Agentic Web: Weaving the Next Web with AI Agents

• LLM-powered agents extend beyond single-turn responses by perceiving, reasoning, remembering, planning, and acting over long horizons, while multiple agents can collaborate on sophisticated objectives.Growing user trust in delegating complete workflows drives the shift toward proactive collaborators and new interaction interfaces.Source: §1 · p. 4
• The Agentic Web is a distributed ecosystem in which autonomous agents act as intermediaries that persistently plan, communicate, coordinate, and execute goal-directed tasks across services for users.Agents enable continuous agent-to-agent interaction, dynamic information exchange, and value creation alongside traditional human-web interactions.Source: §1 · p. 4
• Unlike the traditional Web’s user-driven, step-by-step interactions, the Agentic Web supports sustained, machine-led workflows spanning multiple services, domains, and coordinated actions.Users delegate high-level goals, while agents negotiate, plan, adapt, interact with APIs and webpages, and complete tasks without further intervention.Source: §1 · pp. 4–6
• The paradigm transforms web resources into agent-accessible capabilities: webpages become interactive software agents, hyperlinks become coordination channels, and knowledge combines LLM parameters with real-time retrieval and agent-generated content.Agents can recommend content, retrieve information, execute transactions, and participate in production and consumption processes designed increasingly for agents.Source: §1 · pp. 5–6
• The article argues that web foundations such as protocols, semantics, indexing, search, recommendation, discovery, trust, and orchestration must be reinterpreted for agent autonomy and collaboration.Its sections cover the Agentic Web’s history and conceptual model, enabling techniques, infrastructure, applications, risks, security, regulation, mitigation, and future directions.Source: §1 · p. 7

2 Historical Evolution of the Web

• The Web’s three overlapping eras—PC, Mobile, and Agentic—reflect successive shifts in technology, business models, user behavior, and attention flow.Figure 3 presents the eras as a gradual, overlapping timeline rather than strictly distinct periods.Source: §2 · p. 8, Figure 3 · p. 9

2.1 PC Web Era

• The PC Web used static, hierarchically classified pages and manual browsing, while search engines advanced retrieval from keyword matching to authority- and semantics-aware ranking.PageRank evaluated hyperlink-based authority, substantially improving relevance over keyword-only methods.Source: §2.1 · p. 8, §2.1.1 · pp. 8–9

2.1.1 Static Pages and Search-based Commercial Marketing

• Search advertising commercialized PC Web retrieval by matching queries to paid results through auctions, with Quality Score balancing advertiser bids and relevance.Google AdWords used Generalized Second-Price auctions, while pay-per-click advertising linked search content to commercial marketing.Source: §2.1.1 · p. 9, §2.4 · p. 13

2.2 Mobile Web Era

• The Mobile Web emerged as user-generated content overwhelmed manual search, shifting behavior from intent-driven queries to discovery-oriented, personalized consumption in fragmented mobile sessions.Recommendation systems became central architectural components because mobile platforms imposed latency, screen-space, and attention constraints.Source: §2.2 · p. 9, Figure 4 · p. 10

2.2.1 Recommender Systems

• Mobile recommender systems evolved from collaborative filtering and latent-factor models toward deep, hybrid, sequential, attention-based, and graph-based architectures for real-time personalization.These developments addressed sparsity, scalability, nonlinear interactions, temporal behavior, and complex user-item relationships.Source: §2.2.1 · pp. 10–11

2.2.2 Attention Economy

• Recommendation systems reshaped the Mobile Web’s attention economy by using behavioral data to target content and advertising, increasing personalization, engagement, and marketing efficiency.Clicks, scrolls, and pauses became valuable signals for optimizing advertisement format, timing, and frequency.Source: §2.2.2 · p. 11

2.3 Agentic Web Era

• LLMs enabled the Agentic Web by combining natural-language understanding, reasoning, code generation, context retention, and tool or API use for autonomous multi-step task execution.Multi-agent systems decompose tasks among specialized agents and coordinate them through scheduling, information sharing, and orchestration frameworks such as LangChain and AutoGen.Source: §2.3 · p. 11, §2.3.1 · p. 12

