PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey on Agentic Security: Applications, Threats and Defenses

Asif Shahriar, Md Nafiu Rahman, Sadif Ahmed, Farig Sadeque, Md Rizwan Parvez

arXiv:2510.06445v3cs.CLcs.AIcs.CR

TL;DR

Autonomous LLM agents expand cybersecurity capabilities but also enlarge attack surfaces, and base-model safety alignment does not reliably transfer to tool-using agents. This survey organizes applications, threats, and defenses and finds that many agent-specific attack surfaces remain understudied.

  • Problem

    Giving LLMs tools and autonomy enlarges their attack surface, while base-model safety alignment does not reliably transfer to agentic systems.

    Source: §1 · p. 2

  • Method

    The survey organizes agentic security research into Applications, Threats, and Defenses and analyzes how agents are used, attacked, and protected.

    Source: §1 · p. 2

  • Results

    Offensive applications cluster in feedback-rich stages and are largely dual-use; most attacks are inherited or amplified, succeed black-box, and target perception and action selection.

    Source: §1 · p. 2, §7 · p. 38

  • Takeaways & Limitations

    Agent-specific surfaces including memory, reflection, and inter-agent communication remain among the least attacked and least benchmarked.

    Source: §7 · p. 38

    Many reviewed benchmarks use synthetic or simplified setups, making agents’ real-world performance difficult to judge.

    Source: §7 · p. 38

Abstract

from arXiv · show

LLM-based agents are now used throughout cybersecurity. While these agents facilitate powerful and autonomous security applications, their autonomy opens up new attack surfaces, and the security community is actively building defenses to secure them. Yet the literature on this subject has grown quickly and unevenly. Existing surveys treat applications, threats, and defenses in isolation, leaving no unified account of how an agent's capabilities, vulnerabilities, and countermeasures interconnect. In this work we present the first holistic survey of the agentic security landscape, structuring the field around the fundamental pillars of Applications, Threats and Defenses. We provide a comprehensive taxonomy of over 260 papers, explaining how agents are used in downstream cybersecurity applications, inherent threats to agentic systems, and countermeasures designed to protect them. In addition, we provide detailed pillar-specific and cross-cutting analyses that show the security-lifecycle coverage of agentic applications, comparison between red-teaming and blue-teaming agents, and the adversarial use of red-teaming applications. On the threat side, we analyze the entry points and agent-loop stages that attacks target, their specificity to the agentic setting, and the threat models they assume. On the defense side, we analyze the prevailing defense strategies, their cost and security trade-offs, and where in the agent lifecycle they are deployed. We further map which defenses cover which attack classes and chart trends in agent architecture, backbone model usage, data modality coverage, and the growth of attack and defense research over time. Taken together, these findings indicate that agentic systems are structurally fragile by default and that securing them will require defenses that span the full agent lifecycle rather than single-layer fixes.

1 Introduction

Agentic security research spans applications, threats, and defenses, but prior surveys have not unified how these pillars interconnect. This survey examines their connections and identifies fragilities, coverage gaps, and trends across the field.

1 Introduction

  • Existing surveys address selected areas, leaving no unified account of how agent capabilities, vulnerabilities, and defenses interconnect.This gap complicates understanding which threats existing defenses cover and how offensive applications may also be used to attack agents.Source: §1 · p. 2
  • Security applications cluster in feedback-rich stages, offensive agents are more autonomous than defensive agents, and red-teaming capabilities can be used adversarially.The survey reports that red-team offensive power comes from the agentic scaffold, since the base model often refuses the same task when prompted directly.Source: §1 · p. 2
  • Most attacks are inherited or amplified from base LLMs, succeed black-box, and target perception and action selection more than reflection.Benchmarks are fragmented, with inter-agent communication and reflection output receiving limited study and few comparable metrics beyond attack success rate.Source: §1 · p. 2
  • No single defense strategy is robust across scalability, adversarial robustness, overhead, and coverage, while stronger protection costs latency and tokens.Defense placement is shifting toward post-computation monitoring and lifecycle-wide protection.Source: §1 · pp. 2–3
  • Defensive efforts concentrate on injection and manipulation, while prompt infection and pre-execution attacks remain less covered; research also skews toward text and code.The survey notes a shift toward multi-agent and planner-executor designs, with GPT remaining a near-universal backbone.Source: §1 · p. 3
  • The survey organizes over 260 papers into Applications, Threats, and Defenses, then analyzes each pillar and their cross-cutting relationships.Its analyses cover application lifecycles and dual use, threat entry points and models, defense strategies and placement, and trends across attacks, architectures, backbones, modalities, and benchmarks.Source: §1 · pp. 2–3

