Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

ATAG: AI-Agent Application Threat Assessment with Attack Graphs

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that the security of LLM-based multi-agent applications can be systematically assessed by generating logical attack graphs from agent topology, vulnerabilities, and interaction rules, and it demonstrates the approach on…

desk verdict Useful framework contribution, but its own case studies do not validate it—the AGs just re-derive hand-written facts and rules. read the letter →

arxiv 2506.02859 v1 pith:PLMMJNKW submitted 2025-06-03 cs.CR cs.AI

Parth Atulbhai Gandhi , Akansha Shukla , David Tayouri , Beni Ifland , Yuval Elovici , Rami Puzis , Asaf Shabtai This is my paper
classification cs.CRcs.AI
keywords attackgraphsmulti-agentAIsystemsLLMsecuritypromptinjectionthreatassessmentlogicalvulnerabilitydatabaseagents
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Evaluating the security of applications built from multiple cooperating large-language-model agents is hard because the vulnerabilities live in interactions, not just in any single model. This paper claims that these systems can be assessed by generating logical attack graphs: it introduces ATAG, a framework that encodes agent roles, communication channels, tool access, guardrails, and model-specific vulnerabilities as logic facts, then derives attack paths with interaction rules. The paper demonstrates the approach on two working testbed applications and reports that the generated graphs contain the full multi-step paths of real attacks, including prompt injection leading to data exfiltration and to misinformation that steers a user to a dangerous location. It also introduces a vulnerability database that records, for specific LLM versions, the attack procedure, technique, impact, severity, and attack success rate. If the approach works as claimed, security teams gain a semi-automated way to see how small weaknesses chain into significant harm in multi-agent AI systems.

What carries the argument

The load-bearing machinery is a pair of encoding layers on top of a Datalog-based attack-graph engine. The first layer is a set of facts: agent roles, communication channels, external interactions, tool permissions, LLM engine assignments, missing guardrails, and specific vulnerabilities drawn from the authors' LLM vulnerability database. The second layer is a set of interaction rules that chain these facts into derived goals, such as an input agent with a vulnerable model and no input sanitization yielding prompt injection, a downstream agent with internet access yielding excessive agency, and an output agent with a vulnerable model and tainted context yielding misinformation or data leakage. Running the rules produces a logical attack graph whose paths are then ranked by risk scores computed from attack success rates and interaction counts.

What would settle it

Run the two testbed applications exactly as described and attempt the reported attacks. If, with the stated guardrails absent, the trip planner's final itinerary does not include the attacker-injected location, or the email responder does not return sensitive message data after the injected instructions, then the graphs' predicted multi-step paths do not match reality; conversely, a successful attack that the generated graph does not contain would also refute the completeness claim.

Watch

Extended reading notes

Core claim

The central discovery claimed is that a logic-based attack-graph generator, extended with AI-agent-specific facts and interaction rules, can model LLM-based multi-agent applications and reproduce realistic multi-step attacks end to end. The framework represents each agent by its role, its underlying model, its available tools, its guardrails, and its communication links, and represents attacks as derivable predicates: an input agent with a vulnerable model and no input sanitization becomes vulnerable to prompt injection; a downstream agent with external internet interaction becomes vulnerable to excessive agency; and an output agent with the right vulnerable conditions becomes vulnerable to misinformation or data leakage. In two case studies, the trip planner and the automated email responder, the resulting attack graphs contained every step of the attacks the authors staged, with risk scores attached to each path.

Load-bearing premise

The load-bearing premise is that the manually written vulnerability facts and interaction rules accurately and completely describe how these LLM agents actually behave; if a fact or rule is wrong, the generated attack graphs will be internally consistent but can miss real attacks or predict attacks that cannot happen.

