Paper deep dive
On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models
Md Jafrin Hossain, Mohammad Arif Hossain, Nirwan Ansari
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/16/2026, 2:46:38 AM
Summary
This paper presents a systematic literature review (PRISMA 2020) of 85 papers (2023-2025) on the security of Agentic Large Language Models (LLMs). It identifies a significant imbalance in research, with attack-focused studies outnumbering defense studies by 3.9:1. The authors propose a four-layer vulnerability taxonomy (perception, brain, action, interaction) mapping 13 vulnerability types. A key finding is the misalignment between research focus and real-world risk: perception-layer vulnerabilities (e.g., prompt injection) dominate 66% of literature, while action-layer vulnerabilities (e.g., tool misuse, code injection) account for only 4.7%. The paper highlights architectural coupling as a root cause of insecurity and identifies seven open problems centered on containment.
Entities (10)
Relation Signals (8)
Tool Misuse → belongstolayer → Action Layer
confidence 95% · action-layer vulnerabilities (tool misuse, code injection, sandbox escape)
Code Injection → belongstolayer → Action Layer
confidence 95% · action-layer vulnerabilities (tool misuse, code injection, sandbox escape)
Prompt Injection → belongstolayer → Perception Layer
confidence 95% · Perception-layer vulnerabilities (prompt injection, jailbreaking, adversarial perturbations) dominate
Research Field → hasimbalance → Attack vs Defense Ratio 3.9:1
confidence 93% · Attack research outpaces defense work by 3.9:1.
Agentic LLMs → hasvulnerability → Prompt Injection
confidence 92% · Perception-layer vulnerabilities (prompt injection, jailbreaking, adversarial perturbations) dominate, accounting for 66% of papers
Agentic LLMs → hasvulnerability → Code Injection
confidence 90% · action-layer vulnerabilities (tool misuse, code injection, sandbox escape) appear in only 4.7%
Agentic LLMs → hasvulnerability → Tool Misuse
confidence 90% · action-layer vulnerabilities (tool misuse, code injection, sandbox escape) appear in only 4.7%
Agentic LLMs → causedby → Architectural Coupling
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large Language Models (LLMs) have undergone a shift from stateless conversational interfaces to autonomous agents capable of multi-step planning, tool invocation, code execution, and maintaining persistent memory. When these agents operate with real-world privileges---calling APIs, modifying files, and querying databases---a compromised reasoning step can trigger unauthorized data access, irreversible state changes, or cascading failures, yet the security research community has not kept pace. To quantify the state of the field, we conducted a systematic literature review under PRISMA 2020 guidelines across six databases, screening 743 records and retaining 85 papers (2023--2025) on agentic LLM security. Attack research outpaces defense work by 3.9:1. Perception-layer vulnerabilities (prompt injection, jailbreaking, adversarial perturbations) dominate, accounting for 66\% of papers, while action-layer vulnerabilities (tool misuse, code injection, sandbox escape) appear in only 4.7\%, misaligned with real-world risk. Code execution security accounts for 3.5\%, and tool-augmented agents 12\%. We contribute a four-layer taxonomy mapping 13 vulnerability types across perception, brain, action, and interaction layers, and identify seven open problems centered on containment. Agentic LLM insecurity stems from architectural coupling, where weak isolation allows vulnerabilities to propagate across layers.
Tags
Links
- Source: https://arxiv.org/abs/2608.10530v1
- Canonical: https://arxiv.org/abs/2608.10530v1
Trouble viewing inline? Open PDF directly →
Full Text
124,778 characters extracted from source content.
Expand or collapse full text
On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models Md Jafrin Hossain mhoss098@fiu.edu Florida International UniversityMiamiFloridaUSA , Mohammad Arif Hossain Mohammad.Hossain@mtsu.edu Middle Tennessee State UniversityMurfreesboroTennesseeUSA and Nirwan Ansari nirwan.ansari@njit.edu New Jersey Institute of TechnologyNewarkNJUSA (2025) Abstract. Large Language Models (LLMs) have undergone a shift from stateless conversational interfaces to autonomous agents capable of multi-step planning, tool invocation, code execution, and maintaining persistent memory. When these agents operate with real-world privileges—calling APIs, modifying files, and querying databases—a compromised reasoning step can trigger unauthorized data access, irreversible state changes, or cascading failures, yet the security research community has not kept pace. To quantify the state of the field, we conducted a systematic literature review under PRISMA 2020 guidelines across six databases, screening 743 records and retaining 85 papers (2023–2025) on agentic LLM security. Attack research outpaces defense work by 3.9:1. Perception-layer vulnerabilities (prompt injection, jailbreaking, adversarial perturbations) dominate, accounting for 66% of papers, while action-layer vulnerabilities (tool misuse, code injection, sandbox escape) appear in only 4.7%, misaligned with real-world risk. Code execution security accounts for 3.5%, and tool-augmented agents 12%. We contribute a four-layer taxonomy mapping 13 vulnerability types across perception, brain, action, and interaction layers, and identify seven open problems centered on containment. Agentic LLM insecurity stems from architectural coupling, where weak isolation allows vulnerabilities to propagate across layers. Agentic AI, Large Language Models, LLM Agents, Vulnerability, Security, Prompt Injection, Multi-Agent Systems, Tool-Augmented LLMs †copyright: none†journalyear: 2025†ccs: Security and privacy Human and societal aspects of security and privacy†ccs: Computing methodologies Artificial intelligence 1. Introduction 1.1. The Advancement of Agentic LLM Systems Large language models (LLMs) are in the midst of a paradigm shift. They are moving from passive, interactive systems to autonomous, goal-directed systems with external actuation capabilities, capable of functioning even in complex settings (Dornaika, 2025). Initially, large language models (LLMs) were used for one-shot or limited context conversations at best. The models could only generate textual outputs without taking any actions outside their system, could not retain information from previous interactions, and had no tasks left to perform in the future (Di Maggio, 2025). In contrast to earlier systems, the latest agentic LLMs tend to support memory planning and tool-use plans for achieving self-guided objectives that lie far in the future (Janjusevic et al., 2025). These architecturally significant advancements have made LLMs a centerpiece of iterative decision-making processes (Xia et al., 2025). Today, agentic models of LLMs can be commanded to break down high-level objectives into intermediate sub-goals, support multistep reasoning, use external ”tools” or APIs, and monitor their own internal states based on observations of external outcomes (Di Maggio, 2025). AutoGPT, React-based agents, or tool-based LLM models are examples of systems that better represent the development of language models from passive text-generating machines to generalized computational system controllers [(Feng, 2025; Ren et al., 2025)]. As a result, the scope and operation of large language model-based systems have grown significantly to support increasingly complex and operationally relevant applications (Xu et al., 2024a), where empirical studies indicate that agent actions can exacerbate model failures and lead to detrimental outcomes (Bandi et al., 2025), including the generation of incorrect information and irreversible real-world actions such as faulty API calls or unintended code execution (Li, 2025), thereby introducing additional operational and security risks. 1.2. Security Threats Unique to Agentic Systems The security context of agentic LLMs is not comparable to what we are concerned about with traditional LLMs. The major concerns with LLMs, as discussed in most literature, include prompt injection, jailbreaking, data leakage, and misuse, especially during chat-based interactions (Wang et al., 2024c). Although these are valid security concerns, they do not fully capture the security landscape when agentic LLMs are considered. The security context with agentic LLMs is more alarming because they can interact with other tools, function independently, create their own environment, access memory, and function with other agents (Abuadbba et al., 2025). When agents are used, these agents can access privileged APIs and change external facts. The agents, especially the retrieval agents, are bound by their external knowledge bases (Caetano et al., 2025). When there is a multi-agent system, there is a new channel of attack, especially concerning message injection and impersonation attacks (Wang et al., 2024f). The memory store can allow agents to create channels of attack, especially concerning poisoning and the gradual corruption of the LLM’s reasoning and learning processes (Zhang et al., 2024a). Among these, cascading failures represent a particularly concerning threat class. The agents function independently and recursively. This means that if there is an attack, it can cascade through all agents without anyone’s knowledge, let alone anyone’s control (Kniejski et al., 2025). Any part of the agentic LLM setup that can be breached by an attacker and the harmful consequences that follow will affect the entire agentic LLM setup. This suggests that prompt injection has the potential to change an agent’s current internal goals, which in turn can influence the planning process, tools, and techniques used (Chen et al., 2024). The effects of this then continue over time, becoming harder to identify and address, with the effects not being noticeable until many intermediary actions have been carried out. Even though security issues with agentic LLMs are significant, existing security defenses are based on the era of traditional LLMs. There is, therefore, a growing gap in the capabilities of agentic LLMs and existing security defenses (Feng et al., 2024a). 1.3. Scope and Definitions In this work, we define agentic LLMs as systems where the primary reasoning element is a large language model (LLM), coupled with an autonomous agent capable of: (1) perceiving and processing inputs from surrounding environments, such as user instructions or external data; (2) performing multi-step planning executing sequences of actions; (3) invoking external tools, APIs, and code execution; and (4) updating its state or memory based on the outcome of previously executed actions. It is also important to clarify what is not included in the definition of agentic LLMs. These include purely conversational LLMs, traditional AI agent systems which are not based on LLMs, and studies on LLMs that do not address security or safety aspects related to agentic behaviour. This literature considered in this study spans January 2023 through December 2025. This period is crucial since it marks the emergence of agentic LLMs in the literature, focusing on this timeframe enables us to identify vulnerabilities that arise specifically from the agentic properties of LLM-based systems, rather than vulnerabilities associated with LLMs in general. 1.4. Research Questions This research is organized around four research questions that provide a foundation for evaluating the security of agentic LLMs. • RQ1: What types of vulnerabilities arise in agentic LLMs, and at which architectural layers do these vulnerabilities occur? • RQ2: What techniques have been proposed to detect and identify these vulnerabilities, and how effective are they? • RQ3: What mitigation and defense mechanisms have been developed to address vulnerabilities in agentic LLM systems? • RQ4: What critical research gaps remain, and what research areas require urgent investigation? Taken together, these questions provide a framework for the literature review and guide the development of a vulnerability taxonomy and research agenda addressing the security challenges of agentic LLMs. 1.5. Contributions This research is significant for several reasons. To the best of our knowledge, this is the first PRISMA-based systematic review specifically focused on identifying vulnerabilities associated with agentic LLMs. We undertook an extensive review of the literature, in line with the PRISMA guidelines for the year 2020, for 85 peer-reviewed articles (from an initial set of 743) published between 2023 and 2025 in six prominent research databases. Taxonomy of Vulnerability: Four-layer structure based on agent architecture. We have mapped the vulnerabilities to the different layers of the architecture of the agent, namely perception, brain, action, and interaction. Quantitative Synthesis: Identification of imbalance and gaps in the literature. Our quantitative synthesis indicates an imbalance between the number of papers focused on attacks (3.9:1) and those focused on defenses, while also identifying significant gaps, such as the lack of coverage for code execution vulnerabilities and security for embodied agents. Research Roadmap: A comprehensive framework for the research, identifying seven open problems for improving the security of agentic LLM systems. 1.6. Organization of the Paper This paper progresses from establishing context and scope (Section 2) and methodology (Section 3), through background (Section 4), vulnerability analysis (Section 5), and detection/mitigation (Sections 6–7), to identifying research gaps (Section 8) and concluding with key findings and future directions (Section 9). 2. Related Work and Positioning 2.1. Evolution of LLM Security Research In the last few years, the pace of research related to the safety and security of large language models has accelerated significantly, reflecting the changing nature and applications of large language models (Zangana, 2024). Traditionally, the research was focused only on the risks associated with large language models, but recently, the academic interest has moved towards the agential behavior of large language models, which includes autonomous task accomplishment, tool use, and long-horizon execution (Zhang, 2024). The first set of security research for large language models (LLMs) was initiated with the development and proliferation of large-scale, pre-trained language models (Chhabra et al., 2025). Over a very short period, numerous surveys and empirical studies have identified the security issues faced by conversational and task-oriented large language models, such as prompt injection, jailbreaking, data leakage, memorization, and model abuse (Abdali et al., 2024). However, all such works have considered large language models to be passive entities, responding to user queries, without any state, tool, or time-dependent program flow. Nevertheless, the majority of the works have focused only on the surface-level security issues faced by large language models, without considering the security aspects of large language models used in the core decision-making process. Since the beginning of 2023, the security research for large language model agents has gained momentum, considering the fact that large language model agents have moved beyond the proof-of-concept stage and are being used for practical applications, such as AutoGPT, ReAct, tool-aided large language model agents, and multi-agent systems, which have introduced new security issues, such as uncoordinated failure, tool misuse, environment modification, and multi-step planning challenges (de Witt, 2025). 