Typed-Field Forgery in Agent Communication Protocol Await-Resume: A Study of Content, Metadata, and Encoding Sub-Channels as Injection Vectors

<title>Abstract</title> <p>The Agent Communication Protocol (ACP) has a mechanism the neighbouring agent protocols lack: an agent can pause mid-run into an awaiting state and receive typed user-in-the-loop input through a MessageAwaitRequest/MessageAwaitResume pair. The resume payload flows back into the agent as a first-class Message and, in the naive implementation pattern the current ACP examples exhibit, into the model prompt verbatim. We show that this creates a specific injection surface, distinct from prompt injection over retrieval, tool descriptions, or agent-to-agent messaging: the pause point is publicly signalled, the resume is a small, structured, high-authority slot, and the guard that ran on the original user turn does not re-run on the resume. We name the attack family AWAKEN and study it on a real ACP 1.0 server (SDK 1.0.3) that runs two agents, a naive rough baseline and a defended variant that wraps the resume in a data-only fenced block bound to a per-await nonce. Across 4 real gateway backends (Gemini 3.1 Pro Low, Gemini 3.6 Flash Low, Claude Haiku 4.5, Claude Sonnet 5) and 5 attack families (direct instruction override, forged system tag, forged tool-return frame, urgency-authority framing, and unicode zero-width camouflage), the rough agent is hijacked in 14.4 percent of 195 attack resumes, led by zero-width-camouflaged override at 22.7 percent, while both benign controls sit at 0.0 percent, so the hijack is a genuine attack response and not a base rate. The defended agent drops to 1.5 percent of 205 attack resumes on the same threat model, and closes the weaker off-channel-attacker model (an attacker who cannot see the await prompt and cannot echo the nonce) at 100.0 percent of 27 attempts, before any model call is made. A third study extends the attack surface from the content string to the other typed fields ACP's MessagePart exposes but the general prompt-injection literature does not target: content_type, content_encoding, multipart parts, and metadata. The four typed-field sub-techniques hijack the rough agent in 20.0 percent of 65 attack cells, led by metadata-forgery at 33.3 percent, while the defended agent refuses all four structurally at 100.0 percent of 72 attempts. The contributions are: a first per-family measurement of a protocol-specific injection surface unique to ACP, with a sub-taxonomy covering the typed MessagePart fields; a two-layer defense (nonce for the off-channel case, structural fence plus policy prompt for the MITM case) with an honest accounting of what each layer buys; and a released testbed with fail-closed number verification across three sources of truth so a deployer can re-run the sweep against their own agent.</p>