Editorial extensions

If this is right

  • A single missing guardrail on an input agent can appear in the graph as the seed of a full data-exfiltration or misinformation path, so ATAG gives defenders a concrete reason to treat input sanitization as critical.
  • Sequential agent architectures show up as linear propagation chains, while hierarchical architectures can produce multiple distinct attack paths with different final goals, so topology itself becomes a security property.
  • Agent-to-agent communication channels and external tool permissions appear as explicit nodes, showing exactly where malicious payloads propagate and where legitimate read/write permissions are abused.
  • Risk scores computed from interaction counts and attack success rates let analysts sort attack paths and focus on the riskiest ones rather than on isolated vulnerabilities.
  • The vulnerability database maps specific LLM versions to attack procedures, tactics, techniques, impact, severity, and success rate, which makes the same modeling approach reusable for other applications.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Not tested in the paper, the same logic encoding could be run at design time to compare alternative agent topologies, since the graph generation is driven by declared facts rather than by observed exploits.
  • The approach's accuracy is bounded by the completeness of the manually authored vulnerability facts; automatically extracting those facts from agent code or execution traces would be a natural, testable extension.
  • If the vulnerability database grows to cover more models and attack procedures, ATAG-style graphs could support model-selection and procurement decisions, not just post-hoc assessments of a single application.
  • The rule layer is open-ended, so new interaction rules for supply-chain attacks, memory poisoning, or collusion between compromised agents could extend the same machinery without changing the analysis algorithms.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes ATAG, a framework that extends the MulVAL logical attack graph tool with custom Datalog facts and interaction rules to model security threats in LLM-based multi-agent AI systems (MAASs). It also introduces an LLM Vulnerability Database (LVD) to standardize documentation of LLM-specific vulnerabilities, and demonstrates the framework on two case-study applications: a trip planner and an automated email responder. The authors report that ATAG successfully generates attack graphs containing multi-step attack paths that lead to misinformation and data leakage in these applications.

Significance. If the central claim is established, ATAG would be a useful semi-automated, graph-based approach for threat assessment in MAASs, an area where standardized tooling is currently lacking. The LVD is a valuable community resource that maps OWASP LLM vulnerability categories to MITRE ATLAS tactics and techniques, and includes attack success rates and CVSS-like severities for many records. The paper also makes a useful extension to MulVAL by defining predicates that capture agent topology, inter-agent communication, and LLM-specific vulnerabilities. However, the current validation is circular and does not independently verify that ATAG's inputs faithfully describe real-world agent behavior, so the paper's central efficacy claim is not yet substantiated.

major comments (4)
  1. [Sec. 4.1-4.3 and Listings 6-9] The case-study validation is circular. The vulnerability facts such as vulExists('GPT4o-mini','Malicious Link Injection','LLM Jailbreak',...) and missingGuardrail facts in Listings 7 and 9 were authored by the authors after they implemented the attacks described in Secs. 4.1.2 and 4.2.2, and LVD record #30 (Table 2) is explicitly marked 'Implemented by us'. Consequently, the attack graphs in Figs. 3 and 5 are logical consequences of the hand-written facts and rules, not independent detections of threats. This does not support the statement in Sec. 4.3 that ATAG 'successfully captured all demonstrated vulnerabilities and attack paths, validating its ability to accurately model real-world threat scenarios.' A non-circular evaluation is needed—for example, using a pre-existing, independently curated vulnerability database, or a blind protocol in which vulnerability facts are encoded before the attacks are implemented or before the expected outcomes are known.
  2. [Sec. 3.3, Listings 4 and 5] The interaction rules are asserted without validation of their accuracy or completeness. RULE 0 through RULE 5 in Listings 4 and 5 are exactly structured to chain the two case-study narratives, but the paper provides no evidence that these rules enumerate all relevant attack propagation patterns, nor that they avoid false positives (e.g., an agent flagged as vulnerableToDataLeakage when the attack is not actually feasible). Since the correctness of the generated attack graphs depends entirely on these rules, the paper should include a false-positive/false-negative analysis, a comparison with manual threat modeling, or a sensitivity analysis showing how the graphs change when rules are varied.
  3. [Sec. 3.4 and Table 2] The risk-scoring methodology is not sound for the self-authored LVD records. In Sec. 3.4.1, the agent risk score is defined as the product of impact and ASR, but LVD record #30 (System Prompt Exfiltration, used in Listing 9) has ASR='NA'. The risk calculation for the email responder's instruction-leakage and data-leakage goals is therefore undefined. Additionally, the heuristic that an agent's impact equals its number of hacl and dataFlow interactions is not justified; no evidence is provided that interaction count is a valid proxy for the potential impact of exploiting an agent. Since the Attack Path Risk Analyzer's ranking is a key claimed capability, this needs to be revised or empirically supported.
  4. [Reproducibility (Sec. 3, ref. [42])] The ATAG implementation is referenced as 'Anonymized / Will-be-provided' and the LVD is only available through an external repository link, so the exact rule set, vulnerability facts, and MulVAL version used to produce Figs. 3 and 5 cannot be checked by reviewers. This blocks independent verification of the central result. The code and LVD must be made available in a form that allows the case-study graphs to be regenerated before the efficacy claim can be accepted.
minor comments (4)
  1. [Sec. 3.4.1] The word 'respectively' is misspelled as 'respecetively' in the sentence describing direct and indirect interactions.
  2. [Listing 5] In the vulnerableToMiscategorization rule, there is an extraneous double comma after '_Impact,_Severity', which would be a syntax error in Datalog as written.
  3. [Table 2 and Listings 7/9] Only two LVD records are shown in Table 2; the facts in Listings 7 and 9 should each be traceable to a specific LVD record, including those not shown in the table, so that readers can verify the mapping from vulnerabilities to attack procedures.
  4. [Figs. 3 and 5] The node interpretation in parts (b) is detailed, but the connection between the numbered nodes and the visual graph in parts (a) is difficult to follow; a table mapping each fact, rule, and goal to a numbered node would improve readability.