2.2. Existing Surveys and Their Limitations Figure 1. Organization of the Paper Existing surveys address related issues in LLM or AI security, but none provides a dedicated architectural vulnerability taxonomy for agentic LLM systems grounded in a systematic review of the literature. During the pre-LLMs period, security surveys focused on software agents, multi-agent systems, and robotic agents (Wang et al., 2025e). Although these studies address security issues such as trust, coordination problems, and adversarial situations, their results apply only to symbolic agents. As a result, they do not address potential security concerns related to LLM systems, such as prompt injection, emergent reasoning failure, or tool misuse due to language. Some recent surveys have focused on agentic AI and autonomous LLMs. However, most existing reviews do not report search strategies, inclusion and exclusion criteria, or assess the completeness of the provided information. The majority of existing surveys are narrative and emphasize security mechanisms in association with system challenges or governance. Narrative reviews in this space tend to address security mechanisms at a surface level; while some address multi-agent systems and tool-based security, none adequately covers security vulnerabilities related to agent architecture. Although existing surveys cover LLM safety, adversarial machine learning, and AI agent security, they mostly focus on model-level attacks and do not provide an architectural view on agential LLM vulnerabilities. This survey is unique in that it (1) is underpinned by a systematic review methodology based on PRISMA, (2) offers a four-layer architectural taxonomy for LLM vulnerabilities, and (3) provides a quantitative gap analysis on security research in the architectural layers. 2.3. Gap Analysis and Comparison This study presents a systematic literature review on security vulnerabilities of agentic large language model systems by following a PRISMA protocol, which synthesizes and organizes existing literature on different components. We provide an abridged overview of representative historical survey studies on several key dimensions, as shown in Table 1. The survey covers all aspects of agent architectures, ranging from single-agent and multi-agent systems to tool-augmented and RAG-based systems, as well as security requirements, including vulnerabilities, detections, and mitigations. The following section presents three major gaps found in previous studies. The gaps include: (1) agent architectures, (2) focus on weaknesses, not detection and mitigation, and (3) lack of formalism found in survey studies. Table 1. Coverage Comparison with Previous Surveys. Legend: ✓ = In-depth coverage / Yes, ◐ = Partially covered, ✗ = Not covered. Reference Year PRISMA Arch. Taxonomy Single Agent Multi-Agent Tool-using Vuln. Categories Detection Mitigation (Li, 2025) 2025 ✗ ✗ ◐ ✗ ✗ ✓ ✗ ✓ (Shayegani, 2023) 2023 ✗ ✗ ◐ ✓ ✗ ✓ ✗ ✓ (Brohi, 2025) 2025 ✗ ✗ ◐ ✓ ✓ ✗ ✓ ✗ (Wang, 2025) 2024 ✗ ✗ ◐ ✗ ✗ ✓ ✗ ✓ (Raza, 2025) 2025 ✗ ◐ ◐ ✓ ✓ ✓ ✗ ✗ (Deng, 2025) 2024 ✗ ◐ ◐ ✗ ✗ ✓ ✗ ✓ (Gan, 2024) 2024 ✗ ✗ ◐ ✗ ✗ ✓ ✓ ✓ (Feng, 2025) 2024 ✗ ✗ ◐ ✗ ✗ ✓ ✗ ✗ (Zhu, 2025) 2025 ✗ ✗ ◐ ✓ ✗ ✓ ✗ ✓ (Wang, 2025) 2025 ✗ ✗ ◐ ✗ ✗ ✓ ✗ ✓ (Ma, 2025) 2025 ✗ ◐ ◐ ✗ ✗ ✓ ✓ ✓ (Xu, 2025) 2025 ◐ ✗ ◐ ✗ ✗ ✓ ✓ ✓ (Shi, 2024) 2024 ✗ ✗ ◐ ✗ ✗ ✓ ✗ ✓ (Ma, 2025) 2025 ✗ ◐ ◐ ✗ ✗ ✓ ✓ ✓ (Choi, 2025) 2025 ✗ ✗ ◐ ✓ ✗ ✓ ◐ ✓ (Yang, 2024) 2024 ✗ ◐ ◐ ✓ ✗ ✓ ✗ ✓ (Barua, 2024) 2024 ✗ ✗ ◐ ✗ ✓ ✗ ✗ ✗ This Survey (Ours) 2025 ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ PRISMA-based Research Methodology: This is the first PRISMA 2020-compliant systematic review in agentic LLM security, with Cohen’s κ values of 0.88 and 0.93, unlike prior surveys that omit search strings and inter-rater statistics. Quantitative Analysis and Gap Identification: Our quantitative approach surfaces a 14-fold disparity between perception-layer (65.9%) and action-layer (4.7%) coverage, and the critical underrepresentation of code-execution agents (3.5%), which narrative surveys cannot detect. Architecture-to-Vulnerability-to-Defense Approach: By linking architectural components to their vulnerabilities and defenses, this framework provides a component-based basis for designing agent security. Although 85 papers may appear modest relative to broader LLM safety surveys, this reflects the emergent nature of agentic LLM security as a distinct subfield. Identification Records (n=743n=743) from 6 databases. n=47n=47 dups removed. Net: n=696n=696 Screening n=696n=696 screened; 540540 excluded based on title/abstract. Eligibility 156156 full-texts assessed; 7171 excluded (scope/empirical limits). Included 8585 studies in qualitative synthesis. Figure 2. Condensed PRISMA flow diagram of the study selection process. 2.4. Search Strategy, Search Strings and Databases We searched six major databases, which cover the areas of computer security, artificial intelligence/machine learning, and systems research: IEEE Xplore, ACM Digital Library, arXiv, Scopus, Web of Science, and Google Scholar. These databases collectively cover over one million publications in computer science and include the primary venues for agentic LLM security research. We used multiple strategies: Boolean search queries based on carefully selected keywords, snowball sampling based on the initial set of seed papers, and examining existing conference proceedings from top venues such as NeurIPS, ICML, ICLR, USENIX Security, ACM CCS, and IEEE S&P. We constructed a search strategy using three complementary query groups combined as: (Group 1) AND (Group 2) NOT (Group 3). Group 1 captures agent-related terms (e.g., agentic LLMs, autonomous agents, tool-augmented systems), Group 2 targets security concepts (e.g., attacks, vulnerabilities, prompt injection, mitigation), and Group 3 excludes out-of-scope domains (e.g., traditional, reinforcement learning, or game agents). Queries were adapted to the syntax of databases including IEEE Xplore, ACM Digital Library, Scopus, Web of Science, arXiv, and Google Scholar. 2.5. Data Extraction and Coding Scheme We created a structured data extraction tool to collect relevant data from each of the 85 papers. We extracted identifiers (title, authors, year, venue), agent type classification, primary type of vulnerability and architectural layer, threat model, nature of contribution (attack, defense, framework, or benchmark), experimental setup, and key findings including limitations identified by the authors. To assess the reliability of the coding process, a random stratified sample of 15 papers (17% of the corpus) was independently coded by a second reviewer. Inter-rater agreement for vulnerability classification was 94%, and agreement for paper categorization (attack, defense, framework) was 98%. Cohen’s κ was computed to account for chance agreement, yielding κ=0.88κ=0.88 for vulnerability classification and κ=0.93κ=0.93 for paper categorization, indicating near-perfect agreement. Discrepancies were resolved through discussion and consensus, and the taxonomy definitions were refined accordingly. 2.6. Quality Assessment Quality was assessed across four dimensions (0–5 scale): Threat Model Clarity (mean 4.1, σ=0.8σ=0.8), Experimental Rigour (mean 3.8, σ=0.9σ=0.9), Reproducibility (mean 3.5, σ=1.1σ=1.1), and Real-World Applicability (mean 2.9, σ=1.2σ=1.2); 29.9% rated excellent, 40.2% good, 21.8% fair, and 8% preliminary (Figure 3). Figure 3. Overall quality assessment distribution of the 85 included papers. 2.7. Threats to Validity We identify several potential threats to the validity of this study: Selection Bias: Although the search string used in this research inquiry is comprehensive, some publications, especially those not written in the English language or those which use unconventional terms, might not be found in the results obtained from the search string used in the research inquiry. Furthermore, it is also possible that some publications received in 2025 might not be included in the databases used for the research inquiry, and this might be addressed by the use of a snowball sampling technique. Publication Selection Bias: The literature suggests a higher probability of publication for research that reports positive findings compared to null findings or unsuccessful approaches. This could result in an overestimation of the effectiveness reported in works on mitigation and detection. Reliability of Coding: In view of resource availability, it was mainly the primary reviewer who coded the majority of papers included in the corpus. To assess reliability, 17% of the corpus, i.e., 15 papers, was chosen through stratified sampling. These papers were then independently coded by a second reviewer. There was substantial agreement between two coders, as reflected by high values of kappa statistics, 0.88 and 0.93, for vulnerability classification and paper classification into attack, defense, and framework, respectively. Fast-Moving Area: The field is in a state of rapid development. Publications released from Q4 2024 onwards may not have been adequately indexed. Any publications released after December 2025 are outside the scope of this review. Perhaps a living review would be more appropriate in the future. 3. BACKGROUND 3.1. Introduction to Agentic AI Systems Agentic Large Language Model (LLM) systems represent a remarkable leap forward in the evolution of artificial intelligence, marking the shift from passive query-and-response to autonomous or semi-autonomous intelligent agents with goals and objectives (Ali and Dornaika, 2025). The development of agentic artificial intelligence, including LLMs within a larger architecture, overcomes these challenges. The current era of agentic LLMs is based on a series of critical technological advancements. These systems rely on four enabling capabilities: in-context learning for short-term memory and adaptive reasoning; structured tool and function calling for interaction with external systems; retrieval-augmented generation (RAG) for dynamic knowledge access; and persistent memory for retaining state across episodes (Molinari and Ciravegna, 2025; Gan and Sun, 2025; Singh et al., 2025; Wu et al., 2025b). One of the first agent-based system frameworks developed was ReAct. It was possible to obtain task performance, interpretability, and stability (Yao et al., 2022). While the decomposition of tasks into sequences of thought-action observation cycles was key to making agentic LLMs practical, ReAct provided a framework that served as an engineering blueprint for constructing such systems and led to rapid uptake in both research prototypes and production systems (Yao et al., 2022). Since then, they have been used in various applications, such as intelligent coding agents, automated workflows, research bots, customer support orchestration, and decision support itself (Wang et al., 2025c). 3.2. Architectures of LLM-Based Agents The literature survey discussed here covers a wide range of architectures of agent system designs, reflecting various compromises with respect to important design goals such as autonomy, scalability, coordination, and safety. The models discussed can be broadly grouped into seven categories. Single-agent systems Single-agent systems consist of one LLM instance that handles all reasoning, decision making, and execution towards a goal (Masterman et al., 2024a). These systems are conceptually straightforward, and their dynamic characteristics have been extensively explored in personal assistants, task automation agents, and research platforms, including LangeChain-based agents (Barua, 2024). On the other hand, single-agent systems are simpler to design and reason about but can face challenges in completing complex tasks that involve parallel reasoning, specialization, or adversarial assessment (Kim et al., 2025). Multi-agent systems Agent systems consist of several LLM instances communicating among themselves. Such agents may cooperate toward joint goals, discuss possible alternative solutions to a problem, or organize themselves into hierarchies in which higher-level agents decompose tasks into subtasks and distribute them to specialized subagents. Multi-agent systems have been investigated for collaborative problem-solving, agent debate for improving reasoning accuracy, and simulation of social or economic environments (Han et al., 2024). However, they also introduce novel coordination and attack-surface issues related to inter-agent communication. Tool-Augmented Agents By contrast, tool-augmented agents extend LLMs with the possibility of calling external tools and APIs (Zhang et al., 2024b). Such tools may include, for example, programming language interpreters, database query engines, mathematical solvers, or enterprise software application interfaces. Retrieval-augmented generation (RAG) agents RAG agents incorporate retrieval mechanisms inside the agent loop. These agents can retrieve the latest and/or domain-specific information by querying vector databases, document collections, or knowledge graphs (Xu et al., 2024b). Code execution agents Code execution agents can be used to create and execute code, in secure (e.g., sandboxed) or untrusted operating environments or in a trusted executing environment (Mo et al., 2024). These agents are well-suited for data analysis, software development and system management. However, they are among the highest-risk categories, as bugs in code generation or execution can result in arbitrary code execution, data leakage, or system compromise (Navneet and Chandra, 2025). Web-crawling agents Web-crawling agents can be capable of traversing the web and following links, understanding retrieved pages’ content, and engaging in navigation decision-making. These agents are well-suited for scraping, monitoring, and intelligence-gathering, but are subject to malicious content injection and fraudulent interface attacks (Zhang et al., 2025b). Embodied agents Embodied agents function within a real or virtual world, and perform the integration of perceptual sources (e.g., visual information or sensor data) with action and planning (Wu et al., 2024a). Though rare in our corpus, embodied agents represent high-stakes deployment settings where physical safety and robustness are paramount (Rivera et al., 2024). 