Pith. sign in

REVIEW 2 major objections 5 minor 55 references

Securing Agentic AI: From Per-Action Checks to Trajectory Assurance

T0 review · 2 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Autonomous LLM agents cannot be secured by checking each action alone; the paper argues that safety is a property of the whole execution trajectory and must be built into architectures, protocols, and runtimes as a verifiable invariant.

desk verdict A useful agentic-security roadmap whose Section 5 overstates the gap between per-action checks and trajectory-level policy; the overclaim is fixable. read the letter →

arxiv 2608.01558 v1 pith:7XDTXBE2 submitted 2026-08-03 cs.AI cs.CRcs.MA

Alireza Lotfi , Subangkar Karmaker Shanto , Imtiaz Karim , Elisa Bertino This is my paper
classification cs.AIcs.CRcs.MA
keywords agenticAIsecuritybehavioralcontainmenttrajectoryassuranceLLMagentspromptinjectionmodelroutingmulti-agentsystemssupplychainintegrity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is a vision statement for securing autonomous LLM-based agents. It argues that a single agent may issue thousands of tool calls while a human reviews only a handful, so checking each action in isolation cannot determine whether the agent behaved acceptably. Its central thesis is that a sequence of individually permissible actions can collectively violate a system-level constraint or invariant, making behavioral containment—guaranteeing that the whole execution trajectory stays inside the rules of the governed system—the fundamental open problem. It organizes the field into eleven research directions spanning single-agent memory and tools, multi-agent delegation, model routing, behavioral containment, and supply-chain governance. The paper's unifying claim is that security must become a verifiable property of the architectures, protocols, and runtimes that govern agent behavior rather than an optional layer of guidance.

What carries the argument

The central object is the execution trajectory, and the identity that carries the argument is the gap between per-action permissions and the behavioral envelope of the governing policy. A behavioral envelope is the set of complete trajectories consistent with the rules and invariants of the system; a state-conditioned invariant is a constraint that depends on accumulated state over time, such as a recovery window or an aggregate observation window. Because the same action can be legal in isolation and illegal within a trajectory, the paper uses per-action checks versus trajectory assurance as the organizing lens for all eleven research directions. The remaining machinery consists of the protocol and runtime surfaces through which trajectories are formed—tool interfaces, memory, inter-agent delegation, model routing, and the deployment supply chain—each treated as a place where assurance must become an enforceable invariant.

What would settle it

Find and document one production agent platform whose runtime monitor ingests a written governing policy and enforces a trajectory-level stateful invariant, for instance a 5G slice recovery window or a clinical observation window, rather than checking individual actions; if such a system is deployed, the paper's claim that no deployed mechanism connects per-action permissions and sequence-level policy is false.

Watch

Extended reading notes

Core claim

The core claim is that safety for autonomous agents is a property of behavior over time, not of individual decisions. The paper defines the problem through the contrast between per-action checks and trajectory assurance: an execution trajectory—the ordered sequence of actions, tool calls, and state changes an agent produces—can violate a state-conditioned invariant of a governing standard even when every action in it is locally legal. Concrete examples carry the argument: a network scheduling agent that progressively deprioritizes a public-safety slice and misses a mandated recovery window, and a clinical agent whose accelerated discharge decisions defeat a care-pathway observation window. In both cases no adversarial input is involved. The paper then asserts that no deployed mechanism connects per-action permissions with sequence-level policy, and that existing safety mechanisms—stateless runtime guards, LLM-to-formal-spec compilers, probabilistic monitors, and hand-authored temporal checks—are not grounded in governing policies and fail to detect unseen prohibited trajectories. Behavioral assurance, not per-action validation, is therefore the central challenge.

Load-bearing premise

The load-bearing premise is that no deployed mechanism currently connects per-action permission checks to sequence-level policy, a claim the paper asserts without evidence; if a production runtime already verifies whole trajectories against a written governing policy, the paper's central framing would be overstated.