2.3.2 Agent Attention Economy

• The Agent Attention Economy shifts competition from human clicks to agent invocation, motivating ranking, recommendation, advertising, referral, and bidding mechanisms for scarce agent attention.MCP and related protocols organize external tools and services for agent discovery, filtering, selection, composition, and orchestration.Source: §2.3.2 · p. 13, §2.4 · p. 15

3 The Agentic Web

• The Agentic Web shifts value from manual page navigation to delegated, outcome-oriented orchestration in which agents execute goals across services on users’ behalf.This evolution follows the PC and Mobile Web eras, where users still navigated apps, copied data, and made decisions themselves.Source: §3 · p. 15
• Its framework analyzes this transformation across Intelligence, Interaction, and Economy, redefining Web actors, task execution, and outputs from human activity and content consumption toward autonomous coordination and outcome generation.These dimensions organize how the Agentic Web reshapes capabilities, behaviors, and business models.Source: §3 · p. 15

3.1 Core Conditions

• Three interdependent conditions support scalable Agentic Web operations: autonomous intermediaries, standardized machine-readable interfaces, and direct value exchange between agents and systems.Agent autonomy depends on semantic interfaces, protocol interoperability, and dynamic discovery and orchestration of external capabilities.Source: §3.1 · p. 16

3.2.1 Evolving Interaction Patterns

• Agents replace request-response navigation with proactive discovery, semantic connections, continuous monitoring, adaptive negotiation, and collaboration across services (Tupe and Thube, 2025; Sapkota et al., 2025).They identify resources and capabilities through contextual relevance rather than static hyperlinks or predefined pathways.Source: §3.2.1 · p. 17

3.2.2 Changing Information Structures

• Information shifts from externally stored documents and search-driven access toward in-model knowledge, semantic discovery, and agent-driven retrieval and integration (Petrova et al., 2025; Lù et al., 2025; Touvron et al., 2023b; OpenAI, 2024a; Guo et al., 2025).The transition changes how information is stored, linked, and accessed: in-model rather than in-document, semantic rather than hyperlink-based, and agent-driven rather than search-driven.Source: §3.2.2 · p. 17
• Agents also generate tools, instructions, summaries, and structured artifacts for other agents, creating self-reinforcing information flows in which agents both produce and consume content (Qin et al., 2023; Schick et al., 2023).This extends information production beyond human-authored Web pages.Source: §3.2.2 · p. 17

3.2.3 Dual Operational Roles

• Agent systems combine an Agent-as-User role, autonomously navigating and consuming Web resources, with an Agent-as-Interface role that translates human intentions into multi-step workflows (Nakano et al., 2022; Deng et al., 2023; Zhou et al., 2023b; Gur et al., 2024; OpenAI, 2025; Monica, 2024; Corporation, 2025; Thurrott, 2024; Opera, 2025; Wiggers, 2025).Together, these complementary roles form a bidirectional bridge between human intention and execution for persistent, goal-directed planning, coordination, and task completion.Source: §3.2.3 · pp. 17–18

3.3 Three Conceptual Dimensions of the Agentic Web

• The framework defines intelligence, interaction, and economy as interrelated dimensions, with intelligence enabling interaction and interaction enabling value creation.This layered model explains how agents develop from reasoning entities into economic participants.Source: §3.3 · p. 18

3.3.1 Intelligence Dimension

• Agents require transferable intelligence for contextual understanding, long-horizon planning, adaptive learning, self-monitoring, and multimodal decision-making across open-ended environments.They use internalized knowledge and external tools or APIs to act proactively rather than merely retrieve information.Source: §3.3.1 · pp. 18–19

3.3.2 Interaction Dimension

• The Interaction Dimension provides an operational substrate through semantic interoperability, runtime discovery, safe tool orchestration, and agent-to-agent collaboration.These mechanisms support dynamic capability discovery, preserved context, privacy-aware exchange, authenticated execution, and cooperative pursuit of complex goals.Source: §3.3.2 · p. 19

