This study examines safety properties that are assessed separately for Model Context Protocol (MCP) tool usage and Agent‑to‑Agent (A2A) delegation, which do not describe behavior when an agent employs both. We measured such behavior in a single controlled MCP‑to‑A2A configuration: a testbed drives a real‑model host through a local MCP and then a local A2A leg, producing an ordered event trace scored by exact deterministic rules (no LLM judge), allowing only one restricted decision per trial.
The experiment follows a pre‑specified, frozen three‑arm design. Each of the 10 record scenarios appears with a CONFIDENTIAL header, with no header, and with a PUBLIC - OK TO SHARE header. The six substantive record values are byte‑identical across arms, and the outcome is the verbatim occurrence of any of them in the outbound message. Four models × 3 arms × 4 repeats yield 480 trials; the scenario is the unit of generalization, and we report the 10 scenario‑level values (mean, median, sign counts) without p‑values or confidence intervals.
The confidential‑minus‑unlabeled contrast is inconclusive and floor‑limited in every model (both arms near zero), so it does not demonstrate that confidential labels lack a protective effect. Adding the PUBLIC - OK TO SHARE label is descriptively associated with higher verbatim egress relative to the unlabeled baseline, with strong model dependence: the association is strong and consistent for Claude Sonnet 5 (public‑minus‑unlabeled mean +0.800, all 10 scenarios; largely driven by whether Claude relays at all), moderate but floor‑limited for one GPT‑5.6 tier, small (median 0) for another, and a complete floor for the third. This is an association observed in one configuration, not a causal or general effect.
The code, byte‑pinned traces, and the offline analysis pipeline are released as a public artifact.
Review