Editorial extensions

If this is right

  • Agent platforms that enforce only per-tool or per-action privileges will continue to admit trajectory-level violations, so product guarantees must shift to whole-execution stateful invariants.
  • Future runtime monitors will need to ingest the governing policy itself—a written artifact—and check the evolving trajectory against it, rather than relying on hand-authored or learned rules.
  • Inter-agent delegation protocols must make identity propagation, context ownership, and capability attestation mandatory verified properties, because cross-agent violations arise from interaction, not just from any single agent.
  • Model routing should be treated as a security-critical policy artifact, with provenance and auditability, since a compromised router can steer requests into less-aligned models and compose with tool and agent attacks.
  • Supply-chain assurance must extend software-bill-of-materials thinking to models, prompts, and dynamically discovered tools, and auditability must be engineered as an end-to-end property covering the whole agent lifecycle.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that a benchmark built on synthetic aggregate invariants—for example, a shared budget or a window that can only be exceeded through composition—would directly separate per-action-only monitors from trajectory-aware ones; its thesis predicts the former fail such tests systematically.
  • The trajectory-assurance framing suggests that classic runtime-verification techniques over execution traces are a natural starting point for the monitors the paper calls for, even though the paper does not mention this connection.
  • If interoperability protocols keep security controls optional, the boundary where an agent delegates across protocols becomes the most concentrated attack surface; an implementable test would be to force mandatory context-ownership and attestation invariants across that boundary and measure whether the known relay and downgrade attacks disappear.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. This vision paper argues that securing LLM-based autonomous agents requires shifting attention from per-action validation to behavioral assurance over entire execution trajectories. It surveys the agentic security landscape and organizes it into five areas: the single-agent surface (prompt injection, memory poisoning, tool integrity), the inter-agent surface (A2A protocol, identity, delegated authorization, emergent multi-agent risks), the model-routing control plane (adversarial routing, provenance and observability), behavioral trajectory containment (sequences of individually permitted actions violating system-level invariants), and assurance and governance (supply-chain integrity, auditability). The paper's central thesis, stated in the abstract and repeated in Section 5, is that 'a sequence of individually permissible actions may collectively violate system-level constraints and safety invariants,' making behavioral assurance, not per-action validation, the fundamental challenge. It exemplifies this with a 5G scheduling agent and a clinical discharge agent, and proposes a unifying principle: security must become a verifiable property of architectures, protocols, and runtimes. The paper is explicitly a vision paper, so it offers a roadmap and research directions rather than new mechanisms or empirical evaluations.

Significance. The paper's main strength is its synthetic lens: it connects disparate threats (prompt injection, memory poisoning, routing attacks, delegation, supply chain) under a common framing of 'governed deployment' and 'verifiable properties.' It grounds the discussion in concrete incidents (EchoLeak, AgentPoison, PoisonedRAG, postmark-mcp) and recent protocol analyses, which is appropriate for a vision paper. The emphasis on behavioral containment as a distinct, under-appreciated challenge is timely and likely to spur research. The paper does not introduce a technical mechanism or empirical dataset, but it provides a useful taxonomy and roadmap that can guide the community. The central claim, however, relies on an empirical gap that is stated as a universal negative without supporting evidence, which weakens the paper's motivating premise as currently written.

major comments (2)
  1. [5 (Behavioral Trajectory Containment), first paragraph] The opening claim of Section 5 — 'No deployed mechanism connects the two' — is an unsupported universal negative about the entire deployment landscape, and it is load-bearing for the paper's central thesis that behavioral assurance is the fundamental challenge. The paper does not define what counts as a 'deployed mechanism' or what it would mean for a mechanism to 'connect' per-action permissions with sequence-level policy, which makes the claim unfalsifiable and impossible to evaluate. I recommend either (a) providing evidence from a systematic survey of deployed policy engines (e.g., Open Policy Agent, Cedar, cloud provider agent guardrails) and runtime monitors, or (b) qualifying the claim to 'to our knowledge, no widely deployed mechanism...' and narrowing the scope to mechanisms grounded in explicit governing policy documents. Without this, the motivating premise is overstated.
  2. [5 (Behavioral Trajectory Containment), final paragraph] The subsequent statement that 'none of these approaches are grounded in governing policies' is internally inconsistent with the description of reference [5] in Section 4, which the paper summarizes as a 'declarative approach' that 'compiles routing logic into a non-Turing-complete specification with exhaustive, conflict-free decisions, audit trails, and verified routing nodes across MCP and A2A boundaries.' Unless 'governing policies' is defined so narrowly that [5] is excluded by construction, the paper must explain why a policy-compilation approach that spans MCP and A2A boundaries is not a counterexample to the claimed absence of policy-grounded mechanisms. Conversely, if [5] is limited to routing decisions and does not address behavioral trajectories, the paper should say so explicitly to avoid the appearance of contradiction.
minor comments (5)
  1. [1 (Introduction)] In the sentence 'our focus is to provide alensfor analyzing the agentic security landscape,' 'alensfor' should be 'a lens for'.
  2. [2 (The Single-Agent Surface)] In the sentence about tool poisoning, 'In atool poisoningattack' should be 'In a tool poisoning attack'.
  3. [3 (The Inter-Agent Surface)] The phrase 'optionalshould/mayguidance' should be 'optional should/may guidance' for readability.
  4. [5 (Behavioral Trajectory Containment)] Typographical issues: 'an long execution trajectory' should be 'a long execution trajectory,' and 'makes those unsuitable' should be 'makes them unsuitable.'
  5. [7 (Concluding Remarks)] The paper would benefit from a brief limitations paragraph acknowledging that the 'no deployed mechanism' claim and the assumed dominance of A2A/MCP are empirical statements that require ongoing validation as the protocol ecosystem evolves.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's taxonomy and roadmap are not derived from their own inputs, and the single self-citation is not load-bearing.