3.3.3 Economic Dimension

• Autonomous economic decision-making creates urgent governance needs around liability, transparency, ethical alignment, accountability, and fairness as agents handle finances, contracts, and digital assets.Regulatory frameworks must accommodate autonomous behavior operating at machine timescales.Source: §3.3.3 · p. 20
• The Economic Dimension enables agents to create, exchange, and allocate value through machine-oriented artifacts, autonomous transactions, and decentralized networks that optimize outcomes algorithmically.These systems can operate continuously at speeds and granularities beyond human coordination.Source: §3.3.3 · pp. 19–20

4 Algorithmic Transitions for the Agentic Web

• Three foundational transitions define the Agentic Web: proactive information acquisition, goal-oriented planning, and multi-agent coordination, enabling adaptive systems that operate independently amid uncertainty and complexity.These shifts collectively support continuous learning, emergent behavior, human-AI collaboration, and automated decision-making.Source: §4 · p. 21

4.1 User-centric Retrieval to Agentic Information Retrieval

• Agents replace passive keyword search with context-aware, multi-step retrieval that selects needed information, modalities, tools, and APIs according to goals and task progression (Zhang et al., 2024a).RAG, iterative and self-reflective retrieval, adaptive retrieval policies, query clarification, and autonomous API use ground reasoning in external evidence (Lewis et al., 2020; Jiang et al., 2023; Asai et al., 2024; Zhang et al., 2024c; Kim et al., 2023; Schick et al., 2023).Source: §4.1 · p. 22

4.2 Recommendation to Agent Planning

• Recommendation becomes proactive, goal-oriented planning in which agents combine reasoning, executable actions, environmental feedback, memory, and hierarchical execution to complete complex web tasks.ReAct (Yao et al., 2023), WebAgent (Gur et al., 2024), AdaPlanner (Sun et al., 2023), and Plan-and-Act (Erdogan et al., 2025) exemplify this transition, evaluated by benchmarks including WebArena (Zhou et al., 2023b) and VisualWebArena (Koh et al., 2024).Source: §4.2 · pp. 22–23

4.3 Single-Agent to Multi-Agent Coordination

• Multi-agent frameworks overcome single-agent limits by enabling task decomposition, role specialization, communication, shared goals, modularity, and distributed execution across complex objectives.Systems including AutoGen (Wu et al., 2023), WebPilot (Zhang et al., 2025d), the AI Co-Scientist (Gottweis et al., 2025), OWL (Hu et al., 2025), and Octotools (Lu et al., 2025) implement collaborative or specialized coordination.Source: §4.3 · pp. 23–24

• Traditional web infrastructure is poorly suited to autonomous agents because it relies on stateless protocols, user-initiated interfaces, and static interaction models.Source: §5 · p. 24
• Agentic execution requires continuous contextual awareness, persistent sessions, dynamic service discovery, semantically rich protocols, and real-time coordination with users and other agents.Source: §5 · p. 24
• The section proposes system transformations and evolving communication standards to support persistent, context-aware agents and semantic agent-to-agent interaction at web scale.Its architectural perspective aims to operationalize the Agentic Web beyond isolated prototypes or platform-specific implementations.Source: §5 · p. 24

