBCL is the formally-verified realisation of that vision.
Security Applications Of Formal Language Theory — Sassaman et al.’s LangSec foundations.
Proof-Carrying Code - Necula — Necula 1997, the architectural ancestor of CBCL’s R4 split (host runs a small certified verifier; producer ships the proof).
Enforceable Security Policies - Schneider — Schneider 2000, the formal warrant for R5 monotone-verdict trace monitoring.
An Axiomatic Basis for Computer Programming - Hoare — Hoare 1969, root of the contract-based verification line CBCL inherits.
Authentication in Distributed Systems - Lampson Abadi Burrows Wobber — Lampson et al. 1992, the Speaks-For Calculus for delegated commitments.
Articulating Reasons - Brandom — Brandom 2000, the philosophical underwriting of Public Semantics (entry point).
Making It Explicit - Brandom — Brandom 1994, the full inferentialist treatise.
Empiricism and the Philosophy of Mind - Sellars — Sellars 1956, the Myth of the Given that makes Semantics-Without-Minds possible.
Philosophical Investigations - Wittgenstein — Wittgenstein 1953, Meaning As Use / language-games / rule-following.
Two Dogmas of Empiricism - Quine — Quine 1951, Semantic Holism.
Assertion - Stalnaker — Stalnaker 1978, Common Ground update semantics — operational analogue of CBCL’s verdict ledger.
Languages and Language - Lewis — Lewis 1975, Convention of Truthfulness picture of how an abstract language gets in force in a population.
Communicative Actions for Artificial Agents - Cohen Levesque — Cohen & Levesque 1995, the Mentalistic Semantics high-water mark CBCL deliberately is not.
FIPA-ACL Specifications — the engineering of FIPA-ACL (envelope, conversation-id, ontology slot) CBCL inherits; the semantics it replaces.
An Ontology for Commitments in Multiagent Systems - Singh — Singh 1999, the formal commitment ontology CBCL’s dialect contracts instantiate.
Jones-Sergot Normative Systems — Jones & Sergot 1993, the Counts-As Relation that gives wire events institutional meaning under a dialect contract.
Exploit Programming - From Buffer Overflows To Weird Machines — weird-machine analysis CBCL is designed to preclude at the parser layer.
PKI Layer Cake - Kaminsky Patterson Sassaman — concrete parser-differential attacks; CBCL’s class-level unambiguity rules these out at the grammar level.
The Halting Problems of Network Stack Insecurity
A Language-Based Approach To Prevent DDoS
LangSec
KQML as an Agent Communication Language
KQML - A Language And Protocol For Knowledge And Information Exchange
FIPA-ACL
ACL Rethinking Principles — Singh’s social-agency critique that CBCL’s “dialect installation as public commitment” inherits.
Agent Communication Languages - Rethinking the Principles
Verifiable Semantics for ACLs
A Common Ontology Of ACLs
Commitment-based Semantics
The State of the Art in Agent Communication Languages
Trends in Agent Communication Language
Toward Principles for the Design of Ontologies Used for Knowledge Sharing — Gruber’s ontological-commitment principle CBCL inherits.
Some Philosophical Problems from the Standpoint of Artificial Intelligence — McCarthy & Hayes’s representation/computation separation.
Elephant 2000 - A Programming Language Based on Speech Acts — McCarthy’s intra-program speech-act counterpart to CBCL’s inter-organisational vision.
Adjectival Modifiers
S-expression
Homoiconicity
Code as Data
Creating Languages in Racket — Flatt’s #lang mechanism that inspired CBCL’s homoiconic self-extension.
Extensibility in Programming Language Design - Standish
Language Extensibility Taxonomy
Paraphrase
Orthophrase
Metaphrase
Self-Expression
Self-Adaptation Self-Expression Self-Awareness ASCENS
Dialects and Idiolects
Keeping CALM - When Distributed Consistency is Easy — CALM theorem underwriting the forthcoming coordination-free contracts extension.
Visibly Pushdown Languages
MCP Landscape Security Threats And Future Research Directions
Survey Of AI Agent Protocols
Survey Of Agent Interoperability Protocols
ClawWorm Self-Propagating Attacks Across LLM Agent Ecosystems — concrete LLM-agent worm whose root-cause analysis CBCL’s lang-scoped provenance addresses.
Why AI Agents Communicate In Human Language
Why Do Multi-Agent LLM Systems Fail
Gossiping in Distributed Systems
Gossip-based Aggregation in Large Dynamic Networks