full rationale

This is a vision/taxonomy paper with no equations, no fitted parameters, no empirical predictions, and no uniqueness theorem. Its central claim—that sequences of individually permissible actions may collectively violate system-level constraints—is presented as an observed phenomenon with concrete domain examples (5G scheduling deprioritization, FHIR care-pathway observation windows) and is not defined in terms of any output that the paper then 'predicts.' The framing of behavioral containment as the central challenge is an argumentative position, not a derived result, so there is no construction-level circularity to expose. The paper's only apparent self-reference is citation [25], a survey co-authored by one of the present authors, used to support the uncontroversial statement that agentic AI security has attracted growing attention; that citation is not load-bearing for any of the paper's technical claims. Section 5's assertion that 'No deployed mechanism connects the two' is an unsupported empirical universal, and it sits in some tension with Section 4's citation [5] of a declarative policy-compilation approach operating 'across MCP and A2A boundaries.' That is a matter of evidence quality and internal consistency, not circularity: the paper never reduces a conclusion to its own premise by definition or by fitted input. No step in the paper's argument chain is equivalent to its inputs by construction.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper is a vision essay with no computations. Its central argument rests on domain assumptions about the state of agent practice: that governing policies define trajectory-level permissibility, that current guards are stateless, that protocols treat security as optional, and that formal-spec compilers are unfaithful. These are plausible but unverified premises. No free parameters or invented entities appear.

assumptions (4)
  • domain assumption Agent behavior is governed by policies that specify permissible sequences, not just per-action permissions.
    Central to the framing in Section 5; taken as given without argument.
  • domain assumption Existing runtime guards enforce only stateless, per-action policies.
    Asserted in Section 5, supports the claimed gap; no survey of deployed systems is provided.
  • domain assumption Protocols (A2A, MCP) leave identity and trust to implementers and treat security controls as optional.
    Attributed to cited protocol documents and analyses in Sections 3 and 4; no independent protocol audit.
  • domain assumption LLM-to-formal-spec compilers cannot guarantee completeness, consistency, or faithfulness to governing standards.
    Asserted in Section 5; used to justify the open challenge and not proven.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Securing Agentic AI: From Per-Action Checks to Trajectory Assurance." pith.science (2026). https://pith.science/paper/7XDTXBE2

@misc{pith2026260801558,
  author       = {Pith},
  title        = {Pith review of: Securing Agentic AI: From Per-Action Checks to Trajectory Assurance},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7XDTXBE2}},
  note         = {Machine review of arXiv:2608.01558}
}
read the original abstract

Autonomous agents are increasingly used to execute consequential tasks in environments governed by operational constraints, organizational policies, regulatory requirements, and technical standards. Their safety is therefore determined not by the correctness of individual actions, but by whether their overall behavior remains consistent with the rules and invariants of the systems in which they operate. As large language model (LLM)-based agents become more autonomous and increasingly delegate tasks across organizational boundaries, securing them evolves from a single challenge into a broad and interconnected landscape spanning the entire agentic stack. At the single-agent level, untrusted inputs through prompts, memory, retrieved knowledge, and tool interfaces create attack surfaces. In multi-agent settings, delegation and communication introduce challenges related to identity, trust, capability control, and decision transparency, while the underlying model routing and execution control plane remains vulnerable to manipulation and to unverified model provenance. Perhaps the most fundamental challenge is behavioral containment: sequences of individually permissible actions may collectively violate system-level constraints and safety invariants. At the broader level, supply-chain integrity, provenance, accountability, and end-to-end observability remain largely open problems. A common principle unifies these directions: security must become a verifiable property of the architectures, protocols, and runtimes that govern agent behavior, rather than an optional layer of guidance. Charting these challenges provides a roadmap toward trustworthy autonomous agent deployment.

