Paper deep dive
Security of LLM-based agents regarding attacks, defenses, and applications: A comprehensive survey
Yaxin Tang, Yijia Liu, Jiahe Lan, Zheng Yan, Erol Gelenbe
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 93%
Last extracted: 3/11/2026, 1:10:59 AM
Summary
This paper provides a comprehensive survey of the security landscape surrounding LLM-based agents, covering a taxonomy of attacks and defenses, evaluation criteria, and the dual role of these agents in cyber offense and defense. It identifies critical gaps in existing literature, specifically the lack of unified evaluation metrics and the under-exploration of agents as active security participants.
Entities (4)
Relation Signals (3)
Multi-Agent Systems â contains â LLM-based agents
confidence 95% ¡ In Multi-Agent Systems (MASs), natural language communication enables coordinated division of labor
LLM-based agents â facedwith â Prompt Injection
confidence 95% ¡ exposing single agents to threats such as prompt injection
LLM-based agents â usedfor â Cybersecurity
confidence 90% ¡ security-related applications enabled by the LLM-based agents as cyber offenses or cyber defenses
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Large Language Model (LLM) based agents that employ an LLM as a core reasoning engine, are autonomous or semi-autonomous systems. Equipped with dedicaâŚ
Tags
Links
Full Text
19,986 characters extracted from source content.
Expand or collapse full text
Information FusionVolume 127, Part C, March 2026, 103941Full Length ArticleSecurity of LLM-based agents regarding attacks, defenses, and applications: A comprehensive surveyAuthor links open overlay panelYaxin Tang a, Yijia Liu a, Jiahe Lan a, Zheng Yan a b, Erol Gelenbe c dShow moreAdd to MendeleyShareCitehttps://doi.org/10.1016/j.inffus.2025.103941Get rights and contentHighlightsâ˘A systematic taxonomy of attacks and defenses of the LLM-based agents.â˘Two sets of evaluation criteria for evaluating attacks and defenses of the LLM-based agents.â˘Review representative attack and defense methods of the LLM-based agents.â˘Investigate the applications enabled by the LLM-based agents as cyber offenses or cyber defenses.â˘Identify open issues and propose future research directions.AbstractLarge Language Model (LLM) based agents that employ an LLM as a core reasoning engine, are autonomous or semi-autonomous systems. Equipped with dedicated perception and action modules, they can sense their environment and take autonomous actions to execute complex tasks. Increasingly used for automated decision-making and real-world interactions that need multi-step planning capabilities and persistent engagement with external tools and environments, these agents face substantial and complex security risks. Compared to single-turn LLM inference, the agentic execution of complex tasks significantly expands the attack surface. Although prior work has surveyed security threats and defenses for LLM-based agents, two key issues remain to be addressed: (i) lack of a comprehensive review on attack and defense methods under unified evaluation criteria, and (i) under-exploration of the security applications of LLM-based agents, ranging from enabling cyberattacks to strengthening cyber defense. This paper addresses these gaps with a comprehensive survey of attacks against, and defenses of, the LLM-based agents, as well as a review of the security-related applications enabled by LLM-based agents. We first introduce the foundations of LLM-based agents, and describe the structure and scope of this review. We then propose two complementary sets of evaluation criteria for rigorously evaluating the performance of attacks and defenses. Using these criteria, we analyze the strengths and limitations of the work presented in the relevant literature. In addition, we propose a taxonomy of security-related applications enabled by LLM-based agents and summarize the existing work from two perspectives: cyber offense and cyber defense. Finally, we identify key open challenges and propose future research directions to advance the secure development and deployment of LLM-based agents.IntroductionLarge Language Models (LLMs) have achieved remarkable success in a wide range of tasks, including