2 Applications of Agents in Security

The applications survey covers offensive security agents, from penetration testing through vulnerability discovery and exploit generation. It describes systems that use planning, specialized components, persistent state, and feedback to carry out multi-stage tasks.

2.1.1 Autonomous Penetration Testing

  • Penetration-testing agents span end-to-end and stage-specific tasks, using task trees, retrieval, and modular planning to support execution across environments.Examples include PentestGPT, PentestAgent, VulnBot, ARACNE, and systems for initial access or privilege escalation.Source: §2.1.1 · pp. 3–5

2.1.2 Vulnerability Discovery & Fuzzing

  • Vulnerability-discovery systems combine program analysis, symbolic execution, fuzzing, taint analysis, and generated inputs to expose bugs and unsafe workflows.Examples include Locus, ChatAFL, FirmAgent, and ChainFuzzer; benchmarks also evaluate exploit reproduction, patching, and secure code tasks.Source: §2.1.2 · pp. 5–6

2.1.3 Exploit Generation & Adaptation

  • Exploit-generation work includes multi-agent pipelines, verifiable exploit reconstruction, interactive feedback, and specialized agents for difficult path constraints.CVE Genie reports reproducing 428 CVEs; studies also describe malware generation for controlled testing and attacks that manipulate inter-agent messages.Source: §2.1.3 · p. 6
  • Offensive agents commonly combine reconnaissance, attack planning, specialized discovery or exploit components, execution, and outcome validation.Many maintain persistent state through memory, retrieval-augmented generation, exploit databases, or task graphs to support long-horizon reasoning and refinement.Source: §2.1.3 · p. 6, Figure 2 · p. 7

2.1 Offensive Security Agents (Red-Teaming)

  • Across offensive applications, architectures are moving from monolithic agents toward planner-executor and multi-agent designs coordinated through shared memory and task graphs.The surveyed examples include PentestAgent, VulnBot, ARACNE, HPTSA, and CAI.Source: §2.1.3 · p. 7

2.2 Defensive Security Agents (Blue-Teaming)

Defensive agents support monitoring, detection, threat hunting, forensics, and remediation. Their workflows combine telemetry and evidence processing with triage, investigation, and human approval for high-impact responses.

2.2.1 Autonomous Threat Detection & Incident Response

  • SOC agents process alerts and threat intelligence, detect malicious activity, triage incidents, and support response with auditable or explainable analysis.CORTEX uses separate agents for behavior analysis, evidence collection, and reasoning, and reduces false alerts more than single-agent baselines.Source: §2.2.1 · p. 7

2.2.2 Intelligent Threat Hunting

  • Threat-hunting systems turn reports into detection rules or combine threat knowledge with provenance graphs, while open-ended hunting remains challenging.Studies report contradictions, scope drift, and generalization gaps in assisted workflows; current frontier models fail badly at finding malicious timestamps in raw Windows logs without hints.Source: §2.2.2 · p. 8

2.2.3 Automated Forensics & Root Cause Analysis

  • Forensics agents use memory, multi-agent processing, and mixed evidence to identify incident causes and produce reports or narratives.CyberSleuth processes packet traces and application logs; other work describes root-cause workflows and frameworks that structure cloud logs into incident narratives.Source: §2.2.3 · p. 8