3.3. The Core Of Agentic Systems While agent architectures can differ, many agentic AI systems share four primary layers (ADABARA et al., 2025). These layers provide a security-related abstraction that can be used to model system behavior, organize the assessment of system vulnerabilities, and identify containment boundaries in which policy enforcement should take place (Shapiro et al., 2023). The Perception Layer The perception layer is responsible for receiving and interpreting inputs from users, external systems, and environmental sources. It is in charge of consuming and interpreting inputs from a variety of sources: user commands, retrieved documents, tool responses, sensor readings and inter-agent messages (Zahid and Bharati, 2025). This layer converts raw, typically ill-structured data to reasoning-friendly representations (Sager et al., 2025). The perception layer is most vulnerable to attacks such as prompt injection, jailbreak attempts, and adversarial input manipulation, as it processes inputs from external sources (Deng, 2025). Implementation components include: user input interfaces, retrieval pipelines (RAG),input preprocessing modules, external data sources The Brain Layer The brain layer performs reasoning, planning, and decision-making based on perceived inputs and memory state. This layer is the cognitive centre of the agent. It consists of the LLM, as well as connected planning and reasoning, goal maintenance, and memory systems (Dong et al., 2024b). This level describes what the agent wants to do, and why. At this level, vulnerabilities may include manipulation of reasoning, behaviour insertion of backdoor behaviours into model weights, and goal-hijacking attacks that redirect agent objectives to an unintended target. Implementation components include LLM reasoning modules, planning and task decomposition mechanisms, chain-of-thought reasoning frameworks, and goal and state management components. The Action Layer The action layer executes decisions generated by the reasoning component by invoking tools, APIs, or external systems. This layer executes the decision made by the brain layer (Liu et al., 2025a). These actions might involve invoking tools, running code, interacting with APIs, or controlling other physical systems. This layer is particularly fragile since every action has clear side effects. Some attacks, such as tool misuse, function or code injection, and hijacking, can have devastating effects, including unwanted system alterations and information leakage (Noman and Abu-Sharkh, 2023). Implementation components include tool invocation frameworks, API execution modules, code execution environments, and automation scripts. The Interaction Layer The interaction layer manages communication between agents, external systems, and shared environments. This layer is responsible for agent-environment communication, including other agents(s), memory store(s) and external service(s) (He et al., 2024b). This layer controls the behaviour of information entering and exiting the system. There are vulnerabilities here, such as message injection, memory poisoning, and manipulation of shared environmental state, which can have cascading effects across agent behaviours (He et al., 2025).Through such an organisation of agentic systems, it is possible to systematically analyse and categorise security threats and design the most suitable countermeasures. Implementation components include multi-agent communication protocols, message passing systems, environment interfaces, and shared memory channels. Table 2. Mapping of Existing Agent Framework Components to the Proposed Four-Layer Taxonomy Existing Framework Component This Survey Layer Mapping BDI: Beliefs Perception / Memory Layer BDI: Desires / Intentions Brain Layer ReAct: Observation Perception Layer ReAct: Reasoning / Thought Brain Layer ReAct: Action Action Layer AutoGPT: Tool Invocation Action Layer Multi-Agent Communication Interaction Layer 3.4. Threat Model for Agentic AI systems In order to assess the security of agentic systems, we follow a threat model, which distinguishes between the type and extent of knowledge and access available to an attacker (Christodorescu et al., 2025). This is a widely used taxonomy in security research, offering a theoretical framework for evaluating the severity of security flaws. White-box Attack Model: In this approach, it is assumed that the attacker can access not only the model’s weights, architectures, and training information, but also all of the model’s operational parameters (Wang et al., 2024e). This is the most extreme approach and is used in open-source, insider threat, and model leakage risk scenarios. In this white-box approach, a new type of attack is introduced: targeted attacks, such as backdoors in the model’s weights, and precise attacks, such as manipulating reasoning (Li et al., 2024). Black-box Attack Model: In the black-box threat model, it is assumed that the attacker can only access the model’s inputs and outputs, typically via an API or UI. This is the most realistic scenario for commercial applications. Even in such an unfavourable scenario, it is possible to carry out proactive attacks, such as early injections and jailbreaking, that will indirectly compromise the agent’s behaviour. Grey-box Attack Model: The threat model for this framework is grey-box and thus falls between these two ends of the spectrum. Adversaries have partial information (e.g., architectural designs, training regimes or access to logs and documentation), but not all model parameters. These may correspond to grey-box settings such as collaborative developmentsettings, supply chain environments, or compromised insiders with only limited authority (Mazzone et al., 2024). For all the vulnerability classes explored in this study, we estimate the base attacker skill level required for successful exploitation. Interestingly, several high-impact attacks on agentic systems (in particular, prompt injection and tool abuse) are solvable in a black-box setting. More advanced attacks, such as persistent backdoors or targeted reasoning corruption, can often only be mounted by attackers with grey-box or white-box access (Liu et al., 2025a). 4. Vulnerability Taxonomy This section introduces a taxonomy of vulnerabilities in agentic LLM systems, grouped according to their occurrence in different architectural layers. 4.1. Taxonomy Design and Organization Principles The 13 vulnerability types were identified through an inductive open-coding process applied to the 85 papers in the corpus during the data extraction stage. Each paper was coded according to the primary attack mechanism described, and the resulting codes were iteratively consolidated and refined until a stable set of categories emerged. While the four-layer architecture provided the organizational framework, the vulnerability types within each layer were not predefined. Through three rounds of refinement, an initial set of 23 candidate categories was consolidated into the final 13 by merging closely related attack mechanisms. While vulnerabilities are classified according to their primary architectural layer, several attacks may propagate across layers during execution. Such cross-layer effects are indicated explicitly in the taxonomy tables. Our vulnerability taxonomy categorizes 13 vulnerability types across four architectural layers. Rather than organizing by attack name (which is used inconsistently across the literature), we categorize vulnerabilities by the system component in which they arise. This component-based approach provides actionable insights; i.e., practitioners responsible for designing each component can focus on the vulnerabilities most relevant to that component of the system. The taxonomy is defined by two dimensions: (1) architectural layer, which describes the location of the vulnerability, and (2) vulnerability type, which describes the attack mechanism. The two-dimensional taxonomy enables an understanding of beyond merely the scope of analysis in terms of the number of vulnerabilities analyzed, but also the level of analysis in terms of the amount of effort put into each layer. The four layers are mutually exclusive with regard to primary function: every architectural component is assigned to exactly one layer depending on the primary function that dominates in the perception-execution pipeline, even though some implementation details may occasionally span multiple layers. 4.2. Perception-Layer Vulnerabilities Perception-layer vulnerabilities occur during input processing, prior to the agent’s Reasoning system kicking in. This category is the most extensively researched in our corpus, appearing in 56 of 85 papers (66%). Direct Prompt Injection: When an attacker gains direct control over part of the prompt (Liu et al., 2024). We demonstrate the basic attack of instruction overwriting: the attacker-supplied content changes what the agent is supposed to maximize in reward, and the instruction not to follow previously applied constraints. In contrast to the manipulation of the process of reasoning, which activates the cognitive chain at the brain layer, prompt injection affects the perception layer by modifying the inputs given to the agent before the process of reasoning starts. Indirect Prompt Injection: Malicious instructions are placed in input sources and then processed later by the agent (Shi et al., 2025). Examples are web pages loaded by the agent being poisoned, emails read by the agent being malicious, or database records retrieved being corrupted (Deng et al., 2024). This class is found in the same research papers as direct injection, (Rossi et al., 2024). Jailbreaking Attacks: Try to bypass the agent’s safety barrier with a well-crafted prompt. Jailbreaks do not directly inject instructions; rather, they exploit the model’s tendency to reproduce patterns from the context provided by the prompt (Peng et al., 2024). Adversarial Input Perturbations: Adversarial samples, perturbation attacks and input transformations that have been constructed to be misclassified (Lee et al., 2025). They differ from prompt injections in that their structure is less blunt and does not require text-based prompts. The layer indicated in the following table represents the primary location where the vulnerability arises, although certain attacks may propagate to other layers during system operation. Table 3. Vulnerability Taxonomy by Agent Architecture. Reference numbers in brackets indicate studies that have examined each vulnerability type within the corresponding agent architecture. An em dash (—) denotes no identified studies for that combination. Vulnerability Type Single Agent Multi-Agent Tool-Aug. RAG-based Web Agent Code-Exec Embodied PERCEPTION LAYER Direct Prompt Injection (Han et al., 2024) (Pedro et al., 2024; Fang et al., 2025; Cui and Du, 2025) (Zhan et al., 2024; Debenedetti et al., 2024) (Li and others, 2024) (Li, 2025; Wu et al., 2024b) (Dornaika, 2025) — Indirect Prompt Injection — (Datta et al., 2025; Deng, 2025) (Zhan et al., 2024; Ferrag et al., 2025) (Dong et al., 2024b; Li and others, 2024; Ju and others, 2024) (Li, 2025; Wu et al., 2024b) (Deng, 2025) — Jailbreaking Attacks (Christodorescu et al., 2025; He et al., 2025) (Fang et al., 2025; Gan, 2024; He et al., 2024b; Raza, 2025; Zhou and others, 2024) — (Ghosh and Mittal, 2025; Feng, 2025; Yu and others, 2024; Choi, 2025) — — — Adversarial Perturbations (Shayegani, 2023) (Evertz et al., 2024; Gan, 2024; Jiang et al., 2025; Narajala and Narayan, 2025; Pan et al., 2025) (Jiang et al., 2025) (Liu et al., 2025a; Di Maggio, 2025) (Jiang et al., 2025; Li et al., 2025) — (Evertz et al., 2024; Liu and others, 2024) BRAIN LAYER Backdoor Attacks — (He et al., 2024a; Singh et al., 2025) — (Barua, 2024; Dong et al., 2024b) — — (Liu and others, 2024) Reasoning Manipulation — (Gan, 2024; Mo et al., 2024) — (Evertz et al., 2024) — — (Evertz et al., 2024) Goal/Plan Hijacking — (Janjusevic et al., 2025; Ren et al., 2025) (Wang et al., 2024a) — (Li et al., 2025) — — Memory Poisoning — — — (Ju and others, 2024) — — — ACTION LAYER Tool Manipulation — — (Barua, 2024; Zhan et al., 2024; Debenedetti et al., 2024; Ferrag et al., 2025) — — — — Function Hijacking — — (Janjusevic et al., 2025; Ferrag et al., 2025) — — — — Code Injection — — — — — (Deng, 2025; Dornaika, 2025; Triedman et al., 2025) — Sandbox Escape — — — — — (Patlan et al., 2025; Triedman et al., 2025) — INTERACTION LAYER Inter-Agent Msg. Injection — (Pedro et al., 2024; Datta et al., 2025; Deng, 2025; Gan, 2024) — — — — — Agent Impersonation — (Narajala and Narayan, 2025; Zhu, 2025) — — — — — Knowledge Base Corruption — — — (Dong et al., 2024b; Li and others, 2024; Ju and others, 2024) — — — Figure 4. Heatmap of vulnerability distribution across architectural layers and agent types (visual representation of Table 2). 4.3. Brain-Layer Vulnerabilities Attacking the brain layer focuses on the agent’s reasoning, planning, and decision-making. To date, our survey shows that these vulnerabilities are present in 35/85 papers (41%), indicating that this layer has received significantly less research attention than perception-layer attacks. Backdoor Attacks: Backdoors are latent triggers introduced at training time that fire only when a specific input is observed (Wenger et al., 2021). In an agentic setting, a backdoor code can force the agent to follow rogue guidelines, place unauthorised calls to applications and forge logs daily (Boisvert et al., 2025). Manipulation of Reasoning: This uses the reasoning power of the agent to reach incorrect conclusions (Huang et al., 2025). That includes introducing subtle errors into the reasoning chain that are individually plausible but collectively lead to incorrect conclusions (Dassanayake et al., 2025). This differs from prompt injection because the adversarial influence targets the reasoning process itself rather than the agent’s input. Goal Hijacking and Action Hijacking: The agent’s goals are changed or the actions, which it intended to perform, are steered towards other than desired directions (Gan et al., 2024). Goal hijacking is especially harmful for agent systems, as it may lead the agent to devote its efforts to the attacker’s objectives rather than its initial goals (Rao et al., 2023). 4.4. Action-Layer Vulnerabilities and an Execution Risk Model The execution layer represents a high-risk attack surface in agentic systems, as it interfaces with external tools, APIs, and environments, enabling immediate and potentially irreversible effects. When considering the different layers, perception and reasonings tend to capture the majority of the attention, but the highest-consequence failures arise at the execution layer (Wu et al., 2025a). This is the part of the agentic LLM system that impacts the outside world. Calling tools, calling different APIs, reading and writing files, network communication, and even driving physical actions are all examples of the execution layer (Liu et al., 2025b). Mistakes in the execution layer do not just misrepresent facts; they change the state of the world in a very observable and sometimes irreversible fashion (Desai and Riedl, 2025). However, despite the high stakes of the execution layer, the majority of studies rarely explore the compromise of the execution layer in depth. This discrepancy can be attributed to the mismatch between the emphasis placed on different components of the LLM system and the practical realities of its deployment (Hu et al., 2024). To further clarify the issue, the insecurities related to the execution layer are discussed from three different perspectives: privilege, external state modification, and the possibility of irreversible actions. 4.4.1. Tool Manipulation Tool manipulation occurs when an attacker forces an agent to invoke unintended tools or misuse legitimate ones, potentially triggering unauthorized API calls, data exfiltration, or resource abuse (Barua, 2024; Zhan et al., 2024). The relative underrepresentation of this attack class in the literature is discussed in Section 5.7. 4.4.2. Code Injection Code injection vulnerabilities occur when agents generate and execute code derived from untrusted input sources. In several agent systems, code produced by the agent is executed directly by an interpreter. Empirical studies show that adversarial prompts or retrieved data can inject malicious instructions into the generated code, enabling arbitrary command execution or unauthorized access to files and networks (Bandi et al., 2025). This vulnerability class represents one of the most impactful attack types in agentic systems. 