natural language understanding, logical reasoning, and code generation [1], [2], [3], [4]. These breakthroughs are driven by increasingly powerful architectures and access to massive, high-quality datasets. Building on this foundation, researchers are extending LLMs to serve as a core cognitive module of agentic systems by integrating them with external components, such as memory, tool interfaces, and environments, to create the LLM-based agents capable of autonomously executing tasks in open-world settings [5]. the LLM-based agents (in short agents) are autonomous or semi-autonomous systems that employ an LLM as their core reasoning engine to perform tasks. Compared to text-only LLMs, the LLM-based agents implement a full task loop, from perception input and task reasoning to action execution, thereby exhibiting great autonomy and task adaptability. They can perform end-to-end decision making and execution towards predefined objectives (e.g., weather checking, coffee ordering, and website building) [6]. In Multi-Agent Systems (MASs), natural language communication enables coordinated division of labor in complex, dynamic environments, improving overall decision quality and task execution performance. In practical deployments, representative systems such as GPT-4 [7] and Claude [8] have already been applied in sectors including healthcare, education, and finance [9], [10], [11].However, the increasing complexity and open-ended functionality of these agents raise serious security concerns. Unlike conventional LLMs confined to input-output processing, the LLM-based agents operate across critical layers like prompt interpretation, multi-round interaction, tool invocation, and long-horizon planning. This multi-layered architecture inherently expands the attack surface, exposing single agents to threats such as prompt injection, jailbreak, unsafe tool use, memory poisoning, and reasoning failures, where subtle perturbations can cascade internally, compromising the agentâs function. Critically, in MASs, the attack surface broadens further and undergoes a qualitative shift. The interconnectedness introduces vulnerabilities in inter-agent communication channels, shared knowledge bases, and emergent coordination protocols. Moreover, the LLM-based agents act as both attack targets and active participants in security scenarios. On the one hand, their autonomy and tool access make them attractive targets of adversaries. Thus, defenses should be explored to protect them. On the other hand, these same capabilities can be exploited to automate security defense tasks, such as detecting threats or orchestrating multi-agent defense strategies. But they may also be leveraged by adversaries to launch malicious attacks against valuable systems.We can find a number of related surveys conducted regarding the security of the LLM-based agents. Specifically, a number of works [12], [13], [14], [15] characterize the security threats faced by agents and catalog corresponding defense methods. However, they stop short of a systematic performance evaluation of existing attack and defense methods. Notably, Deng et al. [13] grounded the threat landscape in the agentâs modular architecture, tracing the origins of its attack surfaces and summarizing their risk characteristics, an important conceptual advance. Extend this, the surveys [16], [17], [18] primarily evaluate the security posture of agents themselves under existing benchmarks, rather than the performance of attack and defense methods. Moreover, Kong et al. [19] highlighted the malicious externalities of agent behaviors (e.g., harms to benign users, the environment, and other agents), yet they did not analyze how agents can be leveraged to strengthen defenses. Finally, while Ferrag et al. [20] offered the first detailed review of agent-specific attack surfaces, their paper still lacks a systematic synthesis of agent-enabled applications in cybersecurity. Referring to Table 1 that compares existing surveys, we can find two key gaps: (i) the absence of a comprehensive review on attack and defense methods under unified evaluation criteria, and (i) limited exploration of the agentsâ dual roles as both offenders and guardians in cybersecurity. Consequently, these