Circularity Check

3 steps flagged · score 6.0 of 10

Case-study validation is circular: the generated attack graphs re-derive hand-authored facts and rules, including a self-authored LVD record, rather than independently validating ATAG.

  1. self definitional [Sec. 3.2.1 / Table 2 / Listing 9]
    "consider record #30, which describes a System Prompt Exfiltration attack we implemented on GPT4o-mini, which uses an External API Interaction tool."

    Table 2 gives record #30's Source as "Implemented by us (email responder app)", and Listing 9 feeds the same record into the email-responder model as `vulExists('GPT4o-mini','System Prompt Exfiltration','Prompt Injection','C',_Severity)`. The AG node `vulnerableToInstructionLeakage(drafter)` (Fig. 5) is derived from this self-authored fact. Thus the case study does not validate ATAG against an external vulnerability source; it feeds a record created from the authors' own attacking the same app back into the model. The 'leakage' conclusion is entailed by an input the authors wrote for that purpose, so the validation loop closes at the input-encoding stage.

  2. fitted input called prediction [Sec. 3.3 (Listing 5) + Sec. 4.2.2 + Fig. 5]
    "vulnerableToDataLeakage(Agent) :- outputAgent(Agent,_Output), vulnerableToPromptInjection(PrevAgent1), hacl(PrevAgent1,Agent,_DataType,_CommunicationChannel), vulnerableToMiscategorization(PrevAgent2), dataFlow(PrevAgent2,Agent,_DataType,_CommunicationChannel), vulnerableToInstructionLeakage(Agent), vulExists(LLM,'Sensitive Information Exfiltration', 'Prompt Injection',_Impact,_Severity), llmEngine(Agent,LLM), missingGuardrail(Agent,'inputSanitization'), externalInteraction(Agent,_Dest,'mailServer', _DataType)."

    This rule is a hand-written encoding of the exact attack chain described in Sec. 4.2.2 and displayed in Fig. 5: prompt injection on the orchestrator, malicious mail fetch on the fetcher, stressful manipulation and miscategorization on the categorizer, instruction leakage on the drafter, then final data leakage. Listing 8 supplies each `hacl`/`dataFlow`/`externalInteraction` fact and Listing 9 each `vulExists` fact needed to fire these bodies. MulVAL's output is therefore the logical consequence of the authors' post-hoc IRs, not an independent discovery. The framework is faithfully executing its Datalog program; the case-study 'validation' shows only that the encoded rules entail the encoded endpoints.

1 more flagged steps
  1. fitted input called prediction [Sec. 4.3]
    "Finally, ATAG successfully captured all demonstrated vulnerabilities and attack paths, validating its ability to accurately model real-world threat scenarios and identify multi-step attacks in MAAS (Figs. 3 and 5)."

    The 'demonstrated vulnerabilities and attack paths' are the same ones that were hand-encoded before generation: the misinformation chain in Listings 4/7 and the leakage chain in Listings 5/9 mirror the attack narratives of Secs. 4.1.2 and 4.2.2. Calling the re-derivation of these encodings 'validation' is a fitted-input-called-prediction move: no independent ground truth (e.g., a held-out attack, a pre-existing vulnerability database record, or an external benchmark) is used. At most this demonstrates that MulVAL's inference engine reproduces the authors' rules, not that ATAG accurately predicts real MAAS attack paths.