2.2.4 Autonomous Vulnerability Remediation

  • Remediation systems synthesize patches and infrastructure templates, but stronger evaluation checks whether original exploits fail and whether fixes preserve security and functionality.A red-teaming framework also generates issue statements designed to induce malicious patches that pass unit tests while adding security flaws.Source: §2.2.4 · p. 8

2.2 Defensive Security Agents (Blue-Teaming)

  • Blue-team workflows emphasize telemetry processing, evidence aggregation, analyst collaboration, and approval-gated actions to limit false positives and disruptive responses.Long-term knowledge stores and threat-intelligence repositories help maintain context across investigations.Source: §2.2.4 · p. 9, Figure 3 · p. 9

2.3 Domain-specific Applications

Domain-specific applications apply agents to cloud and infrastructure security, web and application security, and specialized sectors. The surveyed systems combine automation with controls such as sandboxing, isolation, and policy-based access.

2.3.1 Cloud and Infrastructure Security

  • Cloud and infrastructure agents scan, harden, and remediate environments, with sandboxed exploration used to verify changes before production deployment.Other systems route queries to auditing sub-agents, generate tools in a sandbox, or combine static analysis with retrieved configuration practices.Source: §2.3.1 · p. 9

2.3.2 Web and Application Security

  • Web and application security work spans penetration testing, browser-agent risks, prompt-to-SQL injection, operating-system isolation, and runtime permission enforcement.Progent enforces fine-grained permissions and completely blocks successful attacks during red-team evaluations of tool-using frameworks.Source: §2.3.2 · p. 10

2.3.3 Specialized Applications

  • Specialized applications include smart-contract auditing, binary reverse engineering, operational-technology deception, healthcare compliance, and enterprise privacy protection.The systems use tailored techniques such as program analysis, protocol-aware honeypots, field-level sanitization, and sensitive-information detection.Source: §2.3.3 · p. 10

2.4 Analysis of the Application Landscape

The application analysis maps agentic systems across offensive and defensive security lifecycles, compares red- and blue-teaming designs, and examines the dual use of red-teaming agents.

2.4.1 Security-Lifecycle Coverage Map

  • 45 papers target exploitation, while defensive research centers on detection (19 papers) and remediation (14 papers); persistence and exfiltration have no dedicated frameworks.Post-exploitation has 6 papers; root-cause analysis has 4 and response has 6, while coverage concentrates on stages with immediate feedback rather than sustained reasoning, stealth, or long-term awareness.Source: §2.4.1 · pp. 11–12

2.4.2 Red-Teaming vs Blue Teaming (SOC Agents)

  • Offensive systems prioritize long attack chains and context retention, whereas defensive SOC agents emphasize telemetry retrieval, analyst collaboration, and approval-gated workflows.Offensive failures include planning errors and context loss; defensive systems face false positives, CTI contradictions, and hallucinated findings.Source: §2.4.2 · pp. 12–13
  • 88.1% of offensive systems operate at Level 3, versus none of 34 defensive systems; 100% of defensive systems retain human-in-the-loop controls.Execution authority also differs: 92.9% of offensive systems can execute commands or modify targets, versus 41.2% of defensive systems, typically limited to low-risk tasks.Source: Figure 5 · p. 13, §2.4.2 · pp. 13–14

