Large Language Model Agent: A Survey on Methodology, Applications and Challenges

Introduction

• LLM agents perceive environments, reason about goals, and execute actions, with commercial systems autonomously handling complex tasks that once required human expertise.The survey describes agents as adapting to user needs while engaging with their environments through learning, reasoning, and adaptation.Source: §1 · p. 1
• The survey traces a qualitative leap in LLM agents to advances in reasoning [6], tool use and interaction, and memory architectures [8], [9].It describes LLMs as general-purpose task processors that unify perception, decision-making, and action in semantic space.Source: §1 · p. 1
• The framework covers agent methodology, evaluation and tools, real-world issues, and applications, with construction, collaboration, and evolution as its methodological dimensions.The survey also considers security, ethics, and other practical challenges.Source: §1 · pp. 1–2, Figure 1 · p. 2
• Unlike surveys focused on specific applications, deployment environments, modalities, security, or broad overviews, this work offers a comprehensive methodological analysis of LLM agent architectures [11]–[20].It also examines frontier tools, communication protocols, and applications, alongside security, privacy, and ethics challenges.Source: §1 · p. 2
• The survey proposes a methodology-centered taxonomy of agent role definition, memory, planning, and action execution [21], linking construction, collaboration, and evolution [22], [23].This integrated perspective connects individual agent design with collaborative systems, which prior studies often examined separately [22], [24].Source: §1 · pp. 1–2

2.1 Agent Construction

• Construction establishes agent foundations through profile definition, memory mechanisms, planning capabilities, and action execution.The framework treats these as the foundational components of agent systems.Source: §2 · p. 2

2.2 Collaboration

• Collaboration covers centralized control, decentralized cooperation, and hybrid architectures for enabling multiple agents to work together.Source: §2 · pp. 2–3

2.3 Evolution

• Evolution mechanisms support improvement over time through autonomous optimization, multi-agent co-evolution, and external resource integration.Source: §2 · p. 3

2.1.1 Profile Definition

• Profiles establish agent identity and decision boundaries through human-curated static configurations or parameterized dynamic profiles that generate behavioral diversity.Static profiles support consistent, interpretable rule-following; dynamic profiles vary traits, knowledge, or values for social simulations, and DSPy can optimize profile initialization.Source: §2.1.1 · pp. 3–4

2.1.2 Memory Mechanism

• Memory combines transient task context, persistent reusable experience, and external knowledge retrieval to support agents across tasks and time.Short-term memory is constrained by context windows and may require compression; long-term memory includes skill libraries, experience repositories, and synthesized tools, while retrieval can use corpora, knowledge graphs, dialogue, or reasoning-integrated queries.Source: §2.1.2 · p. 4

2.1.3 Planning Capability

• Planning decomposes complex tasks into single-path chains or multi-path trees, with dynamic replanning, multiple reasoning chains, and backtracking addressing rigidity and accumulated errors.Tree search can incorporate environmental or human feedback, reinforcement learning, and methods such as Monte Carlo Tree Search.Source: §2.1.3 · pp. 4–5
• Feedback-driven iteration uses environmental, human, introspective, or collaborative input to evaluate performance and revise an agent’s plan, reasoning path, or goal.Iteration continues until a satisfactory plan is achieved,.Source: §2.1.3 · p. 5

2.1.4 Action Execution

• Action execution requires tool utilization and physical interaction, including deciding when tools are needed, selecting suitable tools, and acting in real-world environments.Physical execution requires agents to account for robotic hardware, social knowledge, and interactions with other LLM agents.Source: §2.1.4 · p. 5

2.2.1 Centralized Control

• Centralized systems use a controller to allocate tasks and integrate decisions, either through explicit coordination modules or prompts that assign sub-roles.Coscientist uses a human operator to coordinate experimental workflows, while LLM-Blender ranks and fuses responses and MetaGPT assigns specialized managers. AutoAct [75] and Meta-Prompting [76] illustrate prompt-based role differentiation; WJudge [77] shows that even controllers with limited discriminative power can improve agent systems.Source: §2.2.1 · p. 6