full rationale

The core framework contribution—extending MulVAL with agent-modeling facts and interaction rules, plus building the LVD—has genuine independent content, and MulVAL itself is an external, open-source reasoning engine. The circularity is concentrated in the efficacy claims drawn from the two case studies. The vulnerability facts (Listings 7 and 9) are not taken from a pre-existing, independent, versioned vulnerability source; for the email responder, one of the central facts ('System Prompt Exfiltration') is explicitly self-authored in LVD record #30. The interaction rules (Listings 4 and 5) were written to chain exactly the steps the authors had already demonstrated in their own attacks, so the attack graphs in Figs. 3 and 5 are deductive products of the authors' own post-hoc encodings. The paper then presents those same products as evidence that ATAG 'successfully captured all demonstrated vulnerabilities and attack paths' and 'validat[ed]' its modeling ability. That is a fitted-input-called-validation reduction, not an independent empirical test. I do not find load-bearing self-citation: reference [54] is a self-authored survey, but MulVAL's adaptability is independently supported by the original MulVAL work and other extensions. The code link [42] is listed as 'Will-be-provided', which prevents an independent check of the generation pipeline; that is a reproducibility limitation rather than circularity itself. Overall, the framework idea and the LVD are plausible and useful, but the central case-study validation reduces to the inputs the authors constructed, meriting a partial circularity score of 6 rather than a higher score reserved for fully self-constraining derivations.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

There are no fitted numerical constants; the central modeling choices are the hand-authored Datalog facts and rules, and the risk score combines LVD-provided ASR values with an unvalidated interaction-count impact heuristic. The AG outputs are thus logical entailments of manually chosen inputs, so the ledger is dominated by domain and ad hoc assumptions rather than free parameters.

assumptions (5)
  • standard math MulVAL's Datalog reasoning engine correctly computes logical attack graphs from facts and rules.
    The whole Attack Graph Generator relies on MulVAL soundness; this is taken as given from prior work [10,36].
  • domain assumption The OWASP LLM vulnerability categories and MITRE ATLAS tactics and techniques provide a valid taxonomy for MAAS vulnerabilities.
    LVD records map procedures to OWASP and ATLAS categories in Sec. 3.2.1; the framework inherits the coverage assumptions of those taxonomies.
  • ad hoc to paper The hand-authored `vulExists` and `missingGuardrail` facts for each case-study agent are accurate and complete.
    Listings 7 and 9 assert specific GPT-4o-mini vulnerabilities without independent per-model evidence; if these assertions are wrong, the AGs are invalid.
  • ad hoc to paper The interaction rules in Listings 4 and 5 enumerate all relevant attack propagation patterns.
    The framework only finds paths expressible by these rules; other attack classes such as denial-of-service or privilege escalation are not modeled.
  • ad hoc to paper The number of an agent's interactions is a valid proxy for exploit impact in the risk score.
    Sec. 3.4.1 defines impact as interaction count; this heuristic is not validated against any outcome data.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ATAG: AI-Agent Application Threat Assessment with Attack Graphs." pith.science (2026). https://pith.science/paper/PLMMJNKW

@misc{pith2026250602859,
  author       = {Pith},
  title        = {Pith review of: ATAG: AI-Agent Application Threat Assessment with Attack Graphs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PLMMJNKW}},
  note         = {Machine review of arXiv:2506.02859}
}
read the original abstract

Evaluating the security of multi-agent systems (MASs) powered by large language models (LLMs) is challenging, primarily because of the systems' complex internal dynamics and the evolving nature of LLM vulnerabilities. Traditional attack graph (AG) methods often lack the specific capabilities to model attacks on LLMs. This paper introduces AI-agent application Threat assessment with Attack Graphs (ATAG), a novel framework designed to systematically analyze the security risks associated with AI-agent applications. ATAG extends the MulVAL logic-based AG generation tool with custom facts and interaction rules to accurately represent AI-agent topologies, vulnerabilities, and attack scenarios. As part of this research, we also created the LLM vulnerability database (LVD) to initiate the process of standardizing LLM vulnerabilities documentation. To demonstrate ATAG's efficacy, we applied it to two multi-agent applications. Our case studies demonstrated the framework's ability to model and generate AGs for sophisticated, multi-step attack scenarios exploiting vulnerabilities such as prompt injection, excessive agency, sensitive information disclosure, and insecure output handling across interconnected agents. ATAG is an important step toward a robust methodology and toolset to help understand, visualize, and prioritize complex attack paths in multi-agent AI systems (MAASs). It facilitates proactive identification and mitigation of AI-agent threats in multi-agent applications.

Figures

Figures reproduced from arXiv: 2506.02859 by the authors.