2.4.3 Dual-Use of Red Teaming Agents

  • 42 of 76 application-oriented systems (55.3%) expose directly offensive or broadly dual-use capabilities, framing applications as a shared capability space rather than a clean attacker-defender split.MalGEN averaged 11.3 MITRE ATT&CK techniques per sample, and approximately half of its generated samples evaded detection by all VirusTotal engines.Source: §2.4.3 · p. 14
  • 42% pass@5 on zero-day web vulnerabilities; HPTSA’s specialized agents yield up to a 4.3× improvement over prior single-agent approaches.ARTEMIS deployed up to eight agents across approximately 8,000 hosts and placed second overall in a live enterprise evaluation, outperforming 9 of 10 human professionals.Source: §2.4.3 · p. 14
  • At about $8.80 per exploit, Fang et al. (2024) report 87% exploitation of one-day CVEs, roughly 2.8× cheaper than the estimated human-expert baseline.HPTSA’s zero-day exploits cost approximately $24.4 each versus an estimated $75 for human experts.Source: §2.4.3 · p. 14, Figure 6 · p. 15
  • HPTSA loses a factor of 13× in pass@1 performance without hierarchical coordination, while underlying models often refuse offensive tasks directly but complete them within agent frameworks.High-level task abstractions in systems such as CAI and Incalmo are described as reducing the expertise required for sophisticated offensive operations.Source: §2.4.3 · p. 15
  • For defenders, the threat model is faster, cheaper, more parallel, and less dependent on experts than human-driven assumptions; current benchmarks only partially capture these risks.The survey motivates agent-generated-attack benchmarks and defenses such as provenance tracking and behavioral signatures of autonomous operators.Source: §2.4.3 · p. 15

3 Threats to Agentic Systems

The section surveys threats to agentic systems and the frameworks used to evaluate their resilience. It analyzes attack entry points, failure stages, agent-specificity, threat models, and benchmarks.

3.1.1 Injection Attacks

  • Prompt injection ranges from malicious instructions in prompts to attacks through retrieved documents, webpages, and tool interfaces.Reported approaches include black-box attacks against real-world applications and attacks that manipulate webpage content or tool descriptions.Source: §3.1.1 · pp. 15–16

3.1.2 Poisoning Attacks

  • Poisoning attacks corrupt memory, retrieval stores, or the backbone model during training to control later agent behavior.Reported variants include query-driven memory poisoning and persistent backdoors introduced through poisoned training data.Source: §3.1.2 · p. 16

3.1.3 Jailbreak Attacks; 3.1.4 Agent Manipulation Attacks

  • Jailbreaks exploit agent deployment and multi-step behavior, while manipulation attacks redirect goals or exploit reward mechanisms.Reported examples include agents complying with malicious tasks their underlying models refuse, goal hijacking, and specification gaming.Source: §3.1.3 · p. 17, §3.1.4 · p. 17

3.1.5 Pre-execution Cognitive Attacks

  • Pre-execution cognitive attacks manipulate intermediate reasoning, planning, or self-correction before the agent acts.Reported effects include malicious intermediate reasoning with correct final outputs, reduced refusal after task decomposition, and increased verification costs.Source: §3.1.5 · p. 18

3.1.6 Red-Teaming Attacks

  • Red-teaming research includes attacks on inter-agent messages and automated fuzzing that discovers vulnerabilities in deployed agents.AgentFuzz reports 34 zero-day vulnerabilities across 20 open-source agents, with 23 CVEs assigned.Source: §3.1.6 · p. 18

3.2 Evaluation Frameworks; 3.2.1 Adversarial Benchmarking; 3.2.2 Execution Environments

  • Evaluation spans adversarial benchmarks and execution environments, including realistic tasks, web interactions, and vulnerable-application testing.Reported settings include benchmarks for harmful requests, prompt injection, MCP interfaces, and long-horizon web tasks.Source: §3.2.1 · pp. 18–19, §3.2.2 · p. 19

3.3.1 Entry Points of the Attack Surface; 3.3.2 Failure Stages of the Agent Loop

  • Conversational input accounts for 55% of evaluated attacks; action selection has 52 papers and perception 41, while reflection has 3.Among agent-specific entry points, retrieved documents are studied in 15 papers, inter-agent communication in 8, and reflection output in 2.Source: §3.3.1 · pp. 19–20, §3.3.2 · p. 21

3.3.3 Inherited, Amplified and Agent-Native Threats; 3.3.4 Threat Models and Attack Objectives; 3.3.5 Benchmark Proliferation and Fragmentation

  • 67% of studied attacks are inherited or amplified, while 25% are agent-exclusive; 70% of threat papers assume black-box access.Benchmarks are fragmented, with roughly 85% used by one paper, and agent-specific surfaces such as memory and reflection remain under-evaluated.Source: §3.3.3 · p. 21, §3.3.4 · p. 22, §3.3.5 · pp. 22–23

4 Defense: Hardening the Agents

This section surveys agentic defenses, spanning architectural, runtime, formal, and operational protections as well as benchmark ecosystems for testing agent security. It organizes the landscape by prevalence, structural trust boundaries, security–cost trade-offs, and where defenses are applied, including the prevalence of post-computation defenses and combined pre- and post-computation controls.

