Ant Group Drives Innovation in ASL Protocol to Enhance Trust in Smart Agent Interactions

As AI agents grow more autonomous and capable of collaborating with one another, organizations encounter security challenges that extend far beyond technical fixes, evolving into deeper trust issues. On April 29th, during the “Intelligent Agent Innovation and Governance” session of the 9th Digital China Construction Summit, Chen Liang, CTO of Ant Group’s Big Security team, delivered a keynote address in which he unveiled three specific “trust black holes” present in cross-agent collaboration for the first time. He also introduced an original security architecture designed specifically to meet the needs of enterprise-level intelligent agents.

The Three "Trust Black Holes": Fatal Weaknesses in Cross-Agent Collaboration

At the beginning of 2026, a study titled “Agents of Chaos” conducted by institutions including Northeastern University deployed multiple autonomous agents equipped with real tool invocation capabilities built on the OpenClaw framework. These agents were subjected to a two-week red team testing period, and the findings revealed that they could face serious security problems in complex open environments. Such issues included non-owner compliance actions, sensitive information leaks, and harmful operations at the system level.

Chen Liang explained that as multi-agent collaboration expands from within a single system to involve different organizations and platforms, three specific “trust black holes” are currently hindering large-scale enterprise deployment. The first is the “identity verification black hole,” where attackers may forge agent identifiers or borrow the identities of employee assistants to abuse identity whitelisting mechanisms. Additionally, multiple intermediate nodes could alter upstream identity information, preventing downstream entities from confirming the legitimacy of the sender. The second is the “intent tamper-proof transmission black hole,” which occurs when user instructions are altered by intermediate nodes in the collaboration chain, resulting in misinterpretations of sensitive data such as fund ownership and data access permissions. The third is the “authorization boundary control black hole,” where downstream agents might acquire capabilities that exceed those granted by upstream parties, leading to an uncontrolled expansion of permissions across the hierarchy.

Insights shared by IIFAA alongside the China Academy of Information and Communications Technology, Ant Group, and dozens of other organizations indicate that current MCP and A2A protocols focus primarily on interoperability and communication connections. However, these protocols fall short when it comes to addressing native trust challenges such as entity traceability, intent integrity, proper management of multi-level delegation boundaries, and auditability in cross-agent interactions. Existing security solutions also show significant limitations when dealing with the unique attack vectors specific to intelligent agents.

Solution: ASL Protocol Builds a "End-to-End Verifiable Trust Chain"

To overcome these shortcomings, Chen Liang proposed a solution grounded in the “Security by Design” principle. This solution consists of a secure and trustworthy interconnection protocol for agents named ASL (Agent Security Link). Functioning as a trusted interconnection protocol stack within the agent collaboration framework, ASL can be integrated on top of existing interoperability protocols like MCP and A2A. It creates a trust foundation that is verifiable, transferable, strictly constrained, and fully auditable for cross-agent interactions.

According to available reports, ASL features a layered architecture composed of “four types of capability components” combined with dedicated security infrastructure. The lower layer provides a progressively secure execution environment, ranging from software isolation to hardware isolation, along with a system for managing device binding keys. The upper layer relies on four core modules—trusted identity, trusted connection, trusted intent, and trusted authorization—to ensure verifiable identity binding, session-level secure communication channels, tamper-proof transmission of instructions, and strict limitation rather than expansion of authorization boundaries in multi-level delegation scenarios. As a result, every action taken by an agent throughout the collaboration process is traceable, all authorizations remain well-defined, and all intent transmissions are protected from unauthorized alteration.

In payment-related applications, ASL works together with the ACT intelligent agent commercial trust protocol. While ASL handles secure interconnection and authorization management between agents, ACT builds the trust foundation necessary for commercial transactions. Together, these protocols support the implementation of features such as instant payments and entrusted purchases.

From "Passive Response" to "Inherently Trustworthy": Full-Chain Security Loop

The adoption of the ASL protocol represents just one component of Chen Liang’s proposed agent-native security framework. Within this framework, the approach to security has shifted completely away from the traditional reactive model of “identifying vulnerabilities and releasing patches.” Instead, it aims to ensure that agents are inherently trustworthy by employing a layered isolation strategy along with robust defense mechanisms. This means integrating security capabilities into every stage of an agent’s lifecycle from its inception.

Specifically, the framework includes components for identity and access management—such as a unified identity system and dynamic lifecycle management of “agent operation licenses”—runtime security protection based on a five-layer control strategy derived from the “Digital Employee Constitution,” and security measures for AgentOS and underlying infrastructure, including mechanisms like the Landlock sandbox, namespace isolation, and TEE hardware isolation. This comprehensive system guarantees that agents maintain end-to-end security guarantees throughout cross-enterprise and cross-platform collaboration scenarios. Such guarantees include verifiable entity identities, tamper-proof intent transmission, and strictly controlled authorization boundaries.