Pith. sign in

REVIEW 3 major objections 6 minor 162 references

On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models

T0 review · 3 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A systematic review of 85 papers on agentic LLM security finds the field structurally imbalanced: 66% of work targets perception-layer attacks, only 4.7% targets action-layer attacks, and attack research outnumbers defense research by 3.9…

desk verdict The paper's headline ratios don't reproduce from its own tables; the taxonomy is useful but the quantitative synthesis needs major repair before it can be cited. read the letter →

arxiv 2608.10530 v1 pith:P4BIF5MY submitted 2026-08-11 cs.CR cs.AI

Md Jafrin Hossain , Mohammad Arif Hossain , Nirwan Ansari This is my paper · ORCID
classification cs.CRcs.AI
keywords agenticLLMsecuritypromptinjectionvulnerabilitytaxonomysystematicliteraturereviewaction-layervulnerabilitiesattack-defenseimbalancecode-executionagentscontainment
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Agentic large language models — systems that plan, call tools, run code, and keep memory — can trigger irreversible real-world actions when a reasoning step is compromised. This paper argues that the security research community is not studying the risk in proportion to its consequences. A systematic review of 85 papers (2023–2025) finds that 66% focus on perception-layer attacks such as prompt injection and jailbreaking, while only 4.7% study action-layer vulnerabilities like tool misuse, code injection, and sandbox escape — the failures that actually change system state. Attack research outnumbers defense research by 3.9 to 1, and code-execution agents receive 3.5% of attention despite being the highest-consequence deployment. The paper offers a four-layer architectural taxonomy and a seven-problem research agenda centered on containment.

What carries the argument

The load-bearing object is a four-layer architectural taxonomy — perception, brain, action, interaction — built by open-coding the 85-paper corpus into 13 vulnerability types, with every agent component assigned to exactly one layer by its primary function. The taxonomy's core move is to count, per layer, how many papers study that layer's vulnerabilities, which converts narrative review into quantitative gap analysis: the perception/action ratio, the attack/defense ratio, and the near-zero coverage of code-execution and embodied agents are all produced by this counting scheme. The companion mechanism is a systematic screening pipeline (743 records screened down to 85 studies) that defines the population the counts describe.

What would settle it

Re-run the same review with the full search strings, two independent coders on 100% of the corpus, and a pre-registered coding protocol; if the action-layer share rises above roughly 15% or the perception-layer share drops below 50%, the claimed fourteen-fold imbalance collapses. A cheaper check: take the 85 papers and count how many require a full execution environment (tools, code, sandbox) as part of their evaluation — if that number is large, the 'action layer is unstudied' claim is an artifact of how papers were classified.

Watch

Extended reading notes

Core claim

The central claim is that agentic LLM security research is structurally misaligned with real-world risk. Coding 85 retained papers by primary attack mechanism, the authors find that perception-layer vulnerabilities (direct and indirect prompt injection, jailbreaking, adversarial perturbations) appear in 65.9% of papers, while action-layer vulnerabilities (tool manipulation, function hijacking, code injection, sandbox escape) appear in only 4.7% — a fourteen-fold gap. Defense-focused papers number 12 against 47 attack-focused ones, a 3.9:1 ratio, and code-execution agents appear in just 3 (3.5%) papers while embodied agents appear in none. The authors attribute the imbalance to methodological accessibility: perception attacks can be studied black-box with API access, whereas action-layer attacks require full execution environments. They interpret the insecurity itself as architectural coupling: because agent layers feed one another, a compromise at any layer can propagate, so the field's singular focus on input filtering is misplaced, and containment boundaries across all four layers are what needs building.

Load-bearing premise

The ratios are only as good as the paper collection they count; the exact search strings used across the six databases are not reported, inclusion and exclusion decisions are summarized rather than documented per record, and only 17% of the corpus was independently coded by a second reviewer, so a different search or a different coder could shift the headline percentages.