2.2.2 Decentralized Collaboration

• Decentralized collaboration avoids a single communication bottleneck through peer interactions, using either iterative revision of finalized decisions or dialogue that exposes peers’ reasoning.Revision examples include MedAgents [78], which uses sequential proposals and final voting, and ReConcile [79], which uses mutual analysis and confidence evaluation. Communication examples include MAD [80], which addresses degeneration of thought, and AutoGen, which supports iterative group debates; MDebate alternates commitment to valid points with collaborative refinement.Source: §2.2.2 · p. 6

2.2.3 Hybrid Architecture

• Hybrid architectures combine centralized coordination with decentralized collaboration through either predefined patterns or dynamically reconfigured topologies.Static examples include CAMEL, which combines decentralized intra-group teams with centralized inter-group governance, and AFlow, which uses three coordination tiers. Dynamic systems include DiscoGraph, DyLAN, and MDAgents, which adapt collaboration using distillation, agent-importance scoring, or task complexity, respectively.Source: §2.2.3 · pp. 6–7

2.3.1 Autonomous Optimization and Self-Learning

• Self-supervised learning and adaptive optimization let agents improve from unlabeled or internally generated data, adjust learning strategies, and generalize with less annotation or added resources.Examples include self-evolution learning, evolutionary optimization, and DiverseEvol [88].Source: §2.3.1 · p. 7
• Self-reflection, self-correction, and internally generated rewards support iterative error repair and decision refinement, reducing hallucinations and reliance on labeled data.SELF-REFINE, STaR, and V-STaR refine outputs or reasoning; self-rewarding and reinforcement learning approaches use internal reward signals to improve adaptability.Source: §2.3.1 · p. 7

2.3.2 Multi-Agent Co-Evolution

• Cooperative and adversarial co-evolution improve coordination, reasoning, robustness, and strategic adaptability through information sharing, role exchange, debate, and red-teaming.ProAgent, CORY, and CAMEL support cooperative adaptation; Red-team LLMs [98], multi-agent debate, and MAD use adversarial interaction to strengthen safety or reasoning.Source: §2.3.2 · pp. 7–8

2.3.3 Evolution via External Resources

• External knowledge and feedback from tools, evaluators, and environments guide planning and iterative behavior refinement, improving task execution, accuracy, adaptability, and robustness.KnowAgent [83] and WKM integrate structured knowledge; CRITIC, STE, and SelfEvolve [102] use tool, trial-and-error, or execution feedback.Source: §2.3.3 · p. 8

3.1 Evaluation Benchmarks and Datasets

• LLM-agent benchmarks address general capability assessment, domain-specific scenarios, and collaborative evaluation of complex systems.Together, these dimensions move assessment beyond isolated success rates toward cognitive capabilities, practical environments, and system-level coordination.Source: §3.1 · p. 8

3.1.1 General Assessment Frameworks

• General assessment frameworks increasingly measure multidimensional capabilities and adapt benchmarks to changing tasks and tool-use settings.Examples include AgentBench [124], Mind2Web, MMAU [126], BLADE [127], VisualAgentBench [128], Embodied Agent Interface, and CRAB; adaptive approaches include BENCHAGENTS [131], Benchmark self-evolving [132], TestAgent [133], Seal-Tools, and CToolEval.Source: §3.1.1 · pp. 8–9

3.1.2 Domain-Specific Evaluation System

• Domain-specific evaluation combines professional competency tests with realistic interactive environments, exposing gaps between general testing and practical applications.Benchmarks span healthcare, autonomous driving, data science, travel planning, machine-learning engineering, and security; simulated real-world settings include cross-platform computers, web and desktop automation, and long-term egocentric activities.Source: §3.1.2 · p. 9

3.1.3 Collaborative Evaluation of Complex Systems

• Collaborative evaluation shifts from individual agent proficiency to system-level coordination, using enterprise simulations, coding challenges, and competition-style tasks.TheAgentCompany [151], AutoGen and CrewAI, MLRB [154], and MLE-Bench [144] exemplify these evaluation approaches; the survey also systematizes over 200 multimodal benchmarks [153].Source: §3.1.3 · p. 9

3.2 Tools

• LLM agents use external tools to improve precision on tasks involving real-time information or accurate computation, and to extend their capabilities through APIs.The tools discussion groups external tools, agent-created tools, and deployment, maintenance, and data-acquisition infrastructure.Source: §3.2 · p. 9