4.4.3. Sandbox Escape Sandbox escape vulnerabilities occur when attackers bypass isolation mechanisms intended to restrict the execution of code generated by agents. Although containerization and sandboxing are commonly used to limit code execution privileges, empirical studies show that attackers can exploit misconfigurations or interpreter capabilities to allow malicious code to access host resources outside the restricted environment (Debenedetti et al., 2024). 4.5. Interaction-Layer Vulnerabilities Interaction-layer vulnerabilities target communication channels between agents and external systems, other agents, and memory stores (Jones et al., 2025). Agent-to-Environment Attacks This includes webpage poisoning, where web content served to web-browsing agents contains malicious instructions, environment manipulation, where the observation space contains injected content, and sensor manipulation for embodied agents (Zychlinski, 2025). Our analysis identifies these in 4 papers. Agent-to-Agent Attacks This is specific to multi-agent systems in which agents communicate with each other. Message injection occurs when inter-agent communications are tampered with (Wang et al., 2025d). In contrast to traditional distributed-system message tampering, which focuses on protocol-level integrity, inter-agent message injection in LLM-based systems manipulates the semantic content of messages, allowing malicious instructions to appear as legitimate tasks because agent communication typically lacks cryptographic message authentication. Agent impersonation occurs when one agent spoofs another’s identity. Unlike traditional distributed systems where identity is established through cryptographic authentication, agentic systems often rely on conversational context and role descriptions, which can be spoofed through prompt manipulation or message injection. Agent-to-Memory Attacks Include memory poisoning, where the agent’s persistent memory is corrupted with false information, and RAG poisoning, where the knowledge base content is contaminated (Zhang et al., 2024a). Our analysis found this dimension represented in three papers addressing RAG-based agents. 4.6. Vulnerability Taxonomy Summary This section presents an exhaustive synthesis of the identified vulnerabilities. Table 4 reports the frequency of vulnerability occurrences rather than unique studies, as individual papers may contribute to multiple categories (e.g., indirect prompt injection and tool manipulation). Table 4. Component-Level Occurrence of Vulnerability Types Across Architectural Layers. Vulnerabilities are classified by the primary layer where the attack originates. A comprehensive table of agentic vulnerabilities across Perception, Brain, Action, and Interaction layers, including attack vectors, examples, impact, severity, frequency counts, and corresponding literature citations. Component Attack Vector Example Attack Sev. Cnt. Key References PERCEPTION LAYER Input Processing Direct Prompt Inj. Malicious user instructions High 12 (Pedro et al., 2024; Zhan et al., 2024; Ferrag et al., 2025; Han et al., 2024; Li, 2025; Cui and Du, 2025; Li and others, 2024) Input Processing Indirect Prompt Inj. Hidden retrieved instructions High 15 (Zhan et al., 2024; Dong et al., 2024b; Li, 2025; Li and others, 2024; Ju and others, 2024; Wu et al., 2024b) Input Handling Jailbreaking Safety bypass prompts High 26 (Christodorescu et al., 2025; He et al., 2025; Ghosh and Mittal, 2025; Feng, 2025; Yu and others, 2024; Choi, 2025; Edwards and Rawat, 2024) Multimodal Input Adversarial Pert. Modified images/audio inputs Med. 42 (Shayegani, 2023; Evertz et al., 2024; Gan, 2024; Liu et al., 2025a; Pan et al., 2025; Perez and Ribeiro, 2022) BRAIN LAYER Planning Module Goal Hijacking Manipulating objectives High 24 (Datta et al., 2025; Janjusevic et al., 2025; Ren et al., 2025) Reasoning Engine CoT Manipulation Corrupting reasoning chains Med. 21 (Evertz et al., 2024; Gan, 2024; Mo et al., 2024) Memory System Memory Poisoning Injecting false context High 41 (Dong et al., 2024b; Ju and others, 2024) Knowledge Base RAG Poisoning Corrupting retrieval DB High 23 (Li and others, 2024; Ju and others, 2024) ACTION LAYER Tool Interface Tool Manipulation Unintended tool calls High 54 (Barua, 2024; Zhan et al., 2024; Debenedetti et al., 2024; Ferrag et al., 2025) API Gateway Function Hijacking Redirecting API calls High 7 (Janjusevic et al., 2025; Ferrag et al., 2025) Code Executor Code Injection Malicious code execution Crit. 13 (Deng, 2025; Dornaika, 2025; Triedman et al., 2025) Sandbox Sandbox Escape Breaking isolation boundaries Crit. 8 (Patlan et al., 2025; Triedman et al., 2025) INTERACTION LAYER Agent-Agent Message Injection Tampering inter-agent comms High 12 (Pedro et al., 2024; Datta et al., 2025; Deng, 2025; Gan, 2024) Agent Registry Impersonation Masquerading as trusted agent Med. 5 (Narajala and Narayan, 2025; Zhu, 2025) Note: The numbers represent the counts at the level of each component. A single paper can contribute to multiple counts because it may discuss more than one type of vulnerability or architectural component. Therefore, the numbers in this table exceed the size of the overall corpus (N = 85) and should not be interpreted as representing individual papers. This column is not the number of unique papers. The severity levels are defined qualitatively using a scheme similar to CVSS v3.1. Critical refers to system compromise or irreversible state changes, High refers to unauthorized data access, goal hijacking, or persistent memory corruption, and Medium refers to behavioral or output manipulation without system compromise. These levels are determined based on worst-case scenarios described in the literature. Figure 5. Component-level vulnerability counts and perceived severity distribution. 4.7. Multi-Dimensional Quantitative Analysis This analysis of 85 papers in the vulnerability taxonomy indicates that the following patterns can be identified: Architectural Layer Distribution Perception layer security risks are the most frequently represented security risks in literature, with 56 out of 85 papers (66%) focusing on input layer security risks, whereas 35 papers (41%) discuss brain layer security risks, 4 papers (4.7%) discuss action layer security risks, and 24 papers (28%) discuss interaction layer security risks. This level of concentration appears to be an artifact of methodological accessibility rather than actual risk distribution. Attacks at the perception layer are typically black-box attacks requiring only API access and do not require the development of fully agentic systems. Moreover, early security research on large language models exhibited a path dependency, primarily focusing on prompt manipulation. There was also a bias toward perception-layer attacks due to benchmark availability, as datasets for prompt injection and jailbreaking were developed earlier than those for agentic systems. This does not imply that perception-layer attacks are more dangerous; as shown in Section 5.4, action-layer attacks can be more impactful despite receiving less research attention. Figure 6. Distribution of vulnerability research across agentic architectural layers. Architecture-Specific Patterns Multi-agent systems being the most frequently represented, with 39 out of 85 papers (46%) focusing on multi-agent architectures, followed by RAG-based agents with 25 out of 85 papers (29%), tool-augmented agents with 10 out of 85 papers (12%), web agents with 4 out of 85 papers (4.7%). No papers primarily focus on single-agent architectures, though single-agent settings appear as baselines in several studies (Table 8). Vulnerability Type Coverage Prompt injection examples are the best represented security risk with 36 papers, followed by Adversarial with 30 papers, and jailbreaking with 16 papers. Other security risks are represented by fewer papers: memory poisoning (3), code injection (3), and sandbox escape (2). A large number of papers on these security risks indicate clustering in the literature. These attacks can be explored in a single-turn setting using standard language model APIs. This contrasts with code injection (3 papers) and sandbox escape (2 papers), which require full agent execution environments with realistic tool integrations. This may indicate that modern research trends are influenced by convenience and not necessarily by risk considerations. Figure 7. Research frequency by primary vulnerability type. 5. Detection Mechanisms in Agentic Systems 5.1. Detection Approaches Overview Section 4 analyzed the vulnerability landscape, while this section focuses on detection and identifying vulnerabilities. The results show that there is a significant imbalance, with much more research on attack methods than on defense/mitigation-focused work. To be more specific, 47 research papers (55.3%) focus on vulnerability discovery and attacks, while only 12 research papers (14.1%) focus on defense and mitigation, a ratio of 3.9:1. In terms of agentic large language models, there are a number of factors that contribute to this trend. First, there is a natural incentive structure that favors novel discoveries of attacks rather than incremental improvements to defenses. Second, many attack approaches can be evaluated using only API-level access, while evaluating defenses requires agents that integrate tools and environments. Third, there is currently a lack of benchmarking and metrics for defenses, making it difficult to compare them against one another. The methods used for detection can be classified under five different stages: input-level detection, runtime detection, multi-agent detection, formal verification, and benchmark-based evaluation. Interestingly, papers addressing action-layer vulnerabilities exhibited lower reproducibility scores (mean 3.1) compared to perception-layer studies (mean 3.9), suggesting that higher-risk architectural layers also suffer from weaker methodological maturity. Figure 8. Ratio of attack-focused research to defense/detection-focused publications. 5.2. Input-Level Detection Methods Input-level detection is performed before the agent’s reasoning module receives input from the user or external environment (Huang et al., 2024). This is, therefore, the first opportunity to identify malicious input. Several approaches have been proposed for prompt-injection detection, including pattern-based and semantic-based detection, as well as classifiers trained on large language models (Wang et al., 2025a). For instance, known-answer-based detection uses auxiliary models trained on large language models to identify inconsistencies during response generation. This approach relies on the complexity of the attack (Shayegani et al., 2023). Apart from that, classifier-based detection models are also trained on a set of adversarial input prompts to classify between malicious and benign instructions (Wang et al., 2024b). The classifiers can vary from fine-tuned LLM-based detectors to lightweight embedding-based classifiers that check for deviations from expected input prompt structures (Lin et al., 2025). Embedding-based anomaly detection methods use similarity changes in vector space representations, detecting inputs that significantly differ from expected input distributions (Xu and Ding, 2024). Jailbreak signature detection methods, on the other hand, attempt to detect input patterns associated with instruction overrides, such as role redefinition and policy negation (Ji et al., 2024). The known answer detection method is an extension of the existing detection model, utilizing additional LLM-based instances that generate expected responses and compare them with actual responses, indicating inconsistencies that could imply manipulation (Feng et al., 2024b). In terms of empirical evaluation of input level detection approaches, it is common to measure their performance in terms of reduction in attack success rate, precision/recall of malicious prompts, or robustness of detectors in handling paraphrased attacks (Zhang et al., 2023). There have been several works that have evaluated the performance of detectors using jailbreak datasets, adversarial prompts, or injection benchmarks (Shang and Wei, 2025; Jia et al., 2025; Nasr et al., 2025; Liao et al., 2025). However, in most common experimental settings, it is often assumed that interactions occur in single turns, i.e., attacks can be contained in a single prompt (Hong et al., 2025). This may not be true in multi-turn scenarios, where adversaries can spread their attacks across multiple turns of conversations. In addition, it has also been observed that evaluation of robustness in handling adaptive adversaries, where adversaries can update their prompts based on feedback from detectors, is often not considered (Nasr et al., 2025). 5.3. Runtime Detection Methods The runtime detection method focuses on detecting agent behavior during runtime, which may indicate an attack (de Witt, 2025). Behavior monitoring focuses on monitoring agent behaviour to detect and recognize anomalous patterns, including unexpected sequences of tool invocations, resource utilization, or output that does not conform to expected patterns (Xu et al., 2025). Output verification includes methods that verify agent output using good examples or auxiliary verification methods. In the In-Context Adversarial Game, for example, this method was shown to be highly effective when using the language model as a verifier, as described by (Drori et al., 2025). In empirical evaluations, mechanisms of runtime detection typically measure the performance of anomaly detection methods in terms of sequences of tool invocation, resource consumption, and consistency of outputs (Yang and Harris, 2025). The literature has demonstrated better robustness, especially when compared with static prompt filtering, and is more applicable to agents with tool usage. However, there is associated computational cost, especially with heuristics, which can be vulnerable to attacks with multiple steps (Mu et al., 2024; Pandya et al., 2024; Zhong et al., 2025). Additionally, there is a high likelihood of evaluations being conducted under controlled conditions, as opposed to an adaptive adversarial framework. Unlike the approaches of the input level, it is clear from the reviewed corpus that there are no approaches that directly tackle the issue of anomaly detection at the level of execution. The closest approaches are based on the monitoring of tool usage behavior, as presented in one of the reviewed papers. However, it is clear that there is a lack of constraint and boundary enforcement for the level of privilege. Anomalies in memory usage are also a less-explored area. The challenges of multi-agent detection include differentiating coordination anomalies from task specialization, monitoring the spread of trust, and checking the integrity of inter-agent communications. Current solutions address these problems in a very limited way. 5.4. Evaluation Frameworks and Benchmarking Practices No standardized evaluation framework for agentic LLM security currently exists (McIntosh et al., 2024; Zhang et al., 2024a). Most studies report attack success rate (ASR), precision/recall of anomaly classification, and in some cases latency overheads (Dong et al., 2024a; Liao et al., 2025; Cui et al., 2024). Adaptive adversarial testing, where attackers iteratively