Figures

Figures reproduced from arXiv: 2608.01558 by the authors.

Figure 1
Figure 1. Agentic AI architecture. An agent plans, uses mem [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. An agentic ecosystem with representative chal [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

55 extracted references · 28 canonical work pages

  1. [5]

    Huamin Chen, Xunzhuo Liu, Bowei He, and Xue Liu. 2026. From Inference Routing to Agent Orchestration: Declarative Policy Compilation with Cross- Layer Verification. arXiv:2603.27299 [cs.SE] https://arxiv.org/abs/2603.27299

    work page arXiv 2026

  2. [25]

    Sahaya Jestus Lazer, Kshitiz Aryal, Maanak Gupta, and Elisa Bertino. 2026. A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes. arXiv:2601.05293 [cs.CR] https://arxiv.org/abs/2601.05293

    arXiv 2026

  3. [1]

    2024.System architecture for the 5G System (TS 23.501)

    3GPP. 2024.System architecture for the 5G System (TS 23.501). Technical Report. 3rd Generation Partnership Project

    work page 2024

  4. [2]

    Zeynab Anbiaee, Mahdi Rabbani, Mansur Mirani, Gunjan Piya, Igor Opushnyev, Ali Ghorbani, and Sajjad Dadkhah. 2026. Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP. arXiv:2602.11327 doi:10.48550/arXiv.2602.11327

    arXiv doi:10.48550/arxiv.2602.11327 2026

  5. [3]

    Anthropic. 2024. Model Context Protocol. https://modelcontextprotocol.io

    2024

  6. [4]

    Alan Chan, Carson Ezell, Max Kaufmann, Kevin Wei, Lewis Hammond, Herbie Bradley, Emma Bluemke, Nitarshan Rajkumar, David Krueger, Noam Kolt, Lennart Heim, and Markus Anderljung. 2024. Visibility into AI Agents. InProceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency (FAccT). doi:10.1145/3630106.3658948

    arXiv 2024

  7. [6]

    Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. AgentPoison: Red-Teaming LLM Agents via Poisoning Memory or Knowl- edge Bases. InAdvances in Neural Information Processing Systems (NeurIPS). doi:10.48550/arXiv.2407.12784

    arXiv doi:10.48550/arxiv.2407.12784 2024

  8. [7]

    2012.Computer Security Incident Handling Guide (NIST SP 800-61 Rev

    Paul Cichonski, Tom Millar, Tim Grance, and Karen Scarfone. 2012.Computer Security Incident Handling Guide (NIST SP 800-61 Rev. 2). Technical Report. National Institute of Standards and Technology

    work page 2012

Show all 55 references
  1. [8]

    2025.Securing AI Agents with Cisco’s Open-Source A2A Scanner

    Cisco. 2025.Securing AI Agents with Cisco’s Open-Source A2A Scanner. https: //blogs.cisco.com/ai/securing-ai-agents-with-ciscos-open-source-a2a-scanner

    2025

  2. [9]

    Cloud Security Alliance. 2025. MAESTRO: Agentic AI Threat Modeling Framework. https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat- modeling-framework-maestro. Accessed 2026

    2025

  3. [10]

    Stav Cohen, Ron Bitton, and Ben Nassi. 2024. Here Comes the AI Worm: Unleashing Zero-Click Worms that Target GenAI-Powered Applications. arXiv:2403.02817 [cs.CR] doi:10.48550/arXiv.2403.02817

    2024 doi arXiv

  4. [11]

    Shrestha Datta, Shahriar Kabir Nahin, Anshuman Chhabra, and Prasant Mo- hapatra. 2025. Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges. arXiv:2510.23883 doi:10.48550/arXiv.2510.23883

    2025 doi arXiv

  5. [12]

    Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. 2025. Defeating Prompt Injections by Design. arXiv:2503.18813 doi:10. 48550/arXiv.2503.18813