Editorial extensions

If this is right

  • If the imbalance is real, defensive research priorities are inverted: the attack classes with the most irreversible consequences (code injection, sandbox escape, tool misuse) currently receive the least investigation.
  • Tool-augmented agents, at 12% of the corpus despite being the dominant production deployment pattern, are a pending security liability as their adoption scales.
  • The absence of standardized benchmarks and adaptive-adversary evaluation means published detection and defense numbers are not comparable across studies and likely overstate robustness.
  • Implementing the paper's seven open problems amounts to a containment strategy: sandboxing code execution, privilege separation for tools, runtime policy engines, human-in-the-loop governance, and authenticated inter-agent communication.
  • Because failures propagate across layers, input filtering alone cannot secure an agent; defenses must be placed at each architectural boundary, including the action layer where verification is currently absent.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 14-fold gap probably measures experimental convenience as much as genuine neglect: perception attacks need only an API, while action-layer research requires building full agent environments, so the ratio may narrow quickly once standardized execution-aware benchmarks become the norm.
  • A testable extension is to run the same coding scheme on the 2026 literature; if the action-layer share rises sharply, the imbalance is a lagging indicator, but if it stays below 10%, accessibility, not field maturity, is the binding constraint.
  • The taxonomy's component-based framing predicts that the next high-impact vulnerabilities will appear in the parts of the stack with no coverage at all — inter-agent message authentication and tool-invocation protocols — where the paper finds zero or near-zero studies.
  • The paper's own quality assessment rates real-world applicability as the weakest of its four quality dimensions, so many published defenses are unlikely to survive deployment and the reported success rates should be read as upper bounds.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This manuscript is a systematic literature review, conducted under PRISMA 2020 guidelines, of 85 papers (2023--2025) on security vulnerabilities in agentic large language models. The authors propose a four-layer architectural taxonomy (perception, brain, action, interaction) covering 13 vulnerability types, report quantitative imbalances in the literature—notably a 3.9:1 attack-to-defense ratio and a roughly 14-fold gap between perception-layer and action-layer research coverage—and identify seven open research problems centered on containment. The paper positions itself as the first PRISMA-based systematic review dedicated to agentic LLM security and claims to provide a component-based foundation for future defense research.

Significance. If the quantitative claims were internally consistent, this would be a valuable contribution. The paper is commendable for attempting a systematic, PRISMA-structured review of a rapidly emerging area, for reporting inter-coder reliability statistics (Cohen's kappa 0.88 and 0.93), and for offering a taxonomy that organizes vulnerabilities by architectural function rather than by attack name. The seven open problems, especially the security of code-execution and embodied agents, are reasonable and useful for shaping future research. However, the headline numerical claims—the 3.9:1 attack-to-defense ratio and the 14x perception/action gap—are not reproducible from the paper's own tables and narrative, and the missing search strings and per-record coding details prevent independent audit. The central contribution is therefore currently undermined by reporting inconsistencies that must be resolved before the quantitative conclusions can be accepted.

major comments (3)
  1. [Section 4.7, Table 4, Table 11] The layer-coverage figures are internally inconsistent. Section 4.7 states that 56 of 85 papers (66%) discuss perception-layer risks, 35 (41%) brain-layer risks, 4 (4.7%) action-layer risks, and 24 (28%) interaction-layer risks, and the abstract and Table 11 repeat these paper-level counts. However, Table 4 reports component-level occurrence counts that sum to 95 for the perception layer (12+15+26+42), 109 for the brain layer (24+21+41+23), 82 for the action layer (54+7+13+8), and 17 for the interaction layer (12+5). The table note states that these are occurrence counts and that a single paper can contribute to multiple counts, but the paper never defines how occurrence counts are converted to the paper-level percentages used in Section 4.7 and the abstract. In particular, the claim that action-layer vulnerabilities 'appear in only 4.7%' of papers is not auditable when Table 4 alone shows 82 action-layer occurrences. The authors should report both units explicitly—unique-paper primary-layer counts and component-occurrence counts—and reconcile the abstract's prevalence language with the table's counting convention.
  2. [Section 5.1, Section 6.1, Table 11, Section 7.1] The attack-to-defense ratio is not reproducible because the paper reports different defense counts in different places. Section 5.1 says 47 research papers (55.3%) focus on vulnerability discovery and attacks while 12 papers (14.1%) focus on defense and mitigation, yielding the headline 3.9:1 ratio; Table 11 repeats 47 and 12. Yet Section 6.1 states that the review identified 17 defense-focused studies (12 detection and 5 mitigation-only), and Section 7.1, Problem 4, refers to '10 detection methods vs 52 attacks' (a 5:1 ratio). These numbers cannot all describe the same corpus under one coding scheme. The authors must specify the mutually exclusive paper categories (attack, defense, framework, mitigation-only, detection-only), apply them consistently, and recompute the ratio; until then, the 3.9:1 claim in the abstract and conclusion is unsupported.
  3. [Section 2.4, Section 2.5] The review's reproducibility is insufficient for the strength of the quantitative claims. Section 2.4 describes the search strategy only at the level of query groups ('Group 1 AND Group 2 NOT Group 3') with illustrative terms, and it does not provide the full Boolean queries adapted to each of the six databases. PRISMA 2020 requires the complete search strategy, typically in an appendix or supplement, and the exclusion decisions are summarized only at the flow level (540 excluded at title/abstract, 71 at full-text) without per-record documentation. Because the inclusion criteria define the population from which every ratio in the paper is computed, the absence of these details is a load-bearing limitation. A supplement containing verbatim search strings, the full list of excluded records with reasons, and the coding protocol should be added.
minor comments (6)
  1. [Section 1.6] The organization paragraph states that the methodology is presented in Section 3, but the search and coding methodology actually appears in Sections 2.4--2.6; the cross-reference should be corrected.
  2. [Figure 4 caption] Figure 4 is described as a 'visual representation of Table 2,' but Table 2 maps existing agent frameworks to the four-layer taxonomy, while the figure appears to depict the vulnerability distribution in Table 3; the caption and table reference should be checked.
  3. [Table 1] Table 1 contains duplicate rows for references [81] and [125] with different years, which appears to be an editing artifact; the table should list each survey once with consistent metadata.
  4. [Section 7.1, Problem 4] The statement '10 detection methods vs 52 attacks' is not tied to any table or definition and does not match the 47 attack papers counted in Table 11; either define the unit of counting or correct the number.
  5. [Section 3.2] The text refers to 'LangeChain-based agents'; this should be 'LangChain-based agents.'
  6. [Section 1.3] The sentence 'This literature considered in this study spans January 2023 through December 2025' is ungrammatical; it should read 'The literature considered in this study spans...'.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the quantitative claims are direct tabulations of a coded corpus, and the apparent contradictions are internal-consistency issues, not reductions of outputs to inputs.