5.1 Motivation for an Agentic Web System

• Dynamic agent discovery must identify collaborators by assessing their skills, readiness, and task-specific suitability for just-in-time multi-agent coordination.This mechanism is needed because autonomous agents are ephemeral and lack fixed network locations (Cui et al., 2025), while on-demand matchmaking supports complex collaboration (Chen et al., 2024b; Raskar et al., 2025).Source: §5.1 · p. 24
• Agent-oriented APIs must add machine-readable semantics, such as ontologies or logical specifications, so agents can autonomously discover, interpret, and use services.Current APIs provide syntactic but not semantic interoperability, preventing agents from unambiguously understanding methods and intent (Tupe and Thube, 2025).Source: §5.1 · pp. 24–25
• Distributed accounting must trace resource consumption across multi-agent interactions and securely attribute service costs to the originating user or principal agent.Reliable micropayments and auditable billing are necessary because agents can delegate subtasks and consume paid services across fluid, multi-party networks (Cui et al., 2025).Source: §5.1 · p. 25
• Infrastructure must replace best-effort, network-centric optimization with task-level service guarantees tailored across cost, delay, security, data rate, and knowledge requirements.A Service Requirement Zone defines an eight-dimensional task profile; deep research needs high knowledge, reliability, stability, and low delay, whereas ticket purchasing prioritizes security and data rate and tolerates longer delays (Yang et al., 2023b).Source: §5.1 · pp. 25–26
• Supporting this model requires real-time negotiation, multimodal handling, capability-driven orchestration, granular security and privacy, observability, and intelligent cost control.The infrastructure must dynamically allocate heterogeneous network, compute, and data resources as agent needs change, while maintaining inventories of models and data sources and enforcing controls at agent and sub-task granularity (Huang et al., 2024; Zhang et al., 2025c; Li et al., 2025a).Source: §5.1 · p. 26

5.2 Toward a Next-Generation Agentic Web System

• The proposed Agentic Web system replaces content-centric interaction with execution-oriented infrastructure that integrates persistent context, tool orchestration, and three components: User Client, Intelligent Agent, and Backend Services.Together, these components operationalize agentic capabilities by translating high-level user intent into executable digital actions.Source: §5.2 · p. 26, §5.2.1 · p. 26

5.2.1 Roadmap of the Agentic Web System

• The roadmap assigns the User Client human interaction, the Intelligent Agent intent decomposition and tool selection, and Backend Services modular computational and domain-specific capabilities.Agents orchestrate callable APIs, databases, web applications, microservices, and plugins, while direct client-service interactions can improve security and efficiency for sensitive or high-throughput transactions.Source: §5.2.1 · pp. 26–28
• The Client-Agent-Server architecture uses demand skill mapping, real-time task routing, and a cross-agent billing ledger to coordinate distributed, autonomous, and value-aware services.The ledger supports resource metering, service chaining, and privacy-preserving settlement across agents.Source: §5.2.1 · p. 28

5.2.2 Interaction Process Example: Collaborative Mechanisms in Travel Itinerary Planning by Agents

• A travel-planning workflow parses a user request, decomposes it into weather, attractions, accommodation, and routing tasks, then combines synthesized results with direct map feedback for interactive updates.This dual pathway balances comprehensive itinerary integration with low-latency responses through MCP-mediated backend services.Source: §5.2.2 · pp. 28–29

5.2.3 Recent Advances and Applications of Agentic Web Systems

• Recent advances improve agentic systems by combining reasoning with action, separating planning from execution, and strengthening evaluation through ReAct (Yao et al., 2023), PLAN-AND-ACT (Erdogan et al., 2025), Online-Mind2Web, and WebJudge.ReAct uses external resources to support fact-checking; PLAN-AND-ACT dynamically replans; Online-Mind2Web covers 300 tasks across 136 websites; and WebJudge reaches up to 85.7% agreement with human judgment.Source: §5.2.3 · p. 29

5.3 Agentic Communication

• Agentic communication extends beyond traditional protocols by requiring semantic interoperability, persistent task states, and asynchronous multi-party interaction, motivating agent-native protocols such as MCP and A2A.The section examines protocol foundations and presents MCP and A2A as representative structured, scalable, and semantically rich approaches.Source: §5.3 · pp. 29–30

5.3.1 Design Motivation (Beyond HTTP/RPC)

• HTTP/RPC are inadequate for Agentic Web workflows because they lack semantic context management, machine-readable interface meaning, and native support for persistent asynchronous control.Agentic tasks require shared history, intent, authorizations, preconditions, structured field semantics, event-driven interaction, task suspension, and user confirmation across long-running multi-party processes.Source: §5.3.1 · pp. 30–31

5.3.2 Details of MCP

• MCP uses capability-negotiated client–server sessions to standardize agent requests to tools, data, and services, reducing invocation fragmentation and improving semantic accuracy and reliability.Hosts interact with MCP clients, which connect to servers and resources through negotiated capabilities, request-response cycles, and resource-update notifications.Source: §5.3.2 · p. 33