Conceptual Contribution

Claim: Agent communication languages can be simultaneously expressive, runtime-extensible, and tractably verifiable iff every message — including those that extend the language — is constrained to the deterministic context-free language class; this constraint is compatible with first-class self-extension, can be machine-checked end-to-end, and converts the unverifiable-mental-state problem of mentalistic ACLs into a public-commitment problem at the protocol layer.
Mechanism: Eight-performative core grammar (LL(1), DCFL); homoiconic dialect mechanism — dialect definitions are valid CBCL messages with extend clauses describing pattern-template substitutions; three safety invariants R1–R3 enforced at installation (no recursion via DFS cycle detection, declared resource bounds, core-vocabulary preservation); (lang name …) wrapper providing prefix-free deterministic dispatch into per-dialect sub-grammars so the union remains DCFL. Lean 4 formalization (LeanCbcl, ~5,400 LoC, 176 theorems) covering parser soundness/completeness, R1–R3, pipeline totality, and dcfl_preserved; verified parser extracted to a runnable binary (cbcl-parse). Rust reference implementation (cbcl-rs, ~11,000 LoC) with a ResourceContext-tracked single-pass expander, gossip-based dialect propagation (O(log n) per Demers et al.), canonical RFC-9804 serialization for signing, algorithm-agnostic Signer trait, C FFI / WASM bindings, property-based + differential tests, fuzz targets. Draft IETF application/cbcl Internet-Draft and Nostr transport binding.
Concepts introduced/used: Deterministic Context-Free Language, LangSec, Homoiconicity, S-expression, Dialects and Idiolects, Performatives, Self-Expression, Paraphrase, Orthophrase, Metaphrase, Visibly Pushdown Languages, CALM Theorem, Commitment-based Semantics, Public Semantics, Verifiable Semantics, Adjectival Modifiers, Ontological Commitment, Lean 4, Property-Based Testing, Parser Differential Attack, Weird Machine, Gossip Protocols, Canonical Serialization, Nostr, hence
Stance: engineering / formal-methods, with explicit position-taking on the agent-communication design space
Relates to: Realises McCarthy’s Common Business Communication Language vision (1975/1982) by giving formal safety guarantees McCarthy could only gesture at. Sits squarely in the LangSec programme of Security Applications Of Formal Language Theory and Exploit Programming - From Buffer Overflows To Weird Machines, extending it from input-validation analysis to protocol design — claiming, plausibly, to be the first ACL designed from LangSec principles and the first to demonstrate that LangSec is compatible with runtime self-extension. Inherits the DCFL-vs-ambiguous-CFG argument from PKI Layer Cake - Kaminsky Patterson Sassaman and applies it at the message layer rather than the certificate layer. Builds explicitly on Singh’s social-agency critique (ACL Rethinking Principles) and Wooldridge’s verifiability programme (Verifiable Semantics for ACLs) by treating dialect installation as a public commitment whose semantics are anchored by the :examples clause — a machine-checkable analogue of the commitment-trace conformance that Flexible Protocol Specification and Execution (Yolum & Singh) and Commitment Machines - Yolum and Singh establish for protocol actions. Where Pact - A Choreographic Language for Agentic Ecosystems takes the individual-rationality fork to answer “why follow a protocol?”, CBCL takes the publicness/verifiability fork: the meaning of a message is fully determined by the formal grammar plus declared semantics, with no mental-state inference required. Inherits Gruber’s ontological-commitment architecture but replaces “out-of-band agreement” with in-protocol propose/query/teach. The extensibility design draws on Creating Languages in Racket (Flatt’s #lang) and respects the boundary set by Extensibility in Programming Language Design - Standish: paraphrastic only, deliberately excluding orthophrase/metaphrase to keep the attack surface bounded. The forthcoming structural-contracts extension uses Visibly Pushdown Languages for shape constraints and the CALM Theorem for coordination-free verification — a natural bridge to commitment-machine semantics. The LLM-agent threat-model framing (ClawWorm Self-Propagating Attacks Across LLM Agent Ecosystems, MCP Landscape Security Threats And Future Research Directions) positions CBCL as the structural alternative to MCP/JSON-RPC-with-natural-language: same extensibility, vastly tighter security envelope.