4.1 Defense & Operations; 4.2 Evaluation Frameworks

  • Agent defenses and evaluations include secure architectures, runtime guardrails, multi-agent coordination, security operations, and benchmarks spanning prompt injection, tool use, red-teaming, and domain-specific risks.Testing resources include dynamic attack-and-defense environments, web-agent and tool-integrated benchmarks, and frameworks for security evaluation; domain-specific work covers areas such as cloud, robotics, browsers, and coding agents.Source: §4.1.1 · p. 23, §4.1.2 · p. 24, §4.1.3 · p. 24

4.3.1 Defense Strategies for LLM-Based Agents

  • Ten defense strategies span perimeter filtering, monitoring, scoped execution, and red-team simulation, with LLM-based monitoring (40.0%) and input filtering (33.3%) the largest categories.The strategies are assessed across scalability, adversarial robustness, latency or overhead, and coverage limits; monitoring incurs high latency and cost, while filtering struggles with sophisticated, obfuscated injections.Source: §4.3.1 · pp. 26–27
  • Other strategies include sandboxing and formal verification (21.0%), structured queries (17.1%), cryptographic verification (14.3%), dataset sanitation and differential privacy (11.4%), consensus and vaccine seeding (10.5%), and moving target defense (8.6%).Their cited limitations include poor scaling of formal verification, computational overhead for cryptographic checks, utility loss from over-sanitization, and instability from moving execution parameters.Source: §4.3.1 · p. 27

4.3.2 LLM Defense Mechanisms and Structural Compositions

  • Six structural compositions map defenses to trust boundaries; injection and agent-manipulation attacks have an 18-paper overlap (17.1%), making prompt injection a dominant route to tool-execution hijacking.Alignment defenses face 28 jailbreak-focused papers (26.7%), while external monitors intersect with 14 jailbreak and red-teaming papers (13.3%); formal verification targets tool abuse and privilege escalation.Source: §4.3.2 · pp. 27–28
  • Isolation, cryptographic integrity, and human checkpoints address other trust boundaries, but face API-surface risks, format-mimicking attacks, and scalability or alert-fatigue limits.The analysis links isolation to 12 pre-execution attack papers (11.4%), integrity to a 9-paper poisoning/extraction and pre-execution overlap (8.6%), and human checkpoints to 9 prompt-infection papers (8.6%).Source: §4.3.2 · p. 28

4.3.3 Cost and Security Trade-offs in Agentic Defense Systems

  • 18 papers (17.1%) use comprehensive cost reporting, jointly measuring attack mitigation, utility preservation, token consumption, and latency overhead.The passage identifies MCP-GUARD, IPIGUARD, and AgentSentry as examples but does not provide their comparative results.Source: §4.3.3 · p. 28
  • No defense dominates: MCP-GUARD improves F1 by +23.4% at roughly 455.9 ms, while IPIGUARD lowers ASR below 1% at 14,605 tokens per task and 13.88 seconds, preserving 67.7% benign utility.The evidence places approaches on a Pareto frontier: stronger protection generally requires more computation, and reported latency ranges from sub-millisecond filters to forensic systems taking several minutes.Source: §4.3.3 · p. 30
  • Security-and-utility studies (35 papers; 33.3%) prioritize normal-operation performance, but restrictive alignment can hurt complex task completion; Sandwich Prevention suppresses ASR yet causes catastrophic forgetting on long-horizon workflows.AgentDojo examines task completion and false refusal behavior, while these studies generally pay less attention to infrastructure latency (Debenedetti et al., 2024).Source: §4.3.3 · p. 30
  • Security-and-compute studies (24 papers; 22.9%) weigh detection quality against cost: PhishDebate reaches 94.14% accuracy at 37.50 seconds per sample, while PROVSEEK scores 0.92 F1 using 440K tokens across roughly 30 minutes.GuardAgent achieves 81.4% accuracy at 6,116 tokens per task over 6.30 seconds. Triage pipelines, specialized agents, and data reduction lower costs before large-model calls, but cheaper triage layers remain exploitable (Li et al., 2025d; Mukherjee & Kantarcioglu, 2025; Xia et al., 2024).Source: §4.3.3 · p. 30
  • Qualitative and theoretical work (28 papers; 26.7%) proposes zero-trust, compartmentalization, and continuous monitoring, but often lacks large-scale empirical validation; PPA screening takes about 0.06 ms with zero token overhead.Lightweight filters can screen requests before expensive LLM reasoning is triggered (Jia et al., 2025).Source: §4.3.3 · p. 30