5.3.3 Details of A2A

• A2A supports cross-agent collaboration through capability discovery, tightly coupled task–message context tracking, asynchronous updates, and long-duration multi-stage execution.Agent Cards expose capabilities, while context and task identifiers support traceable coordination across multi-turn, cross-task, and cross-agent workflows.Source: §5.3.1 · p. 31, §5.3.3 · p. 34

5.4.1 The Disruption of Traditional Browsers by Agents

• Agent browsers replace manual navigation with natural-language delegation, autonomously translating high-level objectives into sequences of actions.This shifts users from hands-on operators to strategic delegators.Source: §5.4.1 · p. 35
• The agent-browser paradigm raises open design questions about predictable interfaces, black-box reasoning, human intervention, collaboration, and accurate user mental models.The central challenge is enabling meaningful oversight and safe delegation without undermining agent autonomy or trust.Source: §5.4.1 · p. 35

5.4.2 The Billing Challenge for Advanced Agent Services

• Advanced agent tasks create variable, potentially substantial costs through LLM tokens, third-party API calls, and prolonged high-performance computing use.Examples include investigative reports, complex image generation, and multi-step financial analyses.Source: §5.4.2 · p. 35
• A viable billing framework must transparently attribute multi-agent resource consumption, estimate costs before execution, and balance user equity with provider sustainability.Open choices include resource-based, outcome-based, or hybrid pricing, while avoiding bill shock and supporting ecosystem accessibility.Source: §5.4.2 · p. 35

6.1.1 Transactional: Enabling Autonomous Execution of Web-Based Services

• Transactional agents execute goal-oriented tasks such as purchasing, booking, scheduling, and negotiating through web services, APIs, and transactional interfaces.Semantic APIs, standardized execution protocols, and persistent authorization tokens let agents coordinate multi-step workflows across service endpoints, such as combined travel bookings.Source: §6.1 · p. 36, §6.1.1 · p. 36

6.1.2 Informational: Structuring Autonomous Knowledge Discovery and Analysis

• Informational agents retrieve, synthesize, and contextualize dynamic sources, supporting longitudinal research through semantic interoperability, persistent monitoring, citation graphs, and long-horizon memory.Deepresearch Agents (Huang et al., 2025b) track papers, compare methods, extract citations, identify research gaps, and collaborate across platforms.Source: §6.1 · p. 36, §6.1.2 · p. 37

6.1.3 Communicational: Orchestrating Inter-Agent Collaboration and Negotiation

• Communicational agents coordinate, delegate, negotiate, and cocreate across organizational boundaries using shared protocols, structured dialogue states, and persistent coordination.Applications include multi-university research, creative-agent coalitions, and real-time supply-chain adaptation among supplier, logistics, and procurement agents.Source: §6.1 · p. 36, §6.1.3 · pp. 37–38

6.2 Current Applications of the Agentic Web

• Agent-as-Interface systems augment users through context-aware assistance, while Agent-as-User systems autonomously navigate interfaces and complete workflows as proxy users.The section identifies a trajectory toward hybrid implementations that dynamically combine both interaction models.Source: §6.2 · p. 38, §6.2.2 · pp. 39, 41

6.2.1 Agent-as-Interface: Agents as Intelligent Web Intermediaries

• Agent-as-Interface applications provide context-aware assistance without fully automating decisions, ranging from Opera Neon’s task modes and Comet’s research features to NLWeb’s schema- and MCP-based agent-accessible endpoints.NLWeb reduces reliance on brittle scraping by exposing semantic website interfaces (Microsoft Corporate Blogs, 2025).Source: §6.2.1 · pp. 38–39