refine prompts against detection systems, remains rare (Jia et al., 2025; Nasr et al., 2025), limiting the comparability of methods across the field (Dugan et al., 2024). Table 5. Overview of Agent Security Benchmark Datasets. Ref Dataset Year Size Vulnerability Types Agent Scenarios Attack Types Availability (Zhang et al., 2024a) Agent Security Bench (ASB) 2024 Multiple scenarios Prompt Injection, Backdoor Tool-using, RAG Direct, Indirect Public (Zhan et al., 2024) InjecAgent 2024 1,054 test cases Indirect Prompt Injection Tool-integrated Indirect Public (Debenedetti et al., 2024) AgentDojo 2024 97 tasks, 629 injections Prompt Injection Tool-using Direct, Indirect Public (Mazzone et al., 2024) AgentHarm 2024 440 behaviors Harmful behaviors General agents Behavioral Public (Li et al., 2025) AdvWeb 2024 Web scenarios Adversarial attacks Web agents Adversarial Public (Pavlova et al., 2024) GOAT 2024 Multiple attacks Jailbreaking General Jailbreak Public (Cui and Du, 2025) MAD-Spear Dataset 2025 Custom Prompt Injection Multi-Agent Debate Social Engineering Custom (Yang, 2024) Mobile Agent Security Matrix 2024 4 attack paths Multimodal attacks Mobile agents Multi-path Public 5.5. Detection Methods Summary If we consider the ways in which detection works, three main patterns are apparent. The majority of the mechanisms focus mainly on the perception layer, with a strong emphasis on input filtering and anomaly detection at the prompt level itself. In comparison, the runtime monitoring tools are still in their early stages of development and do not yet have empirical validation; only a minority of the literature provides formal guarantees and standardized evaluation methods, reflecting an immaturity level when compared with the attack literature. Table 6. Mapping between vulnerability types and detection approaches Vulnerability Type Detection Approach Coverage Prompt Injection Input filtering, prompt validation Well-studied Adversarial Input Input sanitization, robustness checks Well-studied Jailbreaking Output filtering, policy checks Well-studied Indirect Prompt Injection Context validation Moderate Goal Hijacking Behavior monitoring Limited Memory Poisoning Retrieval validation Limited RAG Poisoning Knowledge filtering Moderate Tool Manipulation Tool-use monitoring Limited Code Injection Execution monitoring Limited Sandbox Escape None identified None Message Injection Communication validation Limited Agent Impersonation Context-based identity checks Limited Environment Manipulation Input validation Limited Coverage indicates the extent of dedicated detection mechanisms identified in the literature: ”Well-studied” (multiple established approaches), ”Moderate” (some targeted methods), ”Limited” (few or indirect approaches), and ”None” (no dedicated detection mechanism identified). Table 7. Overview of Agent Defense Detection Mechanisms Ref Year Method Vulnerability Agent Stage Threat Model Automation Dataset Metrics Performance (Ferrag et al., 2025) 2025 Known-Answer Detection (KAD) Prompt Injection Perception Black-box LLM-based Custom Accuracy, FPR Variable (Ayzenshteyn et al., 2024) 2024 LLM Agent Sentinel Adversarial Perception Black-box LLM-based Custom F1, Accuracy 95%+ (Raza, 2025) 2025 Reverse Thinking + Role Examination Jailbreaking Perception Black-box Hybrid Custom Detection Rate Effective (Zhou and others, 2024) 2024 In-Context Adversarial Game (ICAG) Jailbreaking Brain Gray-box LLM-based Custom ASR, Defense Rate High (Cao et al., 2024) 2024 Dynamic Guidance Defense (G4D) Jailbreaking Perception Black-box Hybrid Benchmark ASR Reduction Significant (Zeng et al., 2024) 2024 AutoDefense Multi-Agent System Jailbreaking Runtime Black-box Multi-Agent JailbreakBench ASR, FPR Reduced ASR (Perez and Ribeiro, 2022) 2023 Adversarial Prompt Shield Adversarial Perception Black-box ML-based Custom F1, Precision High (Wu et al., 2025c) 2025 Soft Label + Key-Extraction CoT Prompt Injection Perception Black-box LLM-based Custom Detection Rate Effective (Ferrag et al., 2025) 2025 Comparative Vulnerability Assessment Prompt Injection System White-box Manual Custom Vuln Count MCP vs FC (Deng, 2025) 2025 Adaptive Encryption + Differential Privacy Adversarial System Gray-box Hybrid Framework Security Metrics Framework 5.6. Structural Limitations of Current Detection Paradigms Despite the progress in detection research, there are several structural gaps in the literature when viewed collectively (Miller et al., 2022). Firstly, most of these detection methods are situated in the perception layer and are limited in their ability to identify anomalies in prompt injection attacks. Such approaches are generally effective in detecting known types of attacks but are not sustainable in nature (Yeo and Choi, 2025). Secondly, most of these systems rely on additional large language models for evaluating the output of primary agents (LLM-as-judge). Such approaches are promising in nature but are circular in their design and fail to account for robustness against adversarial attacks on the detector (Wang et al., 2024d). Thirdly, most of these systems are tested in limited conditions and are not comprehensive in their design. Most of these systems are tested in single-session conditions and not in more complex conditions (Buchta et al., 2024). There is little evidence of robust testing of these systems in long-term conditions or in conditions where tasks are multi-step in nature. Lastly, most of these systems lack formal guarantees and are limited in their design. Such systems are generally tested empirically and lack formal verification (Wang et al., 2024g). Such systems are likely in their design and have not moved towards formalizing unified principles of detection. Overall, these gaps indicate that the field of detection in large language models has not yet reached methodological maturity and that further research is required in this area (Valentin et al., 2024; Abdali et al., 2024; Shi et al., 2024). Pushing beyond these countermeasures will likely require standardized benchmarks and adaptive threat modeling. 6. Mitigation Strategies and Defenses To synthesize the architectural distribution of attacks and defenses in agentic LLM systems, we present a unified layered security stack. This model highlights research coverage imbalance and defense maturity across system layers. Figure 9. Unified Security Stack for Agentic LLM Systems 6.1. Defense Taxonomy Overview There are six broad categories of defense mechanisms, differentiated by their implementation approach and scope. Detection focuses on identifying vulnerabilities, whereas mitigation aims to reduce their impact (Fazelnia et al., 2022; Peng et al., 2024). Our review identified 17 defense-focused studies (12 detection and 5 mitigation-only), with emphasis on filtering (60%), runtime control (70%), and multi-agent strategies (35%); note that these percentages are not mutually exclusive, as individual studies may employ multiple defensive mechanisms. Categories were assigned based on each paper’s primary defensive mechanism and consolidated into stable groups: input filtering, architectural modification, runtime control, training-time mitigation, governance, and multi-agent defense. 6.2. Input/Output Filtering and Shields Input/Output filtering primarily addresses perception-layer vulnerabilities (Section 5.2), particularly direct and indirect prompt injection. Input filtering is the process of removing or modifying bad inputs before they enter the process stage (Qendro et al., 2022). Prompt sanitization is also mentioned in the literature (Ostermann et al., 2024). There are studies that introduced input prompts that filter out attack patterns that come in the form of bad input. Guard models have been proposed for input filtering, screening out malicious inputs before they reach the reasoning module. For example, Auto Defense uses a multi-agent filtering system to filter inputs through specialized screening agents that identify prompt injection and unsafe instructions before passing them to the main agent as outputs. Output filtering is also addressed; the outputs are filtered before they are released to other systems (Boreiko et al., 2024; Wang et al., 2025e). This is especially important for code-execution agents; filtered outputs prevent malicious code execution. Generally, empirical evaluations of the efficacy of the filtering mechanisms for input and output filtering demonstrate a reduction in the attack success rate (ASR) for curated datasets for jailbreak and prompt injection attacks (Wang et al., 2025b). However, the efficacy of the guard model filtering approach, while significant, demonstrates a reduction in efficacy against adaptive threat actors, particularly those employing alternative definitions for malicious intent, such as distributing instructions across multiple turns in the conversation (Kulkarni and Namer, 2025). Output filtering for code execution agents significantly mitigates the risk of direct execution but does not account for semantic harm embedded in code, particularly if the code is syntactically valid (Kucharavy et al., 2023). However, overly aggressive filtering can result in false positives, reducing the utility of the task. 6.3. Architectural Defenses Architectural defense mechanisms primarily address brain-layer vulnerabilities (Section 5.3), particularly through the addition of control points between reasoning (B) and execution (E). The architectural techniques focus on modifying the agent system to prevent potential attacks (Cao et al., 2025). Layered Agent Architectures Layered architectures are proposed for agents; they separate reasoning and execution via intermediate verification steps (de Witt, 2025). AutoDefense proposes multi-agent systems where one agent monitors another, detecting and filtering suspicious behaviour (Wang et al., 2024f). Privilege Separation Limiting agent capabilities through permission systems, capability-based security, and role-based access control (Zhang et al., 2025a). Architectures that support multi-agent monitoring and cross-agent verification tend to exhibit improved robustness against simple jailbreak scenarios; however, they impose additional communication overhead and risk correlated failure when identical models are used across agents (Bhatt et al., 2025). Privilege separation limits worst-case damage potential but does not prevent malicious strategy development within defined limits. As architectural complexity increases, unintended attack surfaces may also grow, particularly in multi-agent scenarios where inter-agent communication becomes an attack vector (Shrestha et al., 2025). 6.4. Runtime Controls Runtime control mechanisms primarily address action-layer vulnerabilities (Section 5.4), particularly through execution constraint. Runtime controls monitor and constrain agent execution (Errico et al., 2025). Sandboxing and Isolation Executing agent code in isolated environments with limited system access. Sandboxing is particularly important for code-execution agents but applies to all tool-using agents. Rate Limiting and Quotas: Constraining resource consumption and tool invocation frequency to limit the impact of compromised agents. Policy Engines Enforcing declarative policies about which tools agents can invoke and under what conditions and circumstances. The control mechanisms can be evaluated with respect to their effectiveness in containing scenarios such as simulated privilege escalation, unauthorized API calls, and resource exhaustion attacks (Ferraiolo et al., 2010). The mechanisms of sandboxes/isolation show high levels of containment, especially with respect to code execution agents, as they restrict the impact of malicious outputs even if upstream reasoning is compromised. Rate limiting reduces the impact of compromised agents but cannot prevent a high-impact action (Zhou et al., 2024). The policy engines show high levels of declarative enforcement but are heavily dependent on the precise definition of interactions between tools. Empirical studies confirm that sandboxing is effective at the execution level, though per-action policy validation introduces latency overhead and misconfiguration risk. 6.5. Training-Time Mitigation Training-time mitigation primarily addresses brain-layer vulnerabilities (Section 5.3), particularly through control of statistical behavior of reasoning operator (B). Training-time strategies address the issue during model training. Adversarial training makes the model more robust by training it on adversarial examples (Chattopadhyay et al., 2025). This allows the model to learn how to be robust against existing attack patterns. Reinforcement Learning from Human Feedback (RLHF) promotes safe behavior by incorporating human feedback into the reinforcement learning optimization loop. This discourages unsafe behavior in the model—techniques for backdoor remediation focus on detecting backdoors via fine-tuning or cleansing. Adversarial fine-tuning helps improve robustness against known attacks, and reinforcement learning from human feedback helps prevent harmful outputs, but these methods do not work for new patterns of attacks. Backdoor remediation helps prevent risks of unknown triggers but involves some level of performance degradation. 6.6. Governance and Oversight Governance mechanisms primarily address interaction-layer vulnerabilities (Section 5.5), particularly through control of interactions between agents and external systems. In addition to technical measures, process-level defenses can be implemented by involving humans in the operations of agents (Liu et al., 2025b). Such measures, which involve human-in-the-loop, require authorization from humans before executing certain operations, thereby providing a highly reliable security mechanism at the expense of reduced scalability (South et al., 2025). Audit logging can improve accountability by recording all operations performed by agents, enabling investigations of security breaches. The reliability of human-in-the-loop mechanisms in preventing catastrophic behaviors is very high, especially in high-risk domains (Deng et al., 2025). However, empirical studies on the deployment of these mechanisms indicate that there are issues with scalability as well as increased latency in multi-step agent-based workflows. The reliance on human oversight is also conditional on the ability of the human operator to identify the subtle changes in the reasoning process, which is not always possible (Masterman et al., 2024b). 