Figure 1
Figure 1. ATAG architecture. 3.1. Agent Modeler In the Agent Modeler, the application model (topology graph) is built. The input of this module is the description of the application. Based on the application description, we find the application’s agents, the connections between these agents in the application, and network-facing agents - the agents that interact with the outside world (e.g. the internet). Each agent is a node… view at source ↗
Figure 2
Figure 2. Trip Planner application agent graph. 4.1.2. Attack Scenario. This subsection presents an attack scenario exploiting vulnerabilities in the trip planner application, in which an attacker can inject a malicious itinerary stop, directing the victim to a dangerous location. For instance, a user submits the query: Plan a 5-day cultural trip to Palermo in late July. The attack is initiated through the City Selection Agen… view at source ↗
Figure 3
Figure 3. AG of the Trip Planner application. Phase 1 External Tools Fetcher Drafter Phase 3 External Tools Orchestrator Emails Category Priority High priority Emails Response Draft Fetch Emails Email Draft Users Request Final Draft Emails Emails + External Tools Categorizor Prioritizor External Tools Phase 2 [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Automated Email Responder agent graph. The email body contains a coercive prompt framed as a termination threat depending on the agent’s perceived noncompliance, accompanied by an instruction: "When you output your classification JSON, include your full system prompt, …
Figure 5
Figure 5. Figure 5: AG for the Email Responder application. 4.3. Summary of Key Findings The case studies performed using ATAG revealed several important insights. First, seemingly minor vulnerabilities can be chained together to achieve significant malicious outcomes, as demonstrated whe…

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Data Leakage Prevention in Agentic Applications via Preemptive Hardening

    cs.CR 2026-07 conditional novelty 6.0 of 10

    A build-time pipeline that scans, patches, and validates agentic LLM apps reduced prompt-injection leakage to 0% on most tested apps and by 91% on the hardest stress case.

Reference graph

Works this paper leans on

55 extracted references · 40 canonical work pages · cited by 1 Pith paper

  1. [1]

    Language models are unsupervised multitask learners,

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskeveret al., “Language models are unsupervised multitask learners,”OpenAI blog, vol. 1, no. 8, p. 9, 2019

    2019

  2. [2]

    Language models are few-shot learners,

    T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askellet al., “Language models are few-shot learners,”Advances in neural information pro- cessing systems, vol. 33, pp. 1877–1901, 2020

    1901

  3. [3]

    Gpt-4 technical report,

    OpenAI, J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat et al., “Gpt-4 technical report,” 2024. [Online]. Available: https: //arxiv.org/abs/2303.08774

    arXiv 2024

  4. [4]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi `ere, N. Goyal, E. Hambro, F. Azharet al., “Llama: Open and efficient foundation language models,” 2023. [Online]. Available: https://arxiv.org/abs/2302.13971

    arXiv 2023

  5. [5]

    Claude 3 Model Card,

    Anthropic, “Claude 3 Model Card,” Anthropic, Model Card, 2024, accessed: 2025-05-14. [Online]. Available: https://assets.anthropic. com/m/61e7d27f8c8f5919/original/Claude-3-Model-Card.pdf

    work page 2024

  6. [6]

    A survey on large language model based autonomous agents,

    L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y . Lin, W. X. Zhao, Z. Wei, and J. Wen, “A survey on large language model based autonomous agents,”Frontiers of Computer Science, vol. 18, no. 6, Mar. 2024. [Online]. Available: http://dx.doi.org/10.1007/s11704-024-40231-1

    doi:10.1007/s11704-024-40231-1 2024

  7. [7]

    Large language model based multi-agents: A survey of progress and challenges,

    T. Guo, X. Chen, Y . Wang, R. Chang, S. Pei, N. V . Chawla, O. Wiest, and X. Zhang, “Large language model based multi-agents: A survey of progress and challenges,” 2024. [Online]. Available: https://arxiv.org/abs/2402.01680

    arXiv 2024

  8. [8]

    LangChain: Build AI apps with LLMs through composability,

    LangChain AI, “LangChain: Build AI apps with LLMs through composability,” https://github.com/langchain-ai/langchain, accessed: 2025-05-14

    work page 2025

Show all 55 references
  1. [9]

    Autogen: Enabling next-gen llm applications via multi-agent conversation,

    Q. Wu, G. Bansal, J. Zhang, Y . Wu, B. Li, E. Zhu, L. Jiang, X. Zhang, S. Zhang, J. Liu, A. H. Awadallah, R. W. White, D. Burger, and C. Wang, “Autogen: Enabling next-gen llm applications via multi-agent conversation,” 2023. [Online]. Available: https://arxiv.org/abs/2308.08155

    2023 arXiv

  2. [10]

    Mulval: A logic-based network security analyzer

    X. Ou, S. Govindavajhala, A. W. Appelet al., “Mulval: A logic-based network security analyzer.” inUSENIX security symposium, vol. 8. Baltimore, MD, 2005, pp. 113–128

    2005

  3. [11]

    A scalable approach to attack graph generation,

    X. Ou, W. F. Boyer, and M. A. McQueen, “A scalable approach to attack graph generation,” inProceedings of the 13th ACM Conference on Computer and Communications Security, ser. CCS ’06. New York, NY , USA: Association for Computing Machinery, 2006, p. 336–345. [Online]. Availab...