6.2.2 Agent-as-User: Autonomous Agents Operating as Proxies

• Agent-as-User systems combine reasoning, code execution, browser automation, GUI manipulation, and tool use for autonomous multi-step workflows, while API interactions offer predictability and GUI automation offers universal interface compatibility.The emerging hybrid architecture selects APIs for structured interactions and GUI automation for legacy or non-API-enabled systems.Source: §6.2.2 · pp. 39–41
• 14.9% success on screenshot-only OSWorld tasks and 22.0% with reasoning steps: Anthropic Computer Use outperforms previous vision-action baselines.Computer Use uses vision-based perception and GUI manipulation to control arbitrary desktop and web interfaces without backend APIs (Anthropic, 2024).Source: §6.2.2 · p. 39

6.2.3 Agent-with-Physics: Autonomous Robots Powered by AI Agents

• Agent-with-Physics systems extend agentic intelligence into embodied robots and devices that perceive, reason, and act under safety, latency, uncertainty, and physical-affordance constraints.Vision-language-action models, hierarchical policies, and real-world environments improve generalization, while RT-1, RT-2, RT-X, PaLM-E, and Mobile ALOHA demonstrate language-guided physical control (Kim et al., 2024; Geng et al., 2025).Source: §6.2.3 · p. 41

Safety and Security Ecosystem

• The safety ecosystem integrates LLMs, agent frameworks, and safety infrastructures across laptops, desktops, servers, and mobile phones.Figure 13 depicts these components as the core of an interconnected Agentic Web security architecture.Source: §7 · p. 41, Figure 13 · p. 42
• Agents interact with cloud services, third-party tools, and one another to retrieve information, execute commands, and collaborate across sensitive environments.This distributed architecture requires consistent cross-platform security protocols and emphasizes privacy, trust, and robustness.Source: §7 · p. 42

Section Organization

• The section organizes safety analysis around real-world threats, red teaming, defense strategies, and evaluation techniques.These stages cover identifying vulnerabilities before deployment, improving reliability and trustworthiness, and measuring safety and security mechanisms.Source: §7 · p. 42

7.1 Safety and Security Threats

• Autonomous agents operating across the open internet introduce novel risks through real transactions and persistent states, marking a shift from controlled systems to autonomous web operations.Table 4 captures this fundamental risk evolution.Source: §7.1 · p. 42, Table 4 · p. 43

7.1.1 Threat Analysis Across Agentic Web Layers

• Threats are organized across intelligence, interaction, and value layers, covering cognitive attacks, protocol and communication attacks, and autonomous transaction and economic risks.Tables 5–7 distinguish these primary attack surfaces, while the categorization avoids redundancy when effects cross layers.Source: §7.1.1 · pp. 42–43, Table 5 · p. 43, Table 6 · p. 44
• Threats cascade vertically from cognition to protocols to economics, horizontally between agents, and temporally through persistent memory, turning local attacks into system-wide failures.For example, goal drift can enable protocol exploitation and unauthorized purchases, while learned behaviors and contaminated training data can preserve corruption across agent generations.Source: §7.1.1 · p. 43

7.1.2 Security Implications and Future Directions

• Agentic Web security requires zero-trust architectures, adaptive defenses, and cascade prevention rather than perimeter security, static rules, and incident isolation.Internet-scale deployments must adapt enterprise patterns such as MCP because traditional models assume bounded, stateless operations.Source: §7.1.2 · p. 44
• Quantitative models for cascade probability and impact, safeguards for continuously learning systems, and cross-jurisdictional governance remain underdeveloped, motivating adaptive security architectures.The paper proposes controlled adversarial exposure as a possible way for systems to strengthen over time, while noting that implementation remains a significant research challenge.Source: §7.1.2 · p. 44

7.2 Safety and Security Red Teaming

• Agentic web deployment risks hallucinated or misleading content and permission escalation, potentially causing unauthorized data exposure, privacy violations, and system vulnerabilities.These failures arise when agents misunderstand user intent, contextual ambiguity, access boundaries, or security constraints while handling sensitive data across web pages.Source: §7.2 · p. 45