3.2.1 Tools used by LLM agents

• External tools support knowledge retrieval, computation, and API interactions, extending agents with current information, executable computation, and service access.Examples include WebGPT and WebCPM for search, RLEF and CodeActAgent for code execution, and RestGPT for RESTful APIs.Source: §3.2.1 · pp. 9–10

3.2.2 Tools created by LLM agents

• Agent-created tools address limitations of human-oriented tools by turning task solutions into reusable tools and integrating their creation, planning, execution, and reflection.CRAFRT [166], Toolink, and CREATOR provide creation and use frameworks; LATM adds tool caching and assigns models by task difficulty to reduce cost while maintaining performance.Source: §3.2.2 · p. 10

3.2.3 Tools for deploying LLM agents

• Deployment tools support productionization, operation and maintenance, and standardized context links between agents and data sources.Examples include AutoGen, LangChain, LlamaIndex, and Dify for building applications; Ollama and Dify for monitoring; and MCP with MCP-Agent for context integration.Source: §3.2.3 · p. 10

4 REAL-WORLD ISSUES

• LLM-agent challenges span security, privacy, and social impact, with potential societal benefits and risks.The paper identifies memorization vulnerabilities and intellectual-property exploitation as privacy concerns and emphasizes that understanding these challenges is crucial for robust, trustworthy agents.Source: §4 · pp. 10–11

4.1 Agent-centric Security

• Agent-centric attacks target agent weights, architecture, and inference, risking degraded performance, manipulated outputs, and privacy leaks.Agent security bench evaluates attacks and defenses across 10 scenarios, 10 agents, 400+ tools, 23 methods, and 8 metrics, finding significant vulnerabilities and limited defense effectiveness.Source: §4.1 · p. 11

4.1.1 Adversarial Attacks and Defense

• Adversarial threats target agents’ Perception, Brain, and Action, while defenses include input purification and multi-agent debate [177] [182] [183].AgentDojo tests robustness on 97 realistic tasks and 629 security cases; attack methods include iterative prompt tuning against recommenders and self-propagating inputs across multi-agent systems. ARE [179] evaluates multimodal robustness.Source: §4.1.1 · p. 11

4.1.2 Jailbreaking Attacks and Defense

• Jailbreaking attacks use reinforcement learning, agent-guided mutation, and feedback to elicit restricted outputs, while defenses filter harmful responses or learn attack patterns [185] [187] [188] [189] [190].Attack approaches include black-box search with PPO and multi-agent reinforcement learning guided by target-model feedback [187]; defenses include specialized-role filtering [188] and rogue-agent detection [189].Source: §4.1.2 · p. 11

4.1.4 Model Collaboration Attacks and Defense

• Model-collaboration attacks disrupt multi-agent systems by exploiting contagion and recursion or manipulating inter-agent messages [196] [197].Defenses and safety approaches include topology analysis and anomaly detection [198] [199], planning-stage safeguards, and psychological and behavioral risk assessment [201].Source: §4.1.4 · pp. 11–12

4.2.1 External Data Attack and Defense

• User-input injections, are simple but achieve the highest ASR, while defenses structure inputs, monitor execution, or add guarding instructions.Defenses include Mantis’s hacking back against attackers [206], an Input Firewall that converts user input into structured JSON [207], RTBAS and TaskShield’s information-flow checks [208], [209], and ASB’s sandwich defense.Source: §4.2.1 · p. 12
• Dark-psychology prompts steer agents toward aggressive, antisocial behavior, while poisoned external knowledge and indirect prompt injections can divert agents from their intentions.“Evil Geniuses” generates prompts optimized through red-blue exercises [210], and doctor and police agents assess psychological safety [201]. External-source attacks include malicious instructions embedded in websites, literature, emails, or forums, public-page poisoning [214], and gradual Foot-in-the-Door requests [215]; AgentPoison achieves a high success rate in knowledge-intensive QA agents, while multi-agent debate can verify external knowledge [183].Source: §4.2.1 · p. 12

4.2.2 Interaction Attack and Defense

• Interaction attacks target user-agent interfaces, spread infections across agents, or manipulate planning to trigger harmful tool calls and resource depletion.Attacks include private-memory extraction [217], information solicitation, recursive infection that spreads exponentially fast [220], and malicious planning distractions [223] or planning-process injections [205]. Defenses include semantic reflection [197], infection tagging [221], BlockAgents’ blockchain and proof-of-thought consensus, and a trajectory firewall that corrects deviations [207].Source: §4.2.2 · pp. 12–13