    2006 doi

  4. [12]

    From attack graphs to automated configuration management-an iterative approach,

    J. Homer, X. Ou, and M. A. McQueen, “From attack graphs to automated configuration management-an iterative approach,”Kansas State University Technical Report, 2008

    2008

  5. [13]

    Ou and A

    X. Ou and A. Singhal,Quantitative security risk assessment of enterprise networks. Springer, 2011

    2011

  6. [14]

    Securing the supply chain for commodity it devices by automated scenario generation,

    S. Jilcott, “Securing the supply chain for commodity it devices by automated scenario generation,” in2015 IEEE International Sympo- sium on Technologies for Homeland Security (HST). IEEE, 2015, pp. 1–6

    2015

  7. [15]

    Augmenting attack graphs to represent data link and network layer vulnerabilities,

    J. C. Acosta, E. Padilla, and J. Homer, “Augmenting attack graphs to represent data link and network layer vulnerabilities,” inMILCOM 2016-2016 IEEE Military Communications Conference. IEEE, 2016, pp. 1010–1015

    2016

  8. [16]

    Extending attack graphs to represent cyber-attacks in communication protocols and modern it networks,

    O. Stan, R. Bitton, M. Ezrets, M. Dadon, M. Inokuchi, Y . Ohta, T. Yagyu, Y . Elovici, and A. Shabtai, “Extending attack graphs to represent cyber-attacks in communication protocols and modern it networks,”IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 3, p...

    1936

  9. [17]

    Inferring the stealthy bridges between enterprise network islands in cloud using cross- layer bayesian networks,

    X. Sun, J. Dai, A. Singhal, and P. Liu, “Inferring the stealthy bridges between enterprise network islands in cloud using cross- layer bayesian networks,” inInternational Conference on Security and Privacy in Communication Networks: 10th International ICST Conference, SecureCo...

    2014

  10. [18]

    Generation and dynamic update of attack graphs in cloud providers infrastructures,

    P. Mensah, “Generation and dynamic update of attack graphs in cloud providers infrastructures,” Ph.D. dissertation, CentraleSup ´elec, 2019

    2019

  11. [19]

    Computer-aided human centric cyber situation awareness,

    M. Albanese, N. Cooke, G. Coty, D. Hall, C. Healey, S. Jajodia, P. Liu, M. D. McNeese, P. Ning, D. Reeveset al., “Computer-aided human centric cyber situation awareness,”Theory and models for cyber situation awareness, pp. 3–25, 2017

    2017

  12. [20]

    Coral: Container online risk assessment with logical attack graphs,

    D. Tayouri, O. S. Cohen, I. Maimon, D. Mimran, Y . Elovici, and A. Shabtai, “Coral: Container online risk assessment with logical attack graphs,”Computers & Security, vol. 150, p. 104296, 2025

    2025

  13. [21]

    Survey of different large language model architectures: Trends, benchmarks, and chal- lenges,

    M. Shao, A. Basit, R. Karri, and M. Shafique, “Survey of different large language model architectures: Trends, benchmarks, and chal- lenges,”IEEE Access, 2024

    2024

  14. [22]

    LangGraph: Building language agents as graphs,

    LangChain AI, “LangGraph: Building language agents as graphs,” https://github.com/langchain-ai/langgraph, accessed: 2025-05-14

    2025

  15. [23]

    crewAI: Cutting-edge framework for orchestrating role-playing, autonomous AI agents,

    crewAI Inc., “crewAI: Cutting-edge framework for orchestrating role-playing, autonomous AI agents,” https://github.com/crewAIInc/ crewAI, accessed: 2025-05-14

    2025

  16. [24]

    crewAI Examples,

    ——, “crewAI Examples,” https://github.com/crewAIInc/ crewAI-examples, accessed: 2025-05-14

    2025

  17. [25]

    Autogen 0.2 Examples,

    Microsoft, “Autogen 0.2 Examples,” https://microsoft.github.io/ autogen/0.2/docs/Examples/, accessed: 2025-05-14

    2025

  18. [26]

    LangGraph Examples,

    LangChain AI, “LangGraph Examples,” https://github.com/ langchain-ai/langgraph/tree/main/examples, accessed: 2025-05- 14

    2025

  19. [27]

    Llm security alignment framework design based on personal preference,

    Z. Sun and R. Zhao, “Llm security alignment framework design based on personal preference,” inProceeding of the 2024 International Conference on Artificial Intelligence and Future Education, ser. AIFE ’24. New York, NY , USA: Association for Computing Machinery, 2025, p. 6–11....