7.2.2 Automatic Red Teaming

• Automated red teaming uses LLMs and adversarial agents to generate scenarios, expose information leakage and hidden vulnerabilities, and scale adaptive security evaluation before deployment.RL-based adversarial generation outperforms strong baselines for exposing information leakage, while seed-instruction search with Monte Carlo Tree Search surpasses human-crafted prompts on AgentDojo and VWAadv benchmarks.Source: §7.2 · p. 45, §7.2.2 · p. 46
• Automated red teaming also includes backdoor-triggered, poisoning, and multi-agent approaches that probe privacy leakage, instruction vulnerabilities, detection robustness, and inter-agent communication protocols.Examples include AgentPoison, agent-based backdoor attacks for web shopping, malicious instruction tokens, adversarial word substitutions, and frameworks such as AutoDan and AutoDan-Turbo.Source: §7.2.2 · pp. 46–47

7.2.1 Human-Involved Red Teaming

• Human red teaming provides domain expertise and reliable task-specific evaluation, but its cost, limited diversity, and poor scalability make it difficult for dynamic, multi-platform agentic systems.Manual rules, safety-violation labeling, and vulnerability identification cannot sustain real-time adaptive evaluation for autonomous agents operating across services such as ticketing and financial platforms.Source: §7.2.1 · p. 46, §7.2.3 · p. 47

7.2.3 Emerging Directions in Red Teaming for Agentic Web

• Future systems should combine human judgment with automated red teaming through safe RL, constraining actions to safe regions while balancing safety, performance, and coverage.Hybrid frameworks must address automation’s limitations in complex reasoning, contextual understanding, and ethical judgment, while defending red-team frameworks against attacks, emergent misalignment, unauthorized goal generalization, and evaluation-data leakage.Source: §7.2.3 · pp. 47–48

7.3.1 Inference-time Guardrails

• Guardrails have evolved from transparent but inflexible rule-based filters to adaptable model-based classifiers, with lifelong systems accumulating unsafe trajectories, safety policies, and runtime checks.AGrail (Luo et al., 2025), LlamaFirewall (Chennabasappa et al., 2025), and GuardAgent (Xiang et al., 2025) address continual adaptation, environmental threats, and policy enforcement across agent applications.Source: §7.3.1 · pp. 48–50
• Reasoning guardrails enable structured oversight of agents’ goals, plans, and justifications, while agentic guardrails constrain interactions with external systems and environments.ThinkGuard (Wen et al., 2025) and GuardReasoner (Liu et al., 2025d) advance deliberative safety assessment beyond static threat labels; agentic guardrails govern what agents do rather than what they think.Source: §7.3.1 · p. 49

7.3.2 Controllable Generation and Planning

• Safe decoding and planning steer agents toward harmless outputs and executable decisions, while Thought-Aligner corrects high-risk reasoning steps before action execution.SafeDecoding (Xu et al., 2024c) reshapes token distributions toward safe tokens, and SafePlanner (Li et al., 2025b) uses simulator-trained safety prediction for robot planning.Source: §7.3.2 · p. 50
• Access-control defenses enforce least-privilege tool use and credential-aware knowledge access, enabling policies and internal knowledge usage to vary with task, identity, intent, or role.Progent (Shi et al., 2025) specifies fine-grained tool constraints and fallback behaviors, while SudoLM (Liu et al., 2025b) separates public and privileged knowledge through authorization alignment.Source: §7.3.2 · pp. 50–51

7.3.3 Emerging Directions in Defense for Agentic Web

• Agent defense remains preliminary because reasoning increases inference overhead, open environments undermine generalization, and safe action requires verification grounded in actual web state and constraints.Emerging directions include compressing reasoning for real-time guardrails, robustness to changing websites and tools, and runtime verification grounded in DOM structures, user intent, and API schemas.Source: §7.3.3 · p. 51