full rationale

This paper is a PRISMA-based systematic literature review, so its central quantitative claims (66% perception-layer papers, 4.7% action-layer papers, 3.9:1 attack-to-defense ratio) are counts of papers coded by the authors, not values derived from fitted parameters or from the taxonomy by definition. The four-layer taxonomy is described as an organizing framework developed through open coding, and the vulnerability types within layers were not predefined from the target percentages. No load-bearing self-citations or imported uniqueness theorems appear; the review positions itself against prior surveys without relying on the authors' own prior results. The main concerns identified in the paper and by the reader are internal consistency problems: Section 4.7 reports only 4 action-layer papers while Table 4 lists 82 action-layer component occurrences, and Section 5.1 uses 12 defense papers for the 3.9:1 ratio while Section 6.1 reports 17 defense-focused studies. These are discrepancies in how occurrence counts, primary-layer counts, and defense-paper counts were operationalized, and they affect the reliability of the headline ratios, but they do not make any derivation equivalent to its input by construction. The conclusion that research effort is misaligned with real-world risk is an interpretation layered on top of the counts, not a quantity fitted from or defined by those counts. Under the standard for circularity, the derivation chain is self-contained as a coding-and-counting exercise, even though its numerical backbone is not fully reproducible from the paper's own tables.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

No numerical fitting occurs in this review, so no free parameters exist. The paper relies on standard review methodology and its own layer taxonomy as the organizing frame; the taxonomy is a modeling choice, not an entity with independent evidence.

assumptions (3)
  • domain assumption PRISMA 2020 is a valid and appropriate framework for conducting and reporting this security literature review.
    The paper's entire contribution is framed as a PRISMA-compliant systematic review (Section 2.3); if PRISMA's reporting requirements are not fully met, the review's completeness claims weaken.
  • domain assumption The four-layer decomposition (perception, brain, action, interaction) is an exhaustive and meaningful partition of agentic LLM architecture for security analysis.
    Section 3.3 defines the four layers; the taxonomy and all quantitative layer counts depend on every paper being assignable to exactly one primary layer, which is asserted but not proven.
  • ad hoc to paper The inclusion criteria for 'agentic LLM security papers' (Section 1.3) define the correct population for measuring attack and defense imbalance.
    Papers that study LLM security without agentic behavior are excluded, which directly shapes the 3.9:1 attack-to-defense ratio and the layer percentages.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models." pith.science (2026). https://pith.science/paper/P4BIF5MY

@misc{pith2026260810530,
  author       = {Pith},
  title        = {Pith review of: On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/P4BIF5MY}},
  note         = {Machine review of arXiv:2608.10530}
}
read the original abstract