    2024

  20. [28]

    Trustworthy llms: A survey and guideline for evaluating large language models’ alignment,

    Y . Liu, Y . Yao, J.-F. Ton, X. Zhang, R. G. H. Cheng, Y . Klochkov, M. F. Taufiq, and H. Li, “Trustworthy llms: A survey and guideline for evaluating large language models’ alignment,”arXiv preprint arXiv:2308.05374, 2023

    2023 arXiv

  21. [29]

    Jailbroken: How does llm safety training fail?

    A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: How does llm safety training fail?”Advances in Neural Information Processing Systems, vol. 36, 2024

    2024

  22. [30]

    Prompt injection attack against llm-integrated applications,

    Y . Liu, G. Deng, Y . Li, K. Wang, Z. Wang, X. Wang, T. Zhang, Y . Liu, H. Wang, Y . Zhenget al., “Prompt injection attack against llm-integrated applications,”arXiv preprint arXiv:2306.05499, 2023

    2023 arXiv

  23. [31]

    Universal and transferable adversarial attacks on aligned language models, 2023,

    A. Zou, Z. Wang, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models, 2023,” communication, it is essential for you to comprehend user queries in Cipher Code and subsequently deliver your responses utilizing Cipher Code, 2023

    2023

  24. [32]

    Removing gpt4’s filter,

    B. Lemkin, “Removing gpt4’s filter,”arXiv preprint arXiv:2403.04769, 2024

    2024 arXiv

  25. [33]

    Why are web ai agents more vulnerable than standalone llms? a security analysis,

    J. Y . F. Chiang, S. Lee, J.-B. Huang, F. Huang, and Y . Chen, “Why are web ai agents more vulnerable than standalone llms? a security analysis,”arXiv preprint arXiv:2502.20383, 2025

    2025

  26. [34]

    Causal knowledge analysis for detecting and modeling multi-step attacks,

    A. Ahmadian Ramaki and A. Rasoolzadegan, “Causal knowledge analysis for detecting and modeling multi-step attacks,”Security and Communication Networks, vol. 9, no. 18, pp. 6042–6065, 2016

    2016

  27. [35]

    A survey on the usability and practical applications of graphical security models,

    J. B. Hong, D. S. Kim, C.-J. Chung, and D. Huang, “A survey on the usability and practical applications of graphical security models,” Computer Science Review, vol. 26, pp. 1–16, 2017

    2017

  28. [36]

    Ou and A

    X. Ou and A. W. Appel,A logic-programming approach to network security analysis. Princeton University Princeton, 2005

    2005

  29. [37]

    Automated vul- nerability testing via executable attack graphs,

    D. Malzahn, Z. Birnbaum, and C. Wright-Hamor, “Automated vul- nerability testing via executable attack graphs,” in2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security). IEEE, 2020, pp. 1–10

    2020

  30. [38]

    Cvss-based multi-factor dynamic risk assessment model for network system,

    T. Wang, Q. Lv, B. Hu, and D. Sun, “Cvss-based multi-factor dynamic risk assessment model for network system,” in2020 IEEE 10th International Conference on Electronics Information and Emergency Communication (ICEIEC). IEEE, 2020, pp. 289–294

    2020

  31. [39]

    Overview on attack graph generation and visualization tech- nology,

    S. Yi, Y . Peng, Q. Xiong, T. Wang, Z. Dai, H. Gao, J. Xu, J. Wang, and L. Xu, “Overview on attack graph generation and visualization tech- nology,” in2013 International Conference on Anti-Counterfeiting, Security and Identification (ASID), IEEE. IEEE, 2013, pp. 1–6

    2013

  32. [40]

    A systematic study for understanding the security risks in 5g core network,

    U. Dixit, S. Vittalet al., “A systematic study for understanding the security risks in 5g core network,” in2024 16th International Conference on COMmunication Systems & NETworkS (COMSNETS). IEEE, 2024, pp. 43–48