    2025 doi arXiv

  6. [13]

    Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. 2024. AgentDojo: A Dynamic Environment to Eval- uate Prompt Injection Attacks and Defenses for LLM Agents. arXiv:2406.13352 doi:10.48550/arXiv.2406.13352

    2024 doi arXiv

  7. [14]

    Abul Ehtesham, Aditi Singh, Gaurav Kumar Gupta, and Saket Kumar. 2025. A Survey of Agent Interoperability Protocols: Model Context Protocol (MCP), Agent Communication Protocol (ACP), Agent-to-Agent Protocol (A2A), and Agent Network Protocol (ANP). arXiv:2505.02279 [cs.AI] doi:...

    2025 doi arXiv

  8. [15]

    2018.MiFID II Articles 17 and 21; RTS 6 Algorithmic Trading

    ESMA. 2018.MiFID II Articles 17 and 21; RTS 6 Algorithmic Trading. Technical Report. European Securities and Markets Authority

    2018

  9. [16]

    Mohamed Amine Ferrag, Norbert Tihanyi, Djallel Hamouda, Leandros Maglaras, Abderrahmane Lakas, and Merouane Debbah. 2026. From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows.ICT Express 12, 2 (2026), 353–383. doi:10.1016/j.icte.2025.12.001

    2026 doi

  10. [17]

    2025.Safeguarding AI Agents: An In-Depth Look at A2A Protocol Risks

    Yu Fu, Jay Chen, Yantian Hou, Yilin Zhao, Hui Gao, Royce Lu, and May Wang. 2025.Safeguarding AI Agents: An In-Depth Look at A2A Protocol Risks. Palo Alto Networks. https://live.paloaltonetworks.com/t5/community-blogs/safeguarding- ai-agents-an-in-depth-look-at-a2a-protocol-ris...

    2025

  11. [18]

    Google Developers. 2025. Google Cloud Donates A2A to the Linux Foundation. Google Developers Blog. https://developers.googleblog.com/en/google-cloud- donates-a2a-to-linux-foundation/

    2025

  12. [19]

    2023.HL7 FHIR Release 5: Workflow Module

    HL7 International. 2023.HL7 FHIR Release 5: Workflow Module. Technical Report. Health Level Seven International

    2023

  13. [20]

    Timperley, and Christian Kästner

    Yining Hong, Yining She, Eunsuk Kang, Christopher S. Timperley, and Christian Kästner. 2026. Symbolic Guardrails for Domain-Specific Agents: Stronger Safety and Security Guarantees Without Sacrificing Utility. arXiv:2604.15579 [cs.SE] doi:10.48550/arXiv.2604.15579

    2026 doi arXiv

  14. [21]

    Ruixuan Huang, Qingyue Wang, Hantao Huang, Yudong Gao, Dong Chen, Shuai Wang, and Wei Wang. 2025. RepetitionCurse: Measuring and Under- standing Router Imbalance in Mixture-of-Experts LLMs under DoS Stress. arXiv:2512.23995 [cs.CR] https://arxiv.org/abs/2512.23995

    2025 arXiv

  15. [22]

    Invariant Labs. 2025. MCP Security Notification: Tool Poisoning Attacks. https: //invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks. Ac- cessed 2026

    2025

  16. [23]

    Adharsh Kamath, Sishen Zhang, Calvin Xu, Shubham Ugare, Gagandeep Singh, and Sasa Misailovic. 2025. Enforcing Temporal Constraints for LLM Agents. arXiv:2512.23738 doi:10.48550/arXiv.2512.23738

    2025 doi

  17. [24]

    2025.Potential Attack Surfaces in Agent2Agent (A2A) Protocol

    Keysight Technologies. 2025.Potential Attack Surfaces in Agent2Agent (A2A) Protocol. https://www.keysight.com/blogs/en/tech/nwvs/2025/05/28/potential- attack-surfaces-in-a2a

    2025

  18. [26]

    Donghyun Lee, Mo Tiwari, and Brando Miranda. 2026. Prompt Infection: LLM- to-LLM Prompt Injection within Multi-Agent Systems. InComputer Security. ES- ORICS 2025 International Workshops (Lecture Notes in Computer Science, Vol. 16232). Springer. doi:10.1007/978-3-032-16092-8_28

    2026 doi

  19. [27]