• Agentic web safety evaluation remains largely underexplored compared with traditional web, LLM, multimodal, and robot-learning safety evaluation.Only a few preliminary efforts have been proposed to date.Source: §7.4 · p. 51
• SafeArena (Tur et al., 2025) tests LLM web-agent compliance with malicious requests across 250 safe and 250 harmful tasks spanning misinformation, cybercrime, and social bias.The benchmark evaluates models including ChatGPT (Ouyang et al., 2022; Achiam et al., 2023) and Qwen (Bai et al., 2023).Source: §7.4 · p. 51
• ST-WebAgentBench (Levy et al., 2024) evaluates enterprise-style autonomous web-agent safety across six policy dimensions using policy-compliant completion and risk ratio.Its dimensions include user consent, preference satisfaction, scope boundaries, strict execution, distribution-shift robustness, and error recovery.Source: §7.4 · pp. 51–52
• Safe-OS evaluates adversarial safety for LLM-powered operating-system agents through prompt injection, environment sabotage, and system-level exploitation in Docker-based environments.It complements evaluations on Mind2Web-SC, EICU-AC (Xiang et al. (2024)), AdvWeb (Xu et al., 2024a), and EIA (Liao et al., 2025).Source: §7.4 · p. 52
• Further work is needed on multimodal agentic-web safety and reasoning safety for agentic-web agents.These gaps remain despite insights from SafeArena (Tur et al., 2025) and ST-WebAgentBench (Levy et al., 2024).Source: §7.4 · p. 52

8 Challenges and Open Problems

• The Agentic Web requires holistic solutions spanning cognition, coordination, alignment, security, and socio-economic structures because challenges in one domain can create or exacerbate problems elsewhere.Building the Agentic Web entails architecting a reliable, trustworthy computational layer, including standardized communication protocols, secure tool use, autonomous-payment trust, and viable business models.Source: §8 · p. 52

8.1 Foundational Challenges in Single-Agent Cognition and Autonomy

• Single-agent foundations remain fragile because reasoning and planning are brittle, finite context constrains memory, and tool use creates security vulnerabilities requiring zero-trust validation.Secure agents need a policy engine that scrutinizes information crossing the internal-external boundary without crippling decisive action based on tool outputs.Source: §8.1 · pp. 53–54

8.2 The Learning Conundrum: From Static Models to Dynamic Learners

• Dynamic lifelong learning is bottlenecked by reward design, catastrophic forgetting, and the specialization–generalization trade-off involved in grounding knowledge through interaction.Reinforcement learning can extend static models toward sequential decision-making, but continual adaptation must preserve prior capabilities while learning from new environments.Source: §8.2 · p. 54

8.3 The Ecosystem Challenge: Coordination and Trust in Multi-Agent Systems

• Multi-agent ecosystems require effective orchestration, open communication standards, and decentralized trust mechanisms so independently developed agents can collaborate rather than form proprietary walled gardens.Protocols must standardize message syntax and semantics while remaining expressive, simple, and open enough for widespread adoption; agents also need ways to assess peer reliability and competence.Source: §8.3 · p. 55

8.4 The Human-Agent Interface: Ensuring Goal Alignment and Control

• Human-agent alignment is difficult because requests are ambiguous, preferences are evolving and context-dependent, and high-stakes actions require effective human oversight.Agents may need active clarification and iterative preference elicitation, while human-in-the-loop architectures preserve safety, accountability, and control.Source: §8.4 · pp. 55–56

8.5 Systemic Risks: Ensuring Safety, Security, and Robustness

• As agents take real-world actions, systemic risks demand scalable safety, robust security, long-horizon error recovery, and regulated autonomous payments.Closed-loop systems can self-correct from action feedback, but current evaluation still has gaps in multimodal and reasoning safety, while autonomous spending remains technically, regulatorily, and socially high-risk.Source: §8.5 · p. 56

8.6 Socio-Economic Implications

• The Agentic Web could transform business models and labor markets, but advertising-based monetization is poorly suited to agent-mediated interaction and adoption may worsen inequality.Potential alternatives include transactional, subscription, value-based, intelligence-as-a-service, and blockchain-enabled autonomous exchange models, alongside risks of substantial job disruption.Source: §8.6 · pp. 56–57

Conclusion

• The Agentic Web shifts the internet from passive information access to autonomous, goal-directed action, distinguishing agentic AI’s proactive execution from generative AI’s prompt-based responses.Agentic systems perceive their environment, reason through complex problems, and independently execute tasks to achieve specified goals.Source: §9 · p. 57