significant gaps underscore the critical need for a comprehensive, structured, and systematic analysis of attacks targeting and defenses designed for the LLM-based agents, as well as their applications in cybersecurity, playing as dual roles.In this paper, we undertake a systematic review on attacks and defenses targeting the LLM-based agents, as well as their applications in offensive and defensive cybersecurity. In the security landscape surrounding the LLM-based agents, we integrate a novel taxonomy, unified evaluation criteria, and a dual perspective (attacker and defender) to perform our review and analysis in order to explore open issues and direct future research efforts. The main contributions of this survey are summarized as follows.â˘We propose two sets of evaluation criteria to evaluate the performance of attack and defense methods targeting the LLM-based agents.â˘We develop a taxonomy of attack methods against the LLM-based agents organized by attack impact targets and a complementary taxonomy of their defense methods based on protected components.â˘We conduct a comprehensive review on existing attacks and defense methods targeting the LLM-based agent systems against our proposed criteria, delineating their strengths and limitations.â˘We emphasize a growing research frontier by leveraging the LLM-based agents themselves as autonomous attackers or defenders through a literature review, showing their potential for serving as next-generation cybersecurity agents.â˘We identify critical open issues and outline promising future research directions towards secure and trustworthy the LLM-based agents.The remainder of this paper is organized as follows. In Section 2, we begin by introducing the LLM-based agents, elucidating their basic components, and then outline our survey scope. In Section 3, we propose two sets of evaluation criteria to systematically evaluate the performance of attack and defense methods. In Section 4, we categorize existing attack techniques and provide a comprehensive review based on the proposed evaluation criteria. Similarly, in Section 5, we categorize existing defense methods and conduct a comprehensive review using the proposed evaluation criteria for performance analysis. In Section 6, we present a comprehensive taxonomy and synthesis of the literature on applications enabled by the LLM-based agents as cyber attackers and defenders. In Section 7, we discuss the open issues and outline potential directions for future research. Finally, we draw a conclusion in the last section.Access through your organizationCheck access to the full text by signing in through your organization.Access through your organizationSection snippetsBackground knowledgeIn this section, we first introduce the LLM-based agent by outlining its definition, core advantages, and typical architecture. Building on this foundation, we propose our review framework that systematically exhibits its dual roles as an attack target and an enabler for both attacking and defending.Evaluation criteriaIn this section, we present two sets of evaluation criteria, as illustrated in Fig. 3. The first set is designed to evaluate the effectiveness of attack methods by measuring their impact on agent behavior. The second set focuses on evaluating the performance of defense methods in mitigating these attacks.Attacks against the LLM-based agentsIn recent years, attacks targeting the LLM-based agents have become increasingly prominent and diverse. In this section, we conduct a thorough review of the latest research advances concerning security threats against the LLM-based agents. We performed a systematic search using keywords such as âthe LLM-based agentsâ, âAttack,â and âDefenseâ across major academic databases, including ACM, IEEE Xplore, Web of Science, Springer, Elsevier, Google Scholar, and arXiv, covering publications from 2023 Defenses for the LLM-based agentsIn this section, we shift the focus from adversarial techniques to defense methods, aiming to provide a structured understanding of current efforts to safeguard the LLM-based agents. Mirroring the structure of Section 4, in Section 5.1, we begin by proposing a component-centric classification of defenses, grounded in the modular architecture of the