    2025.ACP Joins Forces with A2A Under the Linux Foundation’s LF AI & Data

    LF AI & Data Foundation. 2025.ACP Joins Forces with A2A Under the Linux Foundation’s LF AI & Data. https://lfaidata.foundation/communityblog/2025/08/ 29/acp-joins-forces-with-a2a-under-the-linux-foundations-lf-ai-data/

    2025

  20. [28]

    Qiqi Lin, Xiaoyang Ji, Shengfang Zhai, Qingni Shen, Zhi Zhang, Yuejian Fang, and Yansong Gao. 2025. Life-Cycle Routing Vulnerabilities of LLM Router. arXiv:2503.08704 [cs.CR] https://arxiv.org/abs/2503.08704

    2025 arXiv

  21. [29]

    Microsoft AI Red Team. 2026. Updating the Taxonomy of Failure Modes in Agentic AI Systems: What a Year of Red Teaming Taught Us. Microsoft Security Blog. https://www.microsoft.com/en-us/security/blog/2026/06/04/updating- taxonomy-failure-modes-agentic-ai-systems-year-red-teami...

    2026

  22. [30]

    Microsoft Security Response Center. 2025. CVE-2025-32711: Microsoft 365 Copi- lot Information Disclosure Vulnerability. Microsoft Security Update Guide. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711

    2025

  23. [31]

    Lesly Miculicich, Mihir Parmar, Hamid Palangi, Krishnamurthy Dj Dvijotham, Mirko Montanari, Tomas Pfister, and Long T. Le. 2025. VeriGuard: Enhancing LLM Agent Safety via Verified Code Generation. arXiv:2510.05156 doi:10.48550/ arXiv.2510.05156

    2025 doi

  24. [32]

    Tam Nguyen, Moses Ndebugre, and Dheeraj Arremsetty. 2026. Security Consid- erations for Multi-agent Systems. arXiv:2603.09002 [cs.CR] doi:10.48550/arXiv. 2603.09002

    2026 doi arXiv

  25. [33]

    OWASP Gen AI Security Project. 2025. Agentic AI: Threats and Mitigations. https://genai.owasp.org/initiatives/#agentic-security-initiative. Agentic Security Initiative. Accessed 2026

    2025

  26. [34]

    OWASP Gen AI Security Project. 2025. LLM10:2025 Unbounded Consumption. OWASP Top 10 for Large Language Model Applications. https://genai.owasp. org/llmrisk/llm102025-unbounded-consumption/

    2025

  27. [35]

    Pillar Security. 2025. New Vulnerability in GitHub Copilot and Cur- sor: How Hackers Can Weaponize Code Agents (Rules File Back- door). Pillar Security; MITRE ATLAS case study AML-CS0041. https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and- cursor-how-hack...

    2025

  28. [36]

    reversinglabs. 2025. Postmark-MCP: A Malicious MCP Package Exfiltrating Email. https://www.reversinglabs.com/blog/postmark-mcp-attack-takeaways. ACM AI Leadership Summit ’26, August 30–September 02, 2026, Atlanta, GA, USA Lotfi, Shanto, et al

    2025

  29. [37]

    Shoumik Saha, Kazem Faghih, and Soheil Feizi. 2026. Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry. arXiv:2605.11418 [cs.CR] https://arxiv.org/abs/2605.11418

    2026 arXiv

  30. [38]

    2026.A2A Protocol Security: Authenticating Agent-to-Agent Communi- cation

    SecureW2. 2026.A2A Protocol Security: Authenticating Agent-to-Agent Communi- cation. https://securew2.com/blog/a2a-protocol-security

    2026

  31. [39]

    Avital Shafran, Roei Schuster, Thomas Ristenpart, and Vitaly Shmatikov

  32. [40]

    Jiawen Shi, Zenghui Yuan, Guiyao Tie, Pan Zhou, Neil Zhenqiang Gong, and Lichao Sun. 2025. Prompt Injection Attack to Tool Selection in LLM Agents. arXiv:2504.19793 [cs.CR] https://arxiv.org/abs/2504.19793

    2025 arXiv

  33. [41]

    Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, and Dawn Song. 2026. Progent: Securing AI Agents with Privilege Control. arXiv:2504.11703 [cs.CR] https://arxiv.org/abs/2504.11703

    2026 arXiv

  34. [42]