4.3.1 LLM Memorization Vulnerabilities

• Queries can extract PII from GPT-2; extraction was also feasible against GPT-neo [226], with risk rising alongside model size, repeated data, and context length.Source: §4.3.1 · p. 13
• Membership inference tests whether samples appeared in training; fine-tuning the model head increases vulnerability [227], while probability-change attacks [228] and attribute-inference studies, expose related risks.Source: §4.3.1 · p. 13
• Mitigations include data cleaning, differential-privacy noise and knowledge distillation,, and ProPILE leakage assessment before deployment.Source: §4.3.1 · p. 13

4.3.2 LM Intellectual Property Exploitation

• Model theft can recover model information or decoding-algorithm properties through queries [235],, or extract specialized code; proposed defenses include watermarking and blockchain IP authentication.Source: §4.3.2 · p. 14
• Prompt-stealing methods include PromptStealer, parameter extraction [241], and PLEAK’s adversarial-query system-prompt extraction; adversarial samples can obstruct inference.Source: §4.3.2 · p. 14
• As LLMs evolve, robust privacy protections must mitigate memory and intellectual-property risks while preserving agents’ effective role in multi-agent systems.Source: §4.3.2 · p. 14

4.4.1 Benefits to Sociaty

• LLM agents automate labor-intensive work across healthcare, law, and education, while expanding workforce needs and enabling more accessible tutoring and information distribution [243]–.Governments are encouraged to support AI-focused training as job demands evolve.Source: §4.4.1 · p. 14

4.4.2 Ethical Concerns

• Training-data biases may be amplified into discriminatory outputs; proposed mitigations include sensitive-topic filtering, human feedback, and fairer training [243]–[245], [248]–.The survey identifies fairness, inclusivity, and ethical deployment as continuing research priorities.Source: §4.4.2 · p. 15
• Accountability is difficult because undocumented training data limits oversight, making rigorous dataset documentation and governance frameworks essential despite documentation costs, [245], [251]–.Harmful outputs may persist despite efforts to mitigate toxic content.Source: §4.4.2 · p. 15
• Unclear rules and opaque training sources create copyright risks for creators, including misuse of their work, content degradation, and potential reputational or legal harm,,.The passage warns that AI-generated material may increasingly displace human-produced work in some domains.Source: §4.4.2 · p. 15
• Other concerns include overreliance on systems lacking semantic understanding, possible misalignment with human intentions, and the environmental and computational costs of large models, [261]–.Privacy, data manipulation, and misinformation are discussed in Sections 4.1–4.3 [243],, [257]–.Source: §4.4.2 · p. 15

5.1.1 Agentic AI Across Scientific Disciplines

• Scientific agents emulate collaborative workflows: SciAgents generates and critiques hypotheses, Curie coordinates experimental planning and execution, and AgentReview simulates peer review.Curie’s structured approach improved experimental-result correctness over straightforward prompt-based automation in tests on questions derived from computer science papers; SciAgents uses an ontological knowledge graph.Source: §5.1.1 · pp. 15–16, §5.1 · p. 15

5.1.2 Agentic AI in Chemistry, Materials Science and Astronomy

• ChemCrow uses 18 chemistry tools to plan and execute syntheses, while AtomAgents delegates alloy-design tasks to specialist modules and an astronomy copilot manages telescope databases and generates analysis code.These systems illustrate tool use and task decomposition across chemistry, materials science, and astronomy; the astronomy work remains experimental.Source: §5.1.2 · p. 16

5.1.3 Agentic AI in Biology

• Biology agents propose experiments, discover gene associations, identify biomarkers, and answer questions by combining retrieval or self-verification with known biological knowledge.Examples include BioDiscoveryAgent for genetic perturbation design, GeneAgent’s self-refinement loop, RiGPS’s experiment-based self-verification, and BioRAG’s multi-tool retrieval and evaluation.Source: §5.1.3 · p. 16

5.1.4 Agentic AI in Scientific Dataset Construction

• Multi-agent systems construct and refresh scientific datasets by selecting pathology-image regions, refining captions, generating research questions, and updating gene-function descriptions.PathGen-1.6M, KALIN, and GeneSUM use agents with distinct roles, including iterative caption refinement, knowledge-hierarchy evaluation, and literature retrieval and summarization.Source: §5.1.4 · p. 16