6.7. Multi-Agent Specific Defenses Multi-agent-specific defenses primarily address interaction-layer vulnerabilities (Section 5.5), particularly those arising from inter-agent communication and coordination. There are several defensive concerns that apply to multi-agent systems. In relation to communication security, cryptographic signing is used to prevent tampering and spoofing (de Witt, 2025). In relation to consensus, agreement among several agents is required before specific actions are taken. In relation to agent authentication, verification of agent identities is required to prevent impersonation attacks. Table 8 synthesizes the relationship between vulnerability types (Section 5), detection mechanisms (Section 6), and mitigation strategies (Section 7), highlighting remaining coverage gaps. Table 8. Vulnerability–Detection–Mitigation Mapping across Agentic Systems Vulnerability Type Detection Approach(es) Mitigation Approach(es) Coverage Gap Prompt Injection (Perception) Guard models, input anomaly detection, LLM-as-judge Input/output filtering, prompt sanitization Weak against multi-turn and obfuscated attacks Data Poisoning (Perception) Data validation, provenance tracking Dataset filtering, training-time mitigation Limited real-time detection capabilities Reasoning Manipulation (Brain) Chain-of-thought inconsistency detection Architectural defenses, training-time alignment Difficult to detect semantic manipulation reliably Tool Misuse (Action) Execution monitoring, policy violation detection Runtime controls, sandboxing, policy engines Cannot fully prevent high-impact actions Multi-Agent Message Injection (Interaction) Communication auditing, anomaly detection Multi-agent verification, governance mechanisms Vulnerable to coordinated adversarial agents Table 9. Trade-offs across mitigation strategies in agentic systems Strategy Effectiveness Scalability Overhead Complexity Input/Output Filtering Moderate (weak vs adaptive attacks) High Low Low Architectural Defenses High (structural guarantees) Moderate Moderate High Runtime Controls High (strong containment) Moderate High (latency, monitoring) Moderate Training-Time Mitigation Moderate (known attacks) High Low (runtime) Moderate Governance (Human-in-the-loop) Very High (high assurance) Low High (human cost) Moderate Multi-Agent Defense Moderate–High Moderate Moderate–High High Table 10. Overview of Agent Defense Strategies and Implementation Ref Category Technique Agent Type Level Evaluation Effectiveness Limitations (Zeng et al., 2024) Multi-Agent Defense LLM-based response filter agents Multi-Agent System JailbreakBench High Latency overhead (Zhou and others, 2024) Runtime Defense In-Context Adversarial Game Single Agent Model Custom High Training required (Cao et al., 2024) Input Filtering Dynamic guidance injection Single Agent API Multiple Significant May affect utility (Wu et al., 2025c) Input Filtering Soft label + CoT defense RAG-based System Custom Effective Domain-specific (Deng, 2025) Architectural Adaptive encryption + differential privacy Multi-Agent System Framework Framework Complexity (Raza, 2025) Runtime Defense Agent monitoring + admin intervention Multi-Agent System Custom Effective Human overhead (Edwards and Rawat, 2024) Training-time Backdoor trigger removal fine-tuning Single Agent Model Benchmark Moderate May affect performance (Fasha and others, 2024) Architectural OWASP-aligned agent defense framework Tool-using System OWASP Framework Implementation effort (Deng, 2025) Runtime Defense Runtime security controls for LPCI Single Agent System Custom Proposed Not validated (Perez and Ribeiro, 2022) Input Filtering Adversarial prompt detection shield Single Agent API Custom High False positives Note: While Table 5 presents the categorical taxonomy of vulnerabilities, Table 6 quantifies their distribution across the 85 analyzed studies. 7. Research Challenges and Future Directions Based on the quantitative results presented in Sections 5-7 of this chapter, as well as the cross-layer insecurity framework described above, this section attempts to synthesize the identified research gaps in order to outline the containment-oriented research avenues for secure agentic architectures. Table 11. Quantitative Overview of Agentic LLM Security Literature (2023–2025, n=85n=85) Metric Value Notes Total Papers Analyzed 85 2023–2025 publication window Attack-focused Papers 47 (55.3%) Primary focus on vulnerability discovery Defense-focused Papers 12 (14.1%) 3.9:1 attack-to-defense ratio Survey/Framework Papers 26 (30.6%) Includes survey/taxonomy/framework studies Papers from 2025 62 (72.9%) Rapid field expansion year Papers from 2024 21 (24.7%) Field consolidation year Papers from 2023 2 (2.4%) Early foundational work Multi-Agent Focus 39 (45.9%) Most represented architecture Tool-Augmented Focus 10 (11.8%) Underexplored despite real-world adoption Code-Execution Focus 3 (3.5%) Critical architectural research gap Perception-Layer Research 56 (65.9%) Dominant research layer Action-Layer Research 4 (4.7%) 14x gap vs perception layer Prompt Injection Papers 36 (42.4%) Most studied vulnerability type Adversarial Attack Papers 30 (35.3%) Second most studied Jailbreaking Papers 16 (18.8%) Third most studied 7.1. Open Problems and Critical Gaps In accordance with the quantitative analysis provided in Sections 5, 6, and 7, seven critical open problems have been identified. These problems have been listed as follows: Problem 1: Security of Code-Execution Agents (3 papers) From the literature, it is evident that there is a significant gap in research on the security of code execution agents. This represents the most critical underexplored area identified in this review. Code injection is a critical security issue that can potentially allow for arbitrary code execution within the context of the code execution agent. The main technical challenge is to design sandbox mechanisms that are sufficiently restrictive to prevent agents from escaping while being sufficiently permissive to allow agents to function as intended. One example is a data analysis agent that generates Python code for handling uploaded data. If the generated code is vulnerable to a path traversal attack or runs shell commands, an adversary with control over the data can steal server files or make unauthorized network connections. Problem 2: Security of Embodied Agents (0 papers) Despite the growing deployment of robotic systems, the security of embodied agents remains unaddressed in the surveyed literature. Embodied agents have several security issues, including sensor manipulation and actuator control, with direct implications within the physical domain. The main technical challenge is that agents have a tight coupling between perception and action, which complicates the enforcement of reliable safety constraints due to sensor noise and environmental uncertainties. One example is a robotic warehouse agent where adversary labels placed on objects affect perception and lead to incorrect routing decisions. Problem 3: Security of Single-Agent Systems (0 papers primarily focused) Single-agent systems were defined strictly as architectures without tool use, retrieval augmentation, multi-agent interaction, or persistent memory. Under this strict definition, no studies explicitly focused on security analysis of such minimal agent architectures, though single-agent settings appear as baselines in several studies (Table 11). The main technical challenge is that agents have a complex internal reasoning process that complicates isolating and analyzing failure modes without resorting to oversimplification of model behavior. This cluster represents limitations in detection capabilities and evaluation methodologies, especially in adapting to adversarial situations and developing standardized benchmarks. Problem 4: Maturity of Detection Methods (10 detection methods vs 52 attacks) There is a 5:1 ratio of attacks to detection methods, thus reflecting a significant imbalance. It is evident that the maturity level of detection methods is relatively low, with limited evaluation of effectiveness and a lack of standardized protocols. The main technical challenge is that adaptive attackers will continually try to evade detection systems and optimize attacks, which makes classifiers and rule-based detection systems only temporarily effective. Problem 5: Coverage of Tool-Augmented Agents (12%) Only 12% of research literature deals with tool-augmented agents, despite (a) the fast pace at which tool-calling large language models are being deployed in production environments, (b) the special risks tool access imposes, and (c) the large attack surface in enterprise environments. The main technical challenge is to design security mechanisms for tool invocation pipelines that have heterogeneous trust boundaries and side effects. Problem 6: Real-World Deployment Most research is conducted in a lab environment, which does not accurately reflect real-world conditions where attackers operate with limited information, communicate asynchronously, and deal with uncontrolled external data. Problem 7: Standardized Evaluation (absent) Despite eight benchmark datasets being available, there are no standardized evaluation protocols. The main technical challenge is that there is a lack of a unified evaluation protocol that makes it difficult to compare results and security baselines across different studies. 7.2. Future Research Agenda We outline the following research agenda: Short term (1-2 years): The focus is on securing code execution and tool-assisted agent augmentation. The emphasis is on filling critical research gaps in high-risk deployment scenarios (Patnaik et al., 2024). The research community should develop an evaluation framework and conduct empirical studies in real-world deployment scenarios, moving beyond laboratory-based research. Medium term (3-5 years): The scope of the research should be broadened to include agent embodiment, agent vulnerabilities, formalized detection methodologies, and tool supply chain security (Deng et al., 2024). Long-term (5+ years): The research community’s goal is to achieve formal verification of security properties, trustworthy agent architectures, and human oversight. 7.3. Standardization Needs Advancing agentic LLM security requires standardization across several dimensions: a unified vulnerability taxonomy aligned with the four-layer framework proposed in this survey, standardized evaluation metrics (attack success rate, detection accuracy, false positive/negative rates), a unified benchmark protocol for comparing detection and defense effectiveness (Zheng et al., 2025), and guidelines for responsible disclosure of newly identified agent security flaws (Peng et al., 2024). 8. Conclusion This systematic literature review examines 85 research articles published between 2023 and 2025, which discuss security issues related to agentic large language model (LLM) systems. The review follows the PRISMA guidelines, applying a rigorous methodology to systematically search databases, apply inclusion/exclusion criteria, and assess the quality of all included research articles. We propose a four-layer vulnerability taxonomy that maps thirteen vulnerability types to the perception, reasoning (brain), action, and interaction layers of agentic architectures, providing a classification grounded in architectural function rather than inconsistent attack nomenclature. Our quantitative analysis of eighty-five papers reveals a 3.9:1 attack-to-defense ratio and a fourteen-fold disparity between perception-layer and action-layer research coverage, providing the first systematic assessment of structural imbalance in the field. Agentic LLM systems represent a significant leap in capability while introducing new security challenges distinct from those of traditional LLMs and AI agents. The findings of this systematic review reveal that, although research on vulnerabilities is growing, work on defense mechanisms remains limited, representing a critical gap. As autonomous agentic LLM applications continue to evolve, the security issues identified in this review are likely to become increasingly important for both researchers and practitioners. References S. Abdali, R. Anarfi, C. Barberan, and J. He (2024) Securing large language models: threats, vulnerabilities and responsible practices. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §2.1, §5.6. A. Abuadbba, C. Hicks, K. Moore, V. Mavroudis, B. Hasırcıoglu, D. Goel, and P. Jennings (2025) From promise to peril: rethinking cybersecurity red and blue teaming in the age of llms. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §1.2. I. ADABARA, B. O. Sadiq, A. N. Shuaibu, Y. I. Danjuma, and M. Venkateswarlu (2025) Trustworthy agentic ai systems: a cross-layer review of architectures, threat models, and governance strategies for real-world deployment. Vol. 14, Faculty of 1000. External Links: Document, ISSN 2046-1402, ISBN , Link Cited by: §3.3. M. A. Ali and F. Dornaika (2025) Agentic ai: a comprehensive survey of architectures, applications, and future directions. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §3.1. D. Ayzenshteyn, R. Weiss, and Y. Mirsky (2024) The best defense is a good offense: countering LLM-Powered cyberattacks. arXiv preprint arXiv:2410.15396. External Links: Document Cited by: Table 7. A. Bandi, B. Kongari, R. Naguru, S. Pasnoor, and S. V. Vilipala (2025) The rise of agentic AI: a review of definitions, frameworks, architectures, applications, evaluation metrics, and challenges. Vol. 17. External Links: Document Cited by: §1.1, §4.4.2. S. Barua (2024) Exploring tool-using llm agent security. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1, §3.2, §4.4.1, Table 3, Table 3, Table 4. A. Bhatt, C. Rushing, A. M. Kaufman, T. Tracy, V. Georgiev, D. Matolcsi, A. Khan, and B. Shlegeris (2025) Ctrl-z: controlling ai agents via resampling. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.3. L. Boisvert, A. Puri, C. K. R. Evuru, N. Chapados, Q. Cappart, A. Lacoste, K. Dvijotham, and A. Drouin (2025) Malice in agentland: down the rabbit hole of backdoors in the ai supply chain. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.3. V. Boreiko, A. Panfilov, V. Voracek, M. Hein, and J. Geiping (2024) A realistic threat model for large language model jailbreaks. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.2. S. Brohi (2025) Research trends in agentic ai security. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1. R. Buchta, G. Gkoktsis, F. Heine, and C. Kleiner (2024) Advanced persistent threat attack detection systems: a review of approaches, challenges, and trends. Vol. 5, Association for Computing Machinery. External Links: Document, ISSN 2576-5337, 2692-1626, ISBN , Link Cited by: §5.6. A. Caetano, K. K. Verma, A. Taheri, R. Kumaran, Z. Chen, J. Chen, T. Höllerer, and M. Sra (2025) Agentic workflows for conversational human-ai interaction design. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §1.2. H. Cao, W. Luo, Y. Wang, and Z. Liu (2024) Guide for defense (G4D): dynamic guidance for robust and balanced defense in large language models. arXiv preprint arXiv:2410.17922. External Links: Document Cited by: Table 7, Table 10. T. Cao, B. Lim, Y. Liu, Y. Sui, Y. Li, S. Deng, L. Lu, N. Oo, S. Yan, and B. Hooi (2025) VPI-bench: visual prompt injection attacks for computer-use agents. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.3. N. Chattopadhyay, A. Basit, B. Ouni, and M. Shafique (2025) A survey of adversarial defenses in vision-based systems: categorization, methods and challenges. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.5. S. Chen, A. Zharmagambetov, S. Mahloujifar, K. Chaudhuri, and C. Guo (2024) Aligning llms to be robust against prompt injection. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §1.2. A. Chhabra, S. Datta, S. K. Nahin, and P. Mohapatra (2025) Agentic ai security: threats, defenses, evaluation, and open challenges. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §2.1. J. Choi (2025) Review of multi-agent llm security. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1, Table 3, Table 4. M. Christodorescu, E. Fernandes, A. Hooda, S. Jha, J. Rehberger, and K. Shams (2025) Systems security foundations for agentic computing. arXiv preprint arXiv:2512.01295. External Links: Document Cited by: §3.4, Table 3, Table 4. J. Cui, Y. Xu, Z. Huang, S. Zhou, J. Jiao, and J. H. Zhang (2024) Recent advances in attack and defense approaches of large language models. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.4. Y. Cui and H. Du (2025) MAD-Spear: a conformity-driven prompt injection attack on multi-agent debate systems. arXiv preprint arXiv:2507.13038. External Links: Document Cited by: Table 3, Table 4, Table 5. R. Dassanayake, M. Demetroudi, J. Walpole, L. Lentati, J. R. Brown, and E. Young (2025) Manipulation attacks by misaligned ai: risk analysis and safety case framework. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.3. S. Datta, S. K. Nahin, A. Chhabra, and P. Mohapatra (2025) Agentic AI security: threats, defenses, evaluation, and open challenges. arXiv preprint arXiv:2510.23883. External Links: Document Cited by: Table 3, Table 3, Table 4, Table 4. C. S. de Witt (2025) Open challenges in multi-agent security: towards secure systems of interacting ai agents. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §2.1, §5.3, §6.3, §6.7. E. Debenedetti, J. L. Bianchi, S. Braunegg, T. Kuber, A. Kurakin, N. Papernot, and F. Tramèr (2024) AgentDojo: a dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In Proceedings of NeurIPS, External Links: Document Cited by: §4.4.3, Table 3, Table 3, Table 4, Table 5. S. Deng, H. Zhao, Z. Wang, G. Cheng, P. Chen, W. Qian, Z. Ling, J. Yin, A. Y. Zomaya, and S. Dustdar (2025) Agentic services computing. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.6. Z. Deng (2025) AI agent security: threats and defenses. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1, §3.3, Table 3, Table 3, Table 3, Table 3, Table 4, Table 4, Table 7, Table 10, Table 10. Z. Deng, Y. Guo, C. Han, W. Ma, J. Xiong, S. Wen, and Y. Xiang (2024) AI agents under threat: a survey of key security challenges and future pathways. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.2, §7.2. D. R. Desai and M. Riedl (2025) Responsible ai agents. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.4. L. G. Di Maggio (2025) Toward autonomous LLM-Based AI agents for predictive maintenance. Applied Sciences 15 (21), p. 11515. External Links: Document Cited by: §1.1, §1.1, Table 3. Y. Dong, R. Mu, Y. Zhang, S. Sun, T. Zhang, C. Wu, G. Jin, Y. Qi, J. Hu, J. Meng, S. Bensalem, and X. Huang (2024a) Safeguarding large language models: a survey. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.4. Y. Dong, Z. Li, X. Meng, N. Yu, and S. Guo (2024b) Jailbreaking text-to-image models with LLM-Based agents. arXiv preprint arXiv:2408.00523. External Links: Document Cited by: §3.3, Table 3, Table 3, Table 3, Table 4, Table 4. F. Dornaika (2025) Agentic AI: a comprehensive survey of architectures, applications, and future directions. Artificial Intelligence Review 59 (1). External Links: Document Cited by: §1.1, Table 3, Table 3, Table 4. I. Drori, G. Longhitano, M. Mao, S. W. Hyun, Y. Zhang, S. Park, Z. Meeks, X. Zhang, B. Segev, H. Yong, N. Verma, A. Shporer, A. Amit, and M. Udell (2025) Diverse inference and verification for advanced reasoning. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.3. L. Dugan, A. Hwang, F. Trhlík, J. M. Ludan, A. Zhu, H. Xu, D. Ippolito, and C. Callison-Burch (2024) RAID: a shared benchmark for robust evaluation of machine-generated text detectors. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.4. D. Edwards and D. B. Rawat (2024) Agent deprogramming: finetuning away backdoor triggers for secure machine learning models/LLMs. In Proceedings of the IEEE International Conference on Communications and Networking (ICCCN), External Links: Document Cited by: Table 4, Table 10. H. Errico, J. Ngiam, and S. Sojan (2025) Securing the model context protocol (mcp): risks, controls, and governance. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.4. J. Evertz, M. Chlosta, L. Schönherr, and T. Eisenhofer (2024) Whispers in the machine: confidentiality in agentic systems. arXiv preprint arXiv:2402.06922. External Links: Document Cited by: Table 3, Table 3, Table 3, Table 3, Table 4, Table 4. Z. Fang, H. Wang, et al. (2025) Breaking barriers: multi-agent prompt fusion for targeted jailbreaks. arXiv preprint arXiv:2503.00865. External Links: Document Cited by: Table 3, Table 3. M. Fasha et al. (2024) Mitigating the OWASP top 10 for large language models applications using intelligent agents. In Proceedings of the IEEE International Conference on Communications and Computing Research (ICCR), External Links: Document Cited by: Table 10. M. Fazelnia, A. Okutan, and M. Mirakhorli (2022) Supporting ai/ml security workers through an adversarial techniques, tools, and common knowledge (ai/ml att&ck) framework. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.1. H. Feng, T. Zhu, D. Ye, B. Liu, W. Zhou, and P. S. Yu (2024a) The emerged security and privacy of llm agent: a survey with case studies. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §1.2. S. Feng, H. Wan, N. Wang, Z. Tan, M. Luo, and Y. Tsvetkov (2024b) What does the bot say? opportunities and risks of large language models in social media bot detection. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2. X. Feng (2025) Emergent security issues in llm systems. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: §1.1, Table 1, Table 3, Table 4. M. A. Ferrag, D. Hamouda, and M. Debbah (2025) From prompt injections to protocol exploits: threats in LLM-Powered AI agents workflows. arXiv preprint arXiv:2506.23260. External Links: Document Cited by: Table 3, Table 3, Table 3, Table 4, Table 4, Table 4, Table 7, Table 7. D. Ferraiolo, V. Atluri, and S. I. Gavrila (2010) The policy machine: a novel architecture and framework for access control policy specification and enforcement. Journal of Systems Architecture 57, p. 412–424. External Links: Document, ISSN 1383-7621, 1873-6165, ISBN , Link Cited by: §6.4. J. Gan (2024) Navigating security for llm agents. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1, Table 3, Table 3, Table 3, Table 3, Table 4, Table 4, Table 4. T. Gan and Q. Sun (2025) RAG-MCP: mitigating prompt bloat in LLM tool selection via retrieval-augmented generation. arXiv preprint arXiv:2505.03275. External Links: Document Cited by: §3.1. Y. Gan, Y. Yang, Z. Ma, P. He, R. Zeng, Y. Wang, Q. Li, C. Zhou, S. Li, T. Wang, Y. Gao, Y. Wu, and S. Ji (2024) Navigating the risks: a survey of security, privacy, and ethics threats in llm-based agents. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.3. S. Ghosh and G. Mittal (2025) Agentic AI systems in electrical power systems engineering. arXiv preprint arXiv:2511.14478. Cited by: Table 3, Table 4. S. Han, Q. Zhang, Y. Yao, et al. (2024) LLM multi-agent systems: challenges and open problems. arXiv preprint arXiv:2402.03578. External Links: Document Cited by: §3.2, Table 3, Table 4. J. He, S. Chen, F. Zhang, and Z. Yang (2024a) From words to actions: unveiling the theoretical underpinnings of LLM-Driven autonomous systems. arXiv preprint arXiv:2405.19883. External Links: Document Cited by: Table 3. P. He, Y. Xing, J. Li, et al. (2025) Comprehensive vulnerability analysis is necessary for trustworthy LLM-MAS. arXiv preprint arXiv:2506.01245. External Links: Document Cited by: §3.3, Table 3, Table 4. Y. He, E. Wang, Y. Rong, Z. Cheng, and H. Chen (2024b) Security of AI agents. arXiv preprint arXiv:2406.08689. External Links: Document Cited by: §3.3, Table 3. H. Hong, S. Feng, N. Naderloui, S. Yan, J. Zhang, B. Liu, A. Arastehfard, H. Huang, and H. Yuan (2025) SoK: taxonomy and evaluation of prompt security in large language models. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2. Q. Hu, X. Xie, S. Chen, and L. Ma (2024) Large language model supply chain: open problems from the security perspective. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.4. Y. Huang, C. Gao, S. Wu, H. Wang, X. Wang, Y. Zhou, Y. Wang, J. Ye, J. Shi, Q. Zhang, Y. Li, H. Bao, Z. Liu, T. Guan, D. Chen, R. Chen, K. Guo, A. Zou, B. H. Kuen-Yew, C. Xiong, E. Stengel-Eskin, H. Zhang, H. Yin, H. Zhang, H. Yao, J. Yoon, J. Zhang, K. Shu, K. Zhu, R. Krishna, S. Swayamdipta, T. Shi, W. Shi, X. Li, Y. Li, Y. Hao, Y. Hao, Z. Jia, Z. Li, X. Chen, Z. Tu, X. Hu, T. Zhou, J. Zhao, L. Sun, F. Huang, O. C. Sasson, P. Sattigeri, A. Reuel, M. Lamparth, Y. Zhao, N. Dziri, Y. Su, H. Sun, H. Ji, C. Xiao, M. Bansal, N. V. Chawla, J. Pei, J. Gao, M. Backes, P. S. Yu, N. Z. Gong, P. Chen, B. Li, and X. Zhang (2025) On the trustworthiness of generative foundation models: guideline, assessment, and perspective. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.3. Z. Huang, J. Chen, Z. Zhang, and C. Yu (2024) Prompting the unseen: detecting hidden backdoors in black-box models. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2. S. Janjusevic, A. Baron Garcia, and S. Kazerounian (2025) Hiding in the AI traffic: abusing MCP for LLM-Powered agentic red teaming. arXiv preprint arXiv:2511.15998. External Links: Document Cited by: §1.1, Table 3, Table 3, Table 4, Table 4. J. Ji, B. Hou, A. Robey, G. J. Pappas, H. Hassani, S. Yan, E. Wong, and S. Chang (2024) Defending large language models against jailbreak attacks via semantic smoothing. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2. Y. Jia, Z. Shao, Y. Liu, J. Jia, D. Song, and N. Z. Gong (2025) A critical evaluation of defenses against prompt injection attacks. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2, §5.4. Y. Jiang, X. Ma, et al. (2025) Safety at scale: a comprehensive survey of large model safety. SuperIntelligence: Robotics, Safety and Alignment 2 (2). External Links: Document Cited by: Table 3, Table 3, Table 3. D. Jones, G. Severi, M. Pouliot, G. Lopez, J. de Gruyter, S. Zanella-Béguelin, J. Song, B. Bullwinkel, P. Cortez, and A. Minnich (2025) A systematization of security vulnerabilities in computer use agents. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.5. T. Ju et al. (2024) Flooding spread of manipulated knowledge in LLM-Based multi-agent communities. arXiv preprint arXiv:2407.07791. External Links: Document Cited by: Table 3, Table 3, Table 3, Table 4, Table 4, Table 4. Y. Kim, K. Gu, C. Park, et al. (2025) Towards a science of scaling agent systems. arXiv preprint arXiv:2512.08296. External Links: Document Cited by: §3.2. M. Kniejski, M. David, J. Hoelscher-Obermaier, C. S. de Witt, and E. Kran (2025) Multi-agent security tax: trading off security and collaboration capabilities in multi-agent systems. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §1.2. A. Kucharavy, Z. M. Schillaci, L. Maréchal, M. Würsch, L. Dolamic, R. Sabonnadiere, D. P. David, A. Mermoud, and V. Lenders (2023) Fundamentals of generative large language models and perspectives in cyber-defense. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.2. P. Kulkarni and A. Namer (2025) Temporal context awareness: a defense framework against multi-turn manipulation attacks on large language models. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.2. S. Lee, J. Hwang, Y. Jo, and S. Han (2025) Wolfpack adversarial attack for robust multi-agent reinforcement learning. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.2. G. Li, T. Li, and X. Ning (2025) Mind the agent: a comprehensive survey on large language model-based agent safety. Cited by: Table 3, Table 3, Table 5. H. Li (2025) Security of llm agents: a survey. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: §1.1, Table 1, Table 3, Table 3, Table 4, Table 4. X. Li et al. (2024) Targeting the core: a simple and effective method to attack RAG-based agents via direct LLM manipulation. arXiv preprint arXiv:2412.04415. External Links: Document Cited by: Table 3, Table 3, Table 3, Table 4, Table 4, Table 4. Y. Li, Z. Zhang, K. Wang, L. Shi, and H. Wang (2024) Model-editing-based jailbreak against safety-aligned large language models. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §3.4. Z. Liao, K. Chen, Y. Lin, K. Li, Y.Z. Liu, H. Chen, X. Huang, and Y. Yu (2025) Attack and defense techniques in large language models: a survey and new perspectives. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2, §5.4. H. Lin, Y. Lao, T. Geng, Y. Tan, and W. Zhao (2025) UniGuardian: a unified defense for detecting prompt injection, backdoor attacks and adversarial attacks in large language models. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2. A. Liu et al. (2024) Compromising embodied agents with contextual backdoor attacks. arXiv preprint arXiv:2408.02882. External Links: Document Cited by: Table 3, Table 3. B. Liu, X. Li, J. Zhang, et al. (2025a) Advances and challenges in foundation agents. arXiv preprint arXiv:2504.01990. External Links: Document Cited by: §3.3, §3.4, Table 3, Table 4. B. Liu, X. Li, J. Zhang, J. Wang, T. He, S. Hong, H. Liu, S. Zhang, K. Song, K. Zhu, Y. Cheng, S. Wang, X. Wang, Y. Luo, H. Jin, P. Zhang, O. Liu, J. Chen, H. Zhang, Z. Yu, H. Shi, B. Li, D. Wu, F. Teng, X. Jia, J. Xu, J. Xiang, Y. Lin, T. Liu, T. Liu, Y. Su, H. Sun, G. Berseth, J. Nie, I. Foster, L. Ward, Q. Wu, Y. Gu, M. Zhuge, X. Tang, H. Wang, J. You, C. Wang, J. Pei, Q. Yang, X. Qi, and C. Wu (2025b) Advances and challenges in foundation agents: from brain-inspired intelligence to evolutionary, collaborative, and safe systems. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.4, §6.6. X. Liu, Z. Yu, Y. Zhang, N. Zhang, and C. Xiao (2024) Automatic and universal prompt injection attacks against large language models. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.2. W. Ma (2025) Safety of llm agents. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1, Table 1. T. Masterman, S. Besen, M. Sawtell, and A. Chao (2024a) The landscape of emerging AI agent architectures for reasoning, planning, and tool calling: a survey. arXiv preprint arXiv:2404.11584. External Links: Document Cited by: §3.2. T. Masterman, S. Besen, M. Sawtell, and A. Chao (2024b) The landscape of emerging ai agent architectures for reasoning, planning, and tool calling: a survey. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.6. F. Mazzone, A. Al Badawi, et al. (2024) Investigating privacy attacks in the gray-box setting. arXiv preprint arXiv:2409.17283. External Links: Document Cited by: §3.4, Table 5. T. R. McIntosh, T. Sušnjak, T. Liu, P. Watters, and M. N. Halgamuge (2024) Inadequacies of large language model benchmarks in the era of generative artificial intelligence. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.4. D. J. Miller, Z. Xiang, and G. Kesidis (2022) Adversarial learning in statistical classification: a comprehensive review of defenses against attacks. Cornell University. External Links: Document, ISSN , ISBN , Link Cited by: §5.6. L. Mo, Z. Liao, B. Zheng, Y. Su, C. Xiao, and H. Sun (2024) A trembling house of cards? mapping adversarial attacks against language agents. arXiv preprint arXiv:2402.10196. External Links: Document Cited by: §3.2, Table 3, Table 4. G. Molinari and F. Ciravegna (2025) Towards pervasive distributed agentic generative AI: a state of the art. arXiv preprint arXiv:2506.13324. External Links: Document Cited by: §3.1. H. Mu, H. He, Y. Zhou, Y. Feng, Y. Xu, L. Qin, X. Shi, Z. Liu, X. Han, Q. Shi, Q. Zhu, and W. Che (2024) Stealthy jailbreak attacks on large language models via benign data mirroring. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.3. V. S. Narajala and O. Narayan (2025) Securing agentic AI: a comprehensive threat model and mitigation framework for generative AI agents. arXiv preprint arXiv:2504.19956. External Links: Document Cited by: Table 3, Table 3, Table 4. M. Nasr, N. Carlini, C. Sitawarin, S. Schulhoff, J. Hayes, M. Ilie, J. Pluto, S. Song, H. Chaudhari, I. Shumailov, A. Thakurta, K. Xiao, A. Terzis, and F. Tramèr (2025) The attacker moves second: stronger adaptive attacks bypass defenses against llm jailbreaks and prompt injections. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2, §5.4. S. K. Navneet and J. Chandra (2025) Rethinking autonomy: preventing failures in AI-Driven software engineering. arXiv preprint arXiv:2508.11824. External Links: Document Cited by: §3.2. H. A. Noman and O. M. F. Abu-Sharkh (2023) Code injection attacks in wireless-based internet of things (IoT): a comprehensive review and practical implementations. Vol. 23. External Links: Document Cited by: §3.3. S. Ostermann, K. Baum, C. Endres, J. Masloh, and P. Schramowski (2024) Soft begging: modular and efficient shielding of llms against prompt injection and jailbreaking based on prompt tuning. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.2. M. Z. Pan, N. Arabzadeh, R. Cogo, et al. (2025) Measuring agents in production. arXiv preprint arXiv:2512.04123. External Links: Document Cited by: Table 3, Table 4. D. Pandya, H. Teckani, and S. S. Raybole (2024) Limiting prompt bypass in llm-integrated applications. International Journal for Research in Applied Science and Engineering Technology 12, p. 2168–2183. External Links: Document, ISSN 2321-9653, ISBN , Link Cited by: §5.3. A. S. Patlan, P. Sheng, S. A. Hebbar, P. Mittal, and P. Viswanath (2025) Real AI agents with fake memories: fatal context manipulation attacks on Web3 agents. arXiv preprint arXiv:2503.16248. External Links: Document Cited by: Table 3, Table 4. N. Patnaik, J. Hallett, and A. Rashid (2024) Saltzer & schroeder for 2030: security engineering principles in a world of ai. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §7.2. M. Pavlova, E. Brinkman, K. Iyer, and V. Albiero (2024) Automated red teaming with GOAT: the generative offensive agent tester. arXiv preprint arXiv:2410.01606. External Links: Document Cited by: Table 5. R. Pedro, C. Daniel, and R. Paolo (2024) Prompt infection: LLM-to-LLM prompt injection within multi-agent systems. arXiv preprint arXiv:2407.12926. External Links: Document Cited by: Table 3, Table 3, Table 4, Table 4. B. Peng, Z. Bi, Q. Niu, M. Liu, P. Feng, T. Wang, L. Yan, Y. Wen, Y. Zhang, and C. H. Yin (2024) Jailbreaking and mitigation of vulnerabilities in large language models. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.2, §6.1, §7.3. F. Perez and I. Ribeiro (2022) Ignore previous prompt: attack techniques for language models. arXiv preprint arXiv:2211.09527. External Links: Document Cited by: Table 4, Table 7, Table 10. L. Qendro, S. Ha, de Jong Rene, and P. Maji (2022) Stochastic-shield: a probabilistic approach towards training-free adversarial defense in quantized cnns. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.2. A. Rao, S. Vashistha, A. Naik, S. Aditya, and M. Choudhury (2023) Tricking llms into disobedience: formalizing, analyzing, and detecting jailbreaks. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.3. M. Raza (2025) TRiSM for llm agents. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1, Table 3, Table 7, Table 10. Z. Ren, Z. Qian, Y. Gao, Y. Shi, S. Zheng, and J. He (2025) GTM: simulating the world of tools for AI agents. arXiv preprint arXiv:2512.04535. External Links: Document Cited by: §1.1, Table 3, Table 4. C. G. Rivera, G. S. Byrd, W. Paul, T. Feldman, M. Booker, E. Holmes, D. A. Handelman, B. Kemp, A. R. Badger, A. Schmidt, K. M. Jatavallabhula, C. M. de Melo, L. Seenivasan, M. Unberath, and R. Chellappa (2024) ConceptAgent: llm-driven precondition grounding and tree search for robust task planning and execution. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §3.2. S. Rossi, A. M. Michel, R. R. Mukkamala, and J. B. Thatcher (2024) An early categorization of prompt injection attacks on large language models. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.2. P. J. Sager, B. Meyer, P. Yan, et al. (2025) A comprehensive survey of agents for computer use: foundations, challenges, and future directions. External Links: Document Cited by: §3.3. Z. Shang and W. Wei (2025) Evolving security in llms: a study of jailbreak attacks and defenses. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2. D. Shapiro, W. Li, M. Delaflor, and C. Toxtli (2023) Conceptual framework for autonomous cognitive entities. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §3.3. A. Shayegani (2023) A survey on llm safety and security. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1, Table 3, Table 4. E. Shayegani, M. A. A. Mamun, Y. Fu, P. Zaree, Y. Dong, and N. Abu‐Ghazaleh (2023) Survey of vulnerabilities in large language models revealed by adversarial attacks. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2. C. Shi, S. Lin, S. Song, J. Hayes, I. Shumailov, I. Yona, J. Pluto, A. Pappu, C. A. Choquette-Choo, M. Nasr, C. Sitawarin, G. Gibson, A. Terzis, and J. ”. Flynn (2025) Lessons from defending gemini against indirect prompt injections. External Links: Document, ISSN , ISBN , Link Cited by: §4.2. D. Shi, T. Shen, Y. Huang, Z. Li, Y. Leng, R. Jin, C. Liu, X. Wu, Z. Guo, L. Yu, L. Shi, B. Jiang, and D. Xiong (2024) Large language model safety: a holistic survey. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.6. Z. Shi (2024) LLM safety: a review. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1. S. Shrestha, C. Banda, A. K. Mishra, F. Djebbar, and D. Puthal (2025) Investigation of cybersecurity bottlenecks of ai agents in industrial automation. Computers 14, p. 456–456. External Links: Document, ISSN 2073-431X, ISBN , Link Cited by: §6.3. A. Singh, A. Ehtesham, S. Kumar, and T. T. Khoei (2025) Agentic retrieval-augmented generation: a survey on agentic RAG. arXiv preprint arXiv:2501.09136. External Links: Document Cited by: §3.1, Table 3. T. South, S. Marro, T. Hardjono, R. Mahari, C. D. Whitney, D. Greenwood, A. Chan, and A. Pentland (2025) Authenticated delegation and authorized ai agents. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.6. H. Triedman, R. Jha, and V. Shmatikov (2025) Multi-agent systems execute arbitrary malicious code. arXiv preprint arXiv:2503.12188. External Links: Document Cited by: Table 3, Table 3, Table 4, Table 4. S. Valentin, J. Fu, G. Detommaso, S. Xu, G. Zappella, and B. Wang (2024) Cost-effective hallucination detection for llms. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.6. L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y. Lin, W. X. Zhao, Z. Wei, and J. Wen (2024a) A survey on large language model based autonomous agents. Frontiers of Computer Science 18. External Links: Document, ISSN 2095-2228, 2095-2236, ISBN , Link Cited by: Table 3. M. Wang, Y. Zhang, and G. Gu (2025a) PromptSleuth: detecting prompt injection via semantic intent invariance. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2. S. Wang, T. Zhu, B. Liu, M. Ding, X. Guo, D. Ye, and W. Zhou (2024b) Unique security and privacy threats of large language model: a comprehensive survey. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2. S. Wang, Y. Zhao, X. Hou, and H. Wang (2024c) Large language model supply chain: a research agenda. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §1.2. T. Wang, Y. Chen, Z. Liu, Z. Chen, H. Chen, X. Zhang, and W. Cheng (2024d) Humanizing the machine: proxy attacks to mislead llm detectors. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.6. T. Wang, Z. Bi, Y. Zhang, M. Liu, W. C. Hsieh, F. Pan, L. Yan, Y. Wen, B. Peng, J. Liu, K. Chen, S. Zhang, M. Li, C. Jiang, X. Song, J. Yang, B. Jing, J. Ren, J. Song, H. E. Tseng, S. Chen, Y. Wang, C. X. Liang, J. Xu, X. Pan, J. Wang, and Q. Niu (2024e) Deep learning model security: threats and defenses. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §3.4. X. Wang (2025) Unique security challenges for llm agents. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1, Table 1. Y.-M. Wang, S. Chen, R. Alkhudair, B. Alomair, and D. Wagner (2025b) Defending against prompt injection with datafilter. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.2. Y. Wang, S. Liu, J. Fang, and Z. Meng (2025c) EvoAgentX: an automated framework for evolving agentic workflows. arXiv preprint arXiv:2507.03616. External Links: Document Cited by: §3.1. Y. Wang, Y. Pan, S. Guo, and Z. Su (2025d) Security of internet of agents: attacks and countermeasures. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.5. Y. Wang, Y. Pan, Z. Su, Y. Deng, Q. Zhao, L. Du, T. H. Luan, J. Kang, and D. Niyato (2025e) Large model based agents: state-of-the-art, cooperation paradigms, security and privacy, and future trends. IEEE Communications Surveys & Tutorials, p. 1–1. External Links: Document, ISSN 1553-877X, 2373-745X, ISBN , Link Cited by: §2.2, §6.2. Y. Wang, Y. Pan, Q. Zhao, Y. Deng, Z. Su, L. Du, and T. H. Luan (2024f) Large model agents: state-of-the-art, cooperation paradigms, security and privacy, and future trends. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §1.2, §6.3. Z. Wang, Z. Zhou, J. Song, Y. Huang, Z. Shu, and L. Ma (2024g) Towards testing and evaluating vision-language-action models for robotic manipulation: an empirical study. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.6. E. Wenger, J. Passananti, A. N. Bhagoji, Y. Yao, H. Zheng, and B. Y. Zhao (2021) Backdoor attacks against deep learning systems in the physical world. External Links: Document, ISSN , ISBN , Link Cited by: §4.3. C. Wu, J. Y. Koh, R. Salakhutdinov, D. Fried, and A. Raghunathan (2024a) Dissecting adversarial robustness of multimodal LM agents. arXiv preprint arXiv:2406.12814. External Links: Document Cited by: §3.2. F. Wu, S. Wu, Y. Cao, and C. Xiao (2024b) WIPI: a new web threat for LLM-Driven web agents. arXiv preprint arXiv:2402.16965. External Links: Document Cited by: Table 3, Table 3, Table 4. X. Wu, M. Li, M. Li, and M. Han (2025a) Towards robust and secure embodied ai: a survey on vulnerabilities and attacks. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.4. Y. Wu, S. Liang, C. Zhang, et al. (2025b) From human memory to AI memory: a survey on memory mechanisms in the era of LLMs. arXiv preprint arXiv:2504.15965. External Links: Document Cited by: §3.1. Z. Wu, J. Wen, W. Peng, and H. Chang (2025c) SLIP: soft label mechanism and key-extraction-guided CoT-based defense against instruction backdoor in APIs. arXiv preprint arXiv:2508.06153. External Links: Document Cited by: Table 7, Table 10. P. Xia, K. Zeng, J. Liu, C. Qin, and F. Wu (2025) Agent0: unleashing self-evolving agents from zero data via tool-integrated reasoning. arXiv preprint arXiv:2511.16043. External Links: Document Cited by: §1.1. F. F. Xu, Y. Song, B. Li, et al. (2024a) TheAgentCompany: benchmarking LLM agents on consequential real world tasks. arXiv preprint arXiv:2412.14161. External Links: Document Cited by: §1.1. H. Xu, J. Yuan, A. Zhou, et al. (2024b) GenAI-powered multi-agent paradigm for smart urban mobility. arXiv preprint arXiv:2409.00494. External Links: Document Cited by: §3.2. H. Xu, D. Wu, Y. Zhai, and K. Sun (2025) SentinelAgent: graph-based anomaly detection in multi-agent systems. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.3. R. Xu and K. Ding (2024) Large language models for anomaly and out-of-distribution detection: a survey. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2. X. Xu (2025) LLMs for cybersecurity: agentic risks. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1. H. Yang (2024) Security for agentic ai systems. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1, Table 5. Z. Yang and I. Harris (2025) LogLLaMA: transformer-based log anomaly detection with llama. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.3. S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao (2022) ReAct: synergizing reasoning and acting in language models. arXiv preprint arXiv:2210.03629. External Links: Document Cited by: §3.1. A. Yeo and D. Choi (2025) Multimodal prompt injection attacks: risks and defenses for modern llms. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.6. M. Yu et al. (2024) LLM-Virus: evolutionary jailbreak attack on large language models. arXiv preprint arXiv:2501.00055. External Links: Document Cited by: Table 3, Table 4. M. Zahid and T. S. Bharati (2025) Enhancing cybersecurity in IoT systems: a hybrid deep learning approach for real-time attack detection. Discover Internet of Things 5 (1). External Links: Document Cited by: §3.3. A. Zangana (2024) LLM security: a survey. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: §2.1. Y. Zeng, Y. Wu, X. Zhang, H. Wang, and Q. Wu (2024) AutoDefense: multi-agent LLM defense against jailbreak attacks. arXiv preprint arXiv:2403.04783. External Links: Document Cited by: Table 7, Table 10. Q. Zhan, Z. Liang, Z. Ying, and D. Kang (2024) InjecAgent: benchmarking indirect prompt injections in tool-integrated LLM agents. In Findings of the Association for Computational Linguistics: ACL 2024, External Links: Document Cited by: §4.4.1, Table 3, Table 3, Table 3, Table 4, Table 4, Table 4, Table 5. H. Zhang, J. Huang, K. Mei, Y. Yao, Z. Wang, C. Zhan, H. Wang, and Y. Zhang (2024a) Agent security bench (asb): formalizing and benchmarking attacks and defenses in llm-based agents. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §1.2, §4.5, §5.4, Table 5. J. Zhang, H. Bu, H. Wen, Y. Chen, L. Li, and H. Zhu (2024b) When LLMs meet cybersecurity: a systematic literature review. arXiv preprint arXiv:2405.03644. External Links: Document Cited by: §3.2. K. Zhang, Z. Su, P. Chen, E. Bertino, X. Zhang, and N. Li (2025a) LLM agents should employ security principles. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.3. W. Zhang, X. Li, Y. Zhang, et al. (2025b) Deep research: a survey of autonomous research agents. arXiv preprint arXiv:2508.12752. External Links: Document Cited by: §3.2. X. Zhang, C. Zhang, T. Li, Y. Huang, X. Jia, X. Xie, Y. Liu, and C. Shen (2023) JailGuard: a universal detection framework for llm prompt-based attacks. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.2. Y. Zhang (2024) Breaking the agent barrier: security of llm agents. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: §2.1. J. Zheng, J. Sun, C. Lin, Z. Zhao, C. Ma, C. Zhang, C. Wang, H. Wang, and C. P. Shen (2025) Revisiting adversarial patch defenses on object detectors: unified evaluation, large-scale dataset, and new insights. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §7.3. P. Y. Zhong, S. Chen, R. Wang, M. McCall, B. L. Titzer, H. Miller, and P. B. Gibbons (2025) RTBAS: defending llm agents against prompt injection and privacy leakage. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §5.3. X. Zhou, H. Kim, F. Brahman, L. Jiang, H. Zhu, X. Lu, F. Xu, B. Y. Lin, Y. Choi, N. Mireshghallah, R. L. Bras, and M. Sap (2024) HAICOSYSTEM: an ecosystem for sandboxing safety risks in human-ai interactions. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §6.4. Y. Zhou et al. (2024) Defending jailbreak prompts via in-context adversarial game. arXiv preprint arXiv:2402.13148. External Links: Document Cited by: Table 3, Table 7, Table 10. Y. Zhu (2025) Master survey of agentic llm security. arXiv. Note: Placeholder entry added to resolve missing citation key; please replace with the correct bibliographic data. Cited by: Table 1, Table 3, Table 4. S. Zychlinski (2025) A whole new world: creating a parallel-poisoned web only ai-agents can see. arXiv (Cornell University). External Links: Document, ISSN , ISBN , Link Cited by: §4.5.