4.3.4 Defense Placement Across the Agent Lifecycle

  • Across 105 papers, post-computation defenses are most common (79; 75.2%), while 42 (40.0%) combine pre- and post-computation controls.Only 26 papers (24.8%) rely exclusively on pre-computation controls and 37 (35.2%) exclusively on post-computation mechanisms, supporting a consensus that no single layer suffices against adaptive, persistent threats.Source: §4.3.4 · pp. 30–31, Figure 10 · p. 31

5 Cross-Cutting Analysis and Trends

The cross-cutting analysis compares defense coverage, agent structures, foundation-model usage, and data modalities. It finds uneven coverage across attack classes and modalities alongside widespread use of multi-agent systems and GPT models.

5.1 Defense Coverage Across Attack Categories

  • Defense papers most often address agent manipulation (26), jailbreak (23), and injection attacks (21); Figure 11 counts 142 category assignments across 105 papers.A paper may address multiple attack categories.Source: §5.1 · p. 32, Figure 11 · p. 32
  • Defenses cover poisoning and extraction (20 papers), prompt infection (18), red-teaming (17), and pre-execution attacks (17), with strategies varying by attack class.The passage identifies dataset sanitation and differential privacy for poisoning and extraction, consensus or vaccine seeding for prompt infection, and cryptographic verification for pre-execution attacks.Source: §5.1 · pp. 32–33

5.2 Structural and Functional Analysis of Agentic AI Systems

  • Multi-agent systems lead the corpus at 125 papers (49.4%), followed by single-agent systems at 85 (33.6%) and hybrid frameworks at 43 (17.0%).The analysis also reports 110 fully autonomous systems (43.5%) and 85 semi-autonomous systems (33.6%).Source: §5.2 · p. 33

5.3 Foundation Model Usage Patterns and Security Evaluations

  • GPT appears in 242 papers (95.7%); Claude (184), LLaMA (156), Gemini (148), Qwen (115), and DeepSeek (55) also appear.The surveyed studies report security concerns including indirect prompt injection, refusal degradation, visual attacks, and planning-phase vulnerabilities across model families.Source: §5.3 · p. 35
  • In-context learning appears in 142 papers (56.1%) and RAG in 156 (61.7%); about 85 papers combine them, while fine-tuning appears in 128 (50.6%).The reported assignments are non-mutually exclusive.Source: §5.3 · pp. 35–36

5.4 Data Modalities and Cross-Modal Security Workloads

  • Text is the dominant modality at 231 papers (91.3%); code appears in 128 (50.6%), logs in 49 (19.4%), and images in 37 (14.6%).Text supports high-level reasoning and threat-intelligence parsing; images enable visual navigation but are susceptible to visual prompt injections and steganographic triggers.Source: §5.4 · p. 36
  • Network traces appear in 22 papers (8.7%), while binaries appear in 15 (5.9%); live network use faces latency limits and binary analysis lacks semantic metadata.Figure 15 describes a gap in active end-to-end network or binary runtime security enforcement.Source: §5.4 · pp. 36–37, Figure 15 · p. 37

6 Related Work Comparison

The survey distinguishes its scope from prior work by integrating applications with threats and defenses, and by connecting technical protections across system levels.