LLM-based agents. Then, in Section 4.2, we evaluate the strengths and limitations of representative techniques using the evaluation criteriaSecurity-related applications enabled by the LLM-based agentsThis section reviews two main security-related applications enabled by the LLM-based agents, as either cyber offenses or cyber defenses. Unlike Sections 4 and 5, which adopt a unified structure comprising technical categorization followed by a systematic review of existing methods, this section is organized by usage intent by delineating two opposing but complementary directions. Section 6.1, explores how adversaries harness the LLM-based agents to automate or enhance cyber attacks. Section 6.2 Open issues and future directionsFollowing the comprehensive review of attacks targeting the LLM-based agents and the corresponding defense mechanisms, we identify key open issues and outline promising future research directions to advance the development of security solutions for the LLM-based agents.ConclusionIn this paper, we conducted a comprehensive survey on attacks and defenses of the LLM-based agents. Specifically, we proposed two sets of evaluation criteria for systematically evaluating the performance and quality of attack and defense methods, and figuring out their shortcomings. Based on our proposed attack evaluation criteria, we thoroughly reviewed existing attack methods against the LLM-based agents by analyzing their transferability, robustness, stealthiness, adaptability,CRediT authorship contribution statementYaxin Tang: Writing â original draft. Yijia Liu: Validation, Conceptualization. Jiahe Lan: Validation, Methodology. Zheng Yan: Writing â review & editing, Supervision, Methodology, Funding acquisition. Erol Gelenbe: Writing â review & editing.Declaration of competing interestRegarding the paper entitled âA Comprehensive Survey on the Security of LLM-based Agents: Attacks, Defenses, and Applicationsâ authored by Yaxin Tang, Yijia Liu, Jiahe Lan, Zheng Yan, Erol Gelenbe, there is no any conflict of interest to declare.AcknowledgmentThis work is supported in part by the National Natural Science Foundation of China under Grant U23A20300; in part by the Key Research Project of Shaanxi Natural Science Foundation under Grant 2023-JC-ZD-35; in part by the Concept Verification Funding of Hangzhou Institute of Technology of Xidian University under Grant GNYZ2024X007; and in part by the China 111 Project under Grant B16037.Recommended articlesReferences (185)Q. Jiang et al.Deepseek vs. chatGPT vs. claude: a comparative study for scientific computing and scientific machine learning tasksTheor. Appl. Mech. Lett.(2025)Y. Yao et al.A survey on large language model (llm) security and privacy: the good, the bad, and the uglyHigh-Confidence Computing(2024)R. Zhang et al.On large language models safety, security, and privacy: a surveyJ. Electron. Sci. Technol.(2025)T. Brown et al.Language models are few-shot learnersAdv. Neural Inf. Process. Syst.(2020)H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale,...J. Wei et al.Chain-of-thought prompting elicits reasoning in large language modelsAdv. Neural Inf. Process. Syst.(2022)Z. Feng, D. Guo, D. Tang, N. Duan, X. Feng, M. Gong, L. Shou, B. Qin, T. Liu, D. Jiang, et al., Codebert: a pre-trained...Y. Cheng, C. Zhang, Z. Zhang, X. Meng, S. Hong, W. Li, Z. Wang, Z. Wang, F. Yin, J. Zhao, et al., Exploring large...Z. Xi et al.The rise and potential of large language model based agents: a surveySci. China Inf. Sci.(2025)K. SandersonGPT-4 Is here: what scientists thinkNature(2023)G. Wang, Y. Xie, Y. Jiang, A. Mandlekar, C. Xiao, Y. Zhu, L. Fan, A. Anandkumar, Voyager: an open-ended embodied agent...Q. Zeng, Q. Yang, S. Dong, H. Du, L. Zheng, F. Xu, Y. Li, Perceive, reflect, and plan: designing llm agent for...K. Zhang, J. Li, G. Li, X. Shi, Z. Jin, Codeagent: enhancing code generation with tool-integrated agent systems for...F. He, T. Zhu, D. Ye, B. Liu, W. Zhou, P.S. Yu, The emerged security and privacy of llm agent: a survey with case...Z. Deng et al.Ai agents under threat: a survey of key security challenges and future pathwaysACM Comput. Surv.