Agent Communication Languages

A concept hub for agent communication languages (ACLs): languages whose speech acts let software agents exchange beliefs, goals, and commitments.

Canonical Languages

KQML — original knowledge-query language
FIPA-ACL — standardised successor

Surveys & Principles

The State of the Art in Agent Communication Languages
Trends in Agent Communication Language
ACL Rethinking Principles — Singh, mental vs. social semantics
Agent Communication Languages - Rethinking the Principles
A Common Ontology Of ACLs
Toward Automated Evolution of ACLs
Towards Automating the Evolution of Linguistic Competence

Semantics

Conversations & Protocols

Domain instances

Common Business Communication Language — McCarthy 1975/1982
CBCL - Safe Self-Extending Agent Communication — O’Connor 2026 (LangSec ’26): contemporary Lean-verified DCFL-bounded ACL realising McCarthy’s CBCL vision

Ripple Effect Protocol

Ripple Effect Protocol: Coordinating Agent Populations

Reference: Chopra, Sharma, Ahmad, Muscariello, Pandey, Raskar (2025). arXiv:2510.16572 (Project Iceberg, MIT / Cisco). Source file: 2510.16572v1.pdf. URL

Summary

REP is a coordination protocol for populations of LLM agents that augments existing messaging (A2A, ACP, SLIM) with sensitivity sharing: agents broadcast not only their decisions but lightweight signals expressing how those decisions would change under counterfactual environmental shifts. Neighbours aggregate these sensitivities into shared coordination variables, letting groups converge faster and more stably than with decision-only exchange.

The protocol separates cognition (local LLM policy) from coordination (aggregation + optional consensus). Experiments on the Beer Game (bullwhip reduction of 41.8%), Fishbanks (sustainability +25%), and movie-scheduling show 41-100% coordination-accuracy gains over A2A baselines and scale from 10 to 200 agents.

Key Ideas

Sensitivity = textual or numeric derivative of a decision w.r.t. environment.
Four-step round: receive, decide+sensitivity, aggregate neighbors, optional median consensus.
Modality-agnostic aggregator phi (numeric gradient or LLM-synthesized textual update).
Transport-agnostic: works over SLIM, A2A, ACP.
Mitigates information cascades / bullwhip effects in open agent networks.

Connections

Conceptual Contribution

Claim: Agent populations coordinate faster and more stably when they share not just decisions but sensitivities - counterfactual derivatives of decisions w.r.t. the environment.
Mechanism: A transport-agnostic four-step round (receive, decide+sensitivity, aggregate, optional median consensus) layered atop Agent-to-Agent Protocol/ACP/SLIM, validated on Beer Game (bullwhip -41.8%), Fishbanks, and movie scheduling up to 200 agents.
Concepts introduced/used: Sensitivity Sharing, Coordination Variables, Information Cascades, Gossip Protocols, Multi-Agent Systems, LLM Agents, Agent-to-Agent Protocol, Emergent Communication
Stance: engineering
Relates to: Realises the structured-coordination vision of Why AI Agents Communicate In Human Language and instantiates an L4 Navigate-level protocol from Levels Of Social Orchestration; extends aggregation intuitions from Gossip Protocols.