6 Related Work Comparison

  • Earlier surveys cover selected areas such as prompt injection, commercial-agent manipulation, model-family safety, or development-pipeline risks, whereas this survey focuses on post-deployment agent behavior and interaction.It places threats in a taxonomy of when and how failures occur and examines how defenses are designed.Source: §6 · p. 37
  • Unlike governance-focused surveys of trustworthiness or TRiSM compliance, this survey treats downstream applications as a core pillar alongside threats and defenses.It also examines offensive red-teaming and defensive blue-teaming deployments, architectural trends, and data modalities.Source: §6 · p. 37
  • Where prior technical or theoretical studies isolate subsystems such as sandboxing, communication protocols, or multi-agent risks, this survey connects protections to broader coordination and control strategies.Source: §6 · p. 38

7 Conclusion

The survey concludes that agentic security research has uneven coverage across applications, threats, and defenses. It identifies underexplored agent-native attack surfaces and recommends lifecycle-wide protection and broader benchmarks.

7 Conclusion

  • Attacks are mostly inherited or amplified from base models, succeed under black-box access, and target perception and action selection, while agent-native surfaces remain least attacked and benchmarked.Memory, reflection, and inter-agent communication are identified as those underexplored surfaces.Source: §7 · p. 38
  • Offensive applications concentrate in feedback-rich stages, offensive agents are more autonomous than defensive ones, and red-teaming agents are largely dual-use.Persistence and exfiltration, along with their defensive detection counterparts, remain unexplored.Source: §7 · p. 38
  • The survey recommends attacks, benchmarks, and defenses tailored to agent-native surfaces, alongside unified benchmarks and lifecycle-wide defense-in-depth architectures.It also recommends broader coverage of network traces, binaries, and underdefended attack classes.Source: §7 · p. 38
  • The survey focuses mainly on software threats and academic papers; synthetic or simplified benchmarks and limited reporting of cost, speed, and energy constrain its coverage.The authors also note that their taxonomy involves subjective choices.Source: §7 · p. 38

A Paper Collection Methodology

The paper collection uses a multi-stage review process that combines automated searching, manual curation, and snowballing.

A Paper Collection Methodology

Automated Database Search

The review searched major academic repositories from January 2023 to May 2026 using a Boolean query combining agent-related and security-related terms.

Automated Database Search

  • The automated search covered ACL Anthology, IEEE Xplore, ACM Digital Library, and arXiv from January 2023 to May 2026.Source: Automated Database Search · p. 58
  • The query required a match from both an agent-related keyword group and a security-related keyword group.Source: Automated Database Search · p. 58
  • Agent terms included LLM and AI agents, agentic AI, autonomous agents, and multi-agent systems, while security terms ranged from threats and attacks to defenses and prompt injection.Source: Automated Database Search · p. 58

Manual Curation

To find work potentially missed by the keyword search, the authors manually scanned proceedings from security and AI conferences in the same period.

Manual Curation

  • Manual proceedings scans were intended to identify relevant work that the keyword search might have missed.Source: Manual Curation · p. 58
  • The security venues included USENIX, ACM CCS, and Oakland, while the AI venues included ACL, EMNLP, NeurIPS, ICLR, and ICML.Source: Manual Curation · p. 58
  • The manual scan covered the same period as the automated search.Source: Manual Curation · p. 58

Inclusion and Exclusion Criteria

Included papers had to center on LLM-based agents, substantially address a technical security aspect within one of the three pillars, and meet the publication-status criterion; several adjacent categories were excluded.

Inclusion and Exclusion Criteria

Snowballing

The authors used backward and forward snowballing on the curated papers to seek additional foundational or related work.

Snowballing

  • Snowballing was performed on the curated set of included papers.Source: Snowballing · p. 59
  • The authors reviewed the included papers’ reference lists to look for foundational or related works that might have been missed.Source: Snowballing · p. 59
  • The process included both backward and forward snowballing.Source: Snowballing · p. 59
Loading 2510.06445v3…