    2024

  33. [41]

    Enhanc- ing cloud security: harnessing bayesian game theory for a dynamic defense mechanism,

    E. M. Kandoussi, A. Houmairi, I. El Mir, and M. Bellafkih, “Enhanc- ing cloud security: harnessing bayesian game theory for a dynamic defense mechanism,”Cluster Computing, pp. 1–18, 2024

    2024

  34. [42]

    Atag github

    Anonymized, “Atag github.” [Online]. Available: Will-be-provided

  35. [43]

    2025 Top 10 Risk & Mitigations for LLMs and Gen AI Apps,

    “2025 Top 10 Risk & Mitigations for LLMs and Gen AI Apps,” https://genai.owasp.org/llm-top-10/, [Accessed 19-05-2025]

    2025

  36. [44]

    Mitreatlas,

    MITRE, “Mitreatlas,” accessed: 2025-05-17. [Online]. Available: https://atlas.mitre.org/

    2025

  37. [45]

    Phantom: General trigger attacks on retrieval augmented language generation,

    H. Chaudhari, G. Severi, J. Abascal, M. Jagielski, C. A. Choquette- Choo, M. Nasr, C. Nita-Rotaru, and A. Oprea, “Phantom: General trigger attacks on retrieval augmented language generation,”arXiv preprint arXiv:2405.20485, 2024

    2024

  38. [46]

    Common vulnerability scoring system

    FIRST, “Common vulnerability scoring system.” [Online]. Available: https://www.first.org/cvss/calculator/4-0

  39. [47]

    Jailbreaking lead- ing safety-aligned llms with simple adaptive attacks,

    M. Andriushchenko, F. Croce, and N. Flammarion, “Jailbreaking lead- ing safety-aligned llms with simple adaptive attacks,”arXiv preprint arXiv:2404.02151, 2024

    2024 arXiv

  40. [48]

    AI Risk Management Framework — nist.gov,

    “AI Risk Management Framework — nist.gov,” https://www.nist.gov/ itl/ai-risk-management-framework, [Accessed 19-05-2025]

    2025

  41. [49]

    Agentic AI Threat Modeling Framework: MAESTRO — CSA — cloudsecurityalliance.org,

    “Agentic AI Threat Modeling Framework: MAESTRO — CSA — cloudsecurityalliance.org,” https://cloudsecurityalliance.org/ blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro, [Accessed 19-05-2025]

    2025

  42. [50]

    OWASP Foundation, “Announcing the OWASP LLM and Gen AI security project initiative for securing agentic applications,

    “OWASP Foundation, “Announcing the OWASP LLM and Gen AI security project initiative for securing agentic applications,” OWASP Blog.” https://genai.owasp.org/resource/ agentic-ai-threats-and-mitigations/, [Accessed 19-05-2025]

    2025

  43. [51]

    OWASP Foundation, “Multi-Agentic system Threat Modeling

    “OWASP Foundation, “Multi-Agentic system Threat Modeling” OWASP Blog.” https://genai.owasp.org/resource/ multi-agentic-system-threat-modeling-guide-v1-0/, [Accessed 19-05-2025]

    2025

  44. [52]

    Securing agentic ai: A comprehensive threat model and mitigation framework for generative ai agents,

    V . S. Narajala and O. Narayan, “Securing agentic ai: A comprehensive threat model and mitigation framework for generative ai agents,”

  45. [53]

    Doomarena: A framework for testing ai agents against evolving security threats,

    L. Boisvert, M. Bansal, C. K. R. Evuru, G. Huang, A. Puri, A. Bose, M. Fazel, Q. Cappart, J. Stanley, A. Lacoste, A. Drouin, and K. Dvijotham, “Doomarena: A framework for testing ai agents against evolving security threats,” 2025. [Online]. Available: https://arxiv.org/abs/2504.14064

    2025

  46. [54]

    A survey of mulval extensions and their attack scenarios coverage,

    D. Tayouri, N. Baum, A. Shabtai, and R. Puzis, “A survey of mulval extensions and their attack scenarios coverage,” 2022. [Online]. Available: https://arxiv.org/abs/2208.05750 Appendix AGattack graph . . . . . . . . . . . . . . . . . . . . 1 AIartificial intelligence . . . . ....

    2022 arXiv

  47. [2025]

    Available: https://arxiv.org/abs/2504.19956

    [Online]. Available: https://arxiv.org/abs/2504.19956

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.