    Haochun Tang, Yuliang Yan, Jiahua Lu, Huaxiao Liu, and Enyan Dai. 2026. Route to Rome Attack: Directing LLM Routers to Expensive Models via Adversarial Suffix Optimization. arXiv:2604.15022 [cs.CR] https://arxiv.org/abs/2604.15022

    2026 arXiv

  35. [43]

    2025.Linux Foundation Announces the Forma- tion of the Agentic AI Foundation (AAIF)

    The Linux Foundation. 2025.Linux Foundation Announces the Forma- tion of the Agentic AI Foundation (AAIF). Press release, 9 December

    2025

  36. [44]

    2025.Linux Foundation Launches the Agent2Agent Protocol Project to Enable Secure, Intelligent Communication Between AI Agents

    The Linux Foundation. 2025.Linux Foundation Launches the Agent2Agent Protocol Project to Enable Secure, Intelligent Communication Between AI Agents. Press release, 23 June 2025. https://www.linuxfoundation.org/press/linux- foundation-launches-the-agent2agent-protocol-project-t...

    2025

  37. [45]

    https://www.linuxfoundation.org/press/linux-foundation-announces-the- formation-of-the-agentic-ai-foundation

  38. [46]

    Poskitt, and Jun Sun

    Haoyu Wang, Christopher M. Poskitt, and Jun Sun. 2026. AgentSpec: Customiz- able Runtime Enforcement for Safe and Reliable LLM Agents. InProceedings of the 48th IEEE/ACM International Conference on Software Engineering (ICSE). arXiv:2503.18666

    2026 arXiv

  39. [47]

    The Linux Foundation. 2026. A2A Protocol Surpasses 150 Organizations, Lands in Major Cloud Platforms, and Sees Enterprise Production Use in First Year. Linux Foundation press release. https://www.linuxfoundation.org/press/a2a- protocol-surpasses-150-organizations-lands-in-majo...

    2026

  40. [48]

    Zihan Wang, Rui Zhang, Yu Liu, Wenshu Fan, Wenbo Jiang, Qingchuan Zhao, Hongwei Li, and Guowen Xu. 2025. MPMA: Preference Manipulation Attack Against Model Context Protocol. arXiv:2505.11154 [cs.CR] https://arxiv.org/abs/ 2505.11154

    2025

  41. [49]

    Poskitt, Jiali Wei, and Jun Sun

    Haoyu Wang, Christopher M. Poskitt, Jiali Wei, and Jun Sun. 2025. ProbGuard: Probabilistic Runtime Monitoring for LLM Agent Safety. arXiv:2508.00500 doi:10. 48550/arXiv.2508.00500

    2025 doi arXiv

  42. [50]

    Itay Yona, Ilia Shumailov, Jamie Hayes, and Nicholas Carlini. 2024. Stealing User Prompts from Mixture of Experts. arXiv:2410.22884 [cs.CR] https://arxiv.org/ abs/2410.22884

    2024 arXiv

  43. [51]

    Zhiyuan Xu, Joseph Gardiner, Sana Belguith, and Lichao Wu. 2026. RouteHijack: Routing-Aware Attack on Mixture-of-Experts LLMs. arXiv:2605.02946 [cs.CR] https://arxiv.org/abs/2605.02946

    2026 arXiv

  44. [52]

    Jiayi Zhou, Yang Sheng, Hantao Lou, Yaodong Yang, and Jie Fu. 2026. FormalJudge: A Neuro-Symbolic Paradigm for Agentic Oversight. arXiv:2602.11136 doi:10. 48550/arXiv.2602.11136

    2026 doi

  45. [53]

    Wenhui Zhang, Huiyu Xu, Zhibo Wang, Zhichao Li, Zeqing He, Xuelin Wei, and Kui Ren. 2026. RerouteGuard: Understanding and Mitigating Adversarial Risks for LLM Routing. arXiv:2601.21380 [cs.CR] https://arxiv.org/abs/2601.21380

    2026

  46. [55]

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2025. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models. In34th USENIX Security Symposium (USENIX Security 25). 3827–3844. doi:10.48550/arXiv.2402.07867

    2025 doi arXiv

  47. [2025]

    InConference on Language Modeling (COLM)

    Rerouting LLM Routers. InConference on Language Modeling (COLM). arXiv:2501.01818 [cs.CR] https://arxiv.org/abs/2501.01818

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.