5.1.5 Agentic AI in Medical

• On standard chest X-ray benchmarks, CXR-Agent and MedRAX achieved diagnostic accuracy on par with state-of-the-art standalone models, while uncertainty scores correlated with correctness.MedRAX combines tools for reading prior reports, highlighting image regions, and clinical reasoning; the multi-agent approach may improve reliability but requires rigorous validation.Source: §5.1.5 · pp. 16–17

5.2 Gaming

• Gaming applications span agents that play roles or learn in game environments and systems that generate interactive narratives or automate game development.Examples include ReAct and Voyager for game playing, CALYPSO for Dungeons & Dragons narrative assistance, and GameGPT for collaborative game development.Source: §5.2 · p. 17

5.3 Social Science

• Social-science applications use LLM agents to simulate financial activity, study psychological behavior, and model social influence, information diffusion, and collective decision-making.Examples include TradingGPT’s hierarchical memory and debate mechanisms, simulations of conformity and psychological experiments, and multi-agent social-network models.Source: §5.3 · p. 17

5.4 Productivity Tools

• Productivity applications coordinate software-development roles and model recommender-system users, items, and interactions, including zero-shot personalized recommendations.Examples include MetaGPT’s use of standardized human workflows, Agent4Rec’s user profiling and memory, and RecMind’s planned use of external knowledge and tools.Source: §5.4 · p. 18

6.1 Scalability and Coordination

• Hierarchical delegation, decentralized concurrent planning, robust communication, and efficient scheduling are proposed to reduce LLM multi-agent coordination bottlenecks [306], [307].Frameworks designed for lightweight agents lack system-level optimization for billion-scale LLM agents,,.Source: §6.1 · p. 18

6.2 Memory Constraints and Long-Term Adaptation.

• Limited effective context makes long-term interaction coherence difficult, motivating scalable relevance management, hierarchical episodic and semantic memory, and autonomous knowledge compression, [310]–.Current approaches include vector databases, memory caches, context-window management, and retrieval-augmented generation.Source: §6.2 · p. 18

6.3 Reliability and Scientific Rigor

• Prompt-sensitive outputs and incomplete or outdated knowledge can produce hallucinations and compound uncertainty, making validation and structured verification essential –.Proposed safeguards include knowledge-graph checks, retrieval-based cross-referencing, [318], direct citation generation, up-to-date knowledge sources, AI-human verification in high-stakes domains [315], and auditing mechanisms such as fact-checking logs; optimal intervention points remain an open challenge,.Source: §6.3 · p. 18

6.4 Multi-turn, Multi-agent Dynamic Evaluation

• Static, single-turn benchmarks miss emergent behavior, long-term adaptation, and collaborative reasoning, while evolving capabilities and possible data contamination complicate assessment [57], [310], –.Future evaluation should use dynamic multi-agent scenarios, structured performance metrics, and adaptive sample generation [324].Source: §6.4 · pp. 18–19

6.5 Regulatory Measures for Safe Deployment

• Safe deployment requires bias auditing, decision-path and confidence traceability, and legal and ethical safeguards developed with policymakers, researchers, and industry [248], [325], [326].Agents may discriminate based on gender, age, ethnicity, or other sensitive attributes in ways developers may not detect.Source: §6.5 · p. 19

6.6 Role-playing Scenarios

• Role-play fidelity is limited by training-data gaps, incomplete understanding of human cognition, and low dialogue diversity, motivating better coordination, real-world reasoning, and dialogue diversity, [326],,.LLM agents can simulate roles such as researchers, debaters, and instructors [307],.Source: §6.6 · p. 19

• The survey organizes LLM agent methodology across construction, collaboration, and evolution, linking individual agent design principles with multi-agent collaborative systems.The authors describe this unified architectural perspective as distinguishing their work from previous surveys.Source: §7 · p. 19
• Significant challenges remain in scalability, memory, reliability, and the adequacy of evaluation frameworks.Source: §7 · p. 19
• The survey anticipates progress in coordination protocols, hybrid architectures, self-supervised learning, and safety mechanisms to enhance agents across domains.It frames these directions as supporting responsible advancement of LLM agents and human-machine collaboration.Source: §7 · p. 19