At A Glance
- A traffic pattern that barely existed before 2024 now moves through most enterprise networks daily: agents calling other agents, orchestrators dispatching sub-agents, and tasks that move between services with no human in the loop.
- This traffic moves east-west, inside the segments your network team drew for a completely different topology, and most segmentation tools weren’t designed to see it.
- Machine identities outnumbered humans 80 to 1 in CyberArk’s 2025 research. One year later, under Palo Alto Networks, that ratio hit 109 to 1, with AI agent identities expected to grow another 85% in the next twelve months.
- What an agent can reach after it’s compromised defines the blast radius, but containing that reach doesn’t require mapping every agent-to-agent path in advance.
Picture an orchestrator agent handed one task: research a competitor, draft a summary, file it to the team’s workspace. That single task fans out into calls to a search tool, a drafting sub-agent, and a file-system connector, each one a new network connection that nobody wrote a firewall rule for and nobody will see in a VPC flow log. Multiply that by every agentic workflow running in a modern enterprise, and you get a traffic pattern that’s grown from a rounding error to a majority of connections in under two years. The problem? It moves inside your network, not across its edge, so the segmentation built to stop outsiders isn’t positioned to see it.
What Is East-West AI Traffic?
East-west AI traffic is connectivity between AI agents and other agents, orchestrators, or sub-agents, as opposed to north-south traffic at the network’s edge between a user and an application. It’s the traffic your perimeter tools aren’t built to watch, because it never crosses the perimeter. An orchestrator dispatching three sub-agents to complete one task generates three internal connections, each capable of reaching a different backend system…and they’re all invisible to controls designed for a person logging in from outside.
Why Traditional Segmentation Can’t See Agent-to-Agent Traffic
VLANs, security groups, and firewall rules describe access in terms of network zones drawn for a specific application topology, one that assumes a relatively fixed number of services talking to each other in predictable ways. Agents break that assumption in two directions. They scale unpredictably, spinning up sub-agents mid-task rather than through a provisioning ticket, and they authenticate as whatever service account they were given rather than as a distinguishable identity the network can reason about.
The scale of the shift shows up in the data: CyberArk’s 2025 research found machine identities outnumbering humans by more than 80 to 1 , with 68% of organizations lacking identity security controls for AI. A year later, Palo Alto Networks’ 2026 report put that ratio at 109 to 1, with AI agent identities specifically projected to grow another 85% over the next twelve months. Bottom line? The ratio is compounding.
How Prompt Injection Turns Agent Compromise into Lateral Movement
An attacker doesn’t need to breach your network if they can convince an agent already inside it to act on their behalf, and that’s exactly what prompt injection is built to do. A poisoned document, a manipulated tool response, or a crafted retrieval result can steer an agent that already holds legitimate credentials and legitimate east-west connectivity, and no perimeter control notices, because no perimeter gets crossed.
That reframes the actual security question, because you can’t fully prevent an agent from being manipulated. What you can control is what a manipulated agent is able to reach next, which is why the lateral path between agents matters more than the initial foothold.
How to Secure East-West AI Traffic with Identity-Based Access Control
The instinct is to inventory every agent, every sub-agent, and every path between them before writing a single access rule. But that approach is exactly what stalls most Zero Trust programs in ordinary environments, let alone ones where agents spin up and disappear inside a single task.
Luckily, it doesn’t have to work that way. When east-west connections are scoped by identity rather than network position, an agent can only reach what it’s been granted and nothing else. That’s a fundamentally different starting point than the discovery-first roadmap most segmentation projects assume, and it doesn’t require ripping out existing segmentation or waiting for a full agent inventory to start. Purpose-built east-west AI traffic architectures apply the same identity-based model NetFoundry uses across MCP servers and LLM endpoints to agent-to-agent connections specifically: every agent gets a cryptographic identity, connections are authorized at the service level rather than the network level, and nothing is reachable until a policy says so.
The Platform Engineer’s Guide to AI Network Architecture walks through exactly how this maps onto a reference architecture, including the specific patterns for securing agent orchestration and sub-agent dispatch. Download the Guide, or see how NetFoundry’s platform applies identity-based policy to every connection your agents make, not just the ones crossing your perimeter.
Frequently Asked Questions
What is east-west AI traffic?
East-west AI traffic is connectivity between AI agents, orchestrators, and sub-agents, as opposed to north-south traffic between a user and an application. It moves inside a network rather than across its edge, which is why perimeter-focused security controls typically can’t see it.
Why can’t traditional network segmentation see agent-to-agent traffic?
Segmentation built on VLANs and security groups describes access by network zone, assuming a relatively fixed set of services. Agents dispatch sub-agents dynamically and authenticate as shared service accounts, so the traffic doesn’t map cleanly onto the zones that segmentation was designed around.
Is this only a risk for organizations running complex multi-agent systems?
No. Even a single orchestrator dispatching a few sub-agents for one task generates east-west connections, and that pattern is now common in everyday agentic workflows, not just advanced multi-agent deployments.
How is this different from securing MCP servers?
MCP security governs how an agent reaches a tool server. East-west AI traffic is about how agents reach each other, including orchestrators dispatching sub-agents. Both need identity-based access control, but they’re different connections with different failure modes.
Do I need to inventory every agent before I can secure this traffic?
No. Identity-based, deny-by-default connectivity means anything you haven’t explicitly authorized is already contained, whether or not you’ve mapped it. You can start with one agent-to-agent connection and extend the model from there.
