Is your feature request related to a problem? Please describe.
More and more agents are deployed behind the Agent-to-Agent (A2A) protocol, for example Microsoft Foundry Agent Service incoming A2A endpoints and Google ADK agents. For a caller, A2A is often the only way in to such an agent, and it sits in front of the agent's server-side instructions, platform guardrails and tools. PyRIT has no target for A2A today, so red-teaming these agents needs a custom HTTPTarget setup that can't follow A2A's task lifecycle or keep an agent's context across turns.
Describe the solution you'd like
An A2ATarget prompt target that:
- speaks A2A 0.3 (
message/send) over JSON-RPC, with a fallback to 0.2 (tasks/send)
- maps each PyRIT conversation to one A2A context, so multi-turn attacks keep the agent's own server-side state
- handles the task lifecycle: blocking sends, polling pending tasks, continuing tasks that are waiting for input
- retries rate limits with
pyrit_target_retry, including rate limits the agent relays from its model
- returns JSON-RPC errors as PyRIT error responses rather than agent text
Describe alternatives you've considered, if relevant
HTTPTarget with a JSON template works for single requests, but it can't manage A2A context IDs, poll pending tasks, or tell a JSON-RPC error apart from an agent reply.
Additional context
I have an implementation in #2771, tested against a Microsoft Foundry prompt agent with incoming A2A enabled.
Is your feature request related to a problem? Please describe.
More and more agents are deployed behind the Agent-to-Agent (A2A) protocol, for example Microsoft Foundry Agent Service incoming A2A endpoints and Google ADK agents. For a caller, A2A is often the only way in to such an agent, and it sits in front of the agent's server-side instructions, platform guardrails and tools. PyRIT has no target for A2A today, so red-teaming these agents needs a custom
HTTPTargetsetup that can't follow A2A's task lifecycle or keep an agent's context across turns.Describe the solution you'd like
An
A2ATargetprompt target that:message/send) over JSON-RPC, with a fallback to 0.2 (tasks/send)pyrit_target_retry, including rate limits the agent relays from its modelDescribe alternatives you've considered, if relevant
HTTPTargetwith a JSON template works for single requests, but it can't manage A2A context IDs, poll pending tasks, or tell a JSON-RPC error apart from an agent reply.Additional context
I have an implementation in #2771, tested against a Microsoft Foundry prompt agent with incoming A2A enabled.