(2025)J. Luo, W. Zhang, Y. Yuan, Y. Zhao, J. Yang, Y. Gu, B. Wu, B. Chen, Z. Qiao, Q. Long, et al., Large language model...Y. Gan, Y. Yang, Z. Ma, P. He, R. Zeng, Y. Wang, Q. Li, C. Zhou, S. Li, T. Wang, et al., Navigating the risks: a survey...K. Wang, G. Zhang, Z. Zhou, J. Wu, M. Yu, S. Zhao, C. Yin, J. Fu, Y. Yan, H. Luo, et al., A comprehensive survey in LLM...M. Yu, F. Meng, X. Zhou, S. Wang, J. Mao, L. Pang, T. Chen, K. Wang, X. Li, Y. Zhang, et al., A survey on trustworthy...A. Chen, Y. Wu, J. Zhang, S. Yang, J.-t. Huang, K. Wang, W. Wang, S. Wang, A survey on the safety and security threats...D. Kong, S. Lin, Z. Xu, Z. Wang, M. Li, Y. Li, Y. Zhang, Z. Sha, Y. Li, C. Lin, et al., A survey of LLM-driven AI agent...M.A. Ferrag, N. Tihanyi, D. Hamouda, L. Maglaras, M. Debbah, From prompt injections to protocol exploits: threats in...L. Wang et al.A survey on large language model based autonomous agentsFront. Comput. Sci.(2024)Y. Du, Z. Ma, Y. Yang, K. Deng, X. Chen, B. Yang, Y. Xiang, M. Liu, B. Qin, CoT-ST: enhancing LLM-based speech...M. Sanwal, Layered chain-of-thought prompting for multi-agent LLM systems: a comprehensive approach to explainable...S. Yao et al.Tree of thoughts: deliberate problem solving with large language modelsAdv. Neural Inf. Process. Syst.(2023)M. Besta et al.Graph of thoughts: solving elaborate problems with large language modelsProceedings of the AAAI Conference on Artificial Intelligence(2024)T. Schick et al.Toolformer: language models can teach themselves to use toolsAdv. Neural Inf. Process. Syst.(2023)J.S. Park et al.Generative agents: interactive simulacra of human behaviorProceedings of the 36th Annual Acm Symposium on User Interface Software and Technology(2023)R.K. Sharma, V. Gupta, D. Grossman, SPML: a dsl for defending language models against prompt attacks, arXiv:...R. Huang et al.AudioGPT: understanding and generating speech, music, sound, and talking headProceedings of the AAAI Conference on Artificial Intelligence(2024)M. Jafaripour et al.Adaptive iterative feedback prompting for obstacle-aware path planning via llmsAAAI Workshop(2025)Z. Zhang et al.A survey on the memory mechanism of large language model-based agentsACM Trans. Inf. Syst.(2025)P. Lewis et al.Retrieval-augmented generation for knowledge-intensive nlp tasksAdv. Neural Inf. Process. Syst.(2020)J. Chen, S.L. Cong, Agentguard: repurposing agentic orchestrator for safety evaluation of tool orchestration, arXiv:...M. Renze, E. Guven, Self-reflection in LLM agents: effects on problem-solving performance, arXiv:...T. Rahmatullaev, P. Druzhinina, M. Mikhalchuk, A. Kuznetsov, A. Razzhigaev, Universal adversarial attack on aligned...Z. Dong, Z. Zhou, C. Yang, J. Shao, Y. Qiao, Attacks, defenses and evaluations for llm conversation safety: a survey,...J. Ji, D. Hong, B. Zhang, B. Chen, J. Dai, B. Zheng, T. Qiu, B. Li, Y. Yang, Pku-saferlhf: towards multi-level safety...A. Liu, Y. Zhou, X. Liu, T. Zhang, S. Liang, J. Wang, Y. Pu, T. Li, J. Zhang, W. Zhou, et al., Compromising embodied...K. Domico, J.-C. N. Ferrand, R. Sheatsley, E. Pauley, J. Hanna, P. McDaniel, Adversarial agents: black-box evasion...Q. Xu, Z. Tian, H. Wu, Z. Huang, Y. Song, F. Liu, D. Li, Learn to disguise: avoid refusal responses in LLMâs defense...A. Bilal, D. Ebert, B. Lin, Llms for explainable ai: a comprehensive survey, arXiv:...N. Carlini et al.Extracting training data from large language models30th USENIX Security Symposium (USENIX Security 21)(2021)Y. Bai, G. Pei, J. Gu, Y. Yang, X. Ma, Special characters attack: toward scalable training data extraction from large...M. Juuti et al.PRADA: Protecting against DNN model stealing attacks2019 IEEE European Symposium on Security and Privacy (EuroS&P)(2019)S. Kariyappa et al.Maze: data-free model stealing attack using zeroth-order gradient estimationProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition(2021)T. Green, M. Gubri, H. Puerto, S. Yun, S.J. Oh, Leaky thoughts: large reasoning models are not private thinkers, arXiv:...N. Mireshghallah, H. Kim, X. Zhou, Y. Tsvetkov, M. Sap, R. Shokri, Y. Choi, Can llms keep a secret? testing privacy...B. Wang, W. He, S. Zeng, Z. Xiang, Y. Xing, J. Tang, P. He, Unveiling privacy risks in llm agent memory, arXiv:...View more referencesCited by (0)View full textŠ 2025 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.