Large Language Models (LLMs) have undergone a shift from stateless conversational interfaces to autonomous agents capable of multi-step planning, tool invocation, code execution, and maintaining persistent memory. When these agents operate with real-world privileges---calling APIs, modifying files, and querying databases---a compromised reasoning step can trigger unauthorized data access, irreversible state changes, or cascading failures, yet the security research community has not kept pace. To quantify the state of the field, we conducted a systematic literature review under PRISMA 2020 guidelines across six databases, screening 743 records and retaining 85 papers (2023--2025) on agentic LLM security. Attack research outpaces defense work by 3.9:1. Perception-layer vulnerabilities (prompt injection, jailbreaking, adversarial perturbations) dominate, accounting for 66\% of papers, while action-layer vulnerabilities (tool misuse, code injection, sandbox escape) appear in only 4.7\%, misaligned with real-world risk. Code execution security accounts for 3.5\%, and tool-augmented agents 12\%. We contribute a four-layer taxonomy mapping 13 vulnerability types across perception, brain, action, and interaction layers, and identify seven open problems centered on containment. Agentic LLM insecurity stems from architectural coupling, where weak isolation allows vulnerabilities to propagate across layers.

Figures

Figures reproduced from arXiv: 2608.10530 by the authors.

Figure 1
Figure 1. Organization of the Paper towards the agential behavior of large language models, which includes autonomous task accomplishment, tool use, and long-horizon execution [156]. The first set of security research for large language models (LLMs) was initiated with the development and proliferation of large-scale, pre-trained language models [18]. Over a very short period, numerous surveys and empirical studies have ident… view at source ↗
Figure 2
Figure 2. Condensed PRISMA flow diagram of the study selection process. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Overall quality assessment distribution of the 85 included papers. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Heatmap of vulnerability distribution across architectural layers and agent types (visual representation of Table 2). [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Component-level vulnerability counts and perceived severity distribution. [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]
Figure 6
Figure 6. Figure 6: Distribution of vulnerability research across agentic architectural layers. [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]
Figure 7
Figure 7. Figure 7: Research frequency by primary vulnerability type. [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]
Figure 8
Figure 8. Figure 8: Ratio of attack-focused research to defense/detection-focused publications. [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]
Figure 9
Figure 9. Figure 9: Unified Security Stack for Agentic LLM Systems [PITH_FULL_IMAGE:figures/full_fig_p021_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

162 extracted references · 29 canonical work pages

  1. [125]

    Shang Wang, Tianqing Zhu, Bo Liu, Ming Ding, Dayong Ye, Wanlei Zhou, and Philip S. Yu. 2025. Unique security and privacy threats of large language models: a comprehensive survey.ACM Computing Surveys, 58, 4, 1–36. doi:10.1145/3764113

    doi:10.1145/3764113 2025

  2. [27]

    Zehang Deng, Yongjian Guo, Changzhou Han, Wanlun Ma, Junwu Xiong, Sheng Wen, and Yang Xiang. 2024. Ai agents under threat: a survey of key security challenges and future pathways.arXiv (Cornell University), (June 2024). doi:10.48550/arxiv.2406.02630

    doi:10.48550/arxiv.2406.02630 2024

  3. [28]

    Zehang Deng, Yongjian Guo, Changzhou Han, Wanlun Ma, Junwu Xiong, Sheng Wen, and Yang Xiang. 2025. AI agents under threat: a survey of key security challenges and future pathways.ACM Computing Surveys, 57, 7, 1–36. doi:10.1145/3716628

    doi:10.1145/3716628 2025

  4. [1]

    Sara Abdali, Richard Anarfi, CJ Barberan, and Jia He. 2024. Securing large language models: threats, vulnerabilities and responsible practices. arXiv (Cornell University), (Mar. 2024). doi:10.48550/arxiv.2403.12503

    arXiv doi:10.48550/arxiv.2403.12503 2024

  5. [2]

    Alsharif Abuadbba, Chris Hicks, Kristen Moore, Vasilios Mavroudis, Burak Hasırcıoglu, Diksha Goel, and Paul Jennings. 2025. From promise to peril: rethinking cybersecurity red and blue teaming in the age of llms.arXiv (Cornell University), (June 2025). doi:10.48550/arxiv.2506.13434. Manuscript submitted to ACM On Understanding, Identifying, and Mitigating...

    arXiv doi:10.48550/arxiv.2506.13434 2025

  6. [3]

    IBRAHIM ADABARA, Bashir Olaniyi Sadiq, Aliyu Nuhu Shuaibu, Yale Ibrahim Danjuma, and Maninti Venkateswarlu. 2025. Trustworthy agentic ai systems: a cross-layer review of architectures, threat models, and governance strategies for real-world deployment. (Sept. 2025). doi:10.12688/f1000research.169927.1

    work page doi:10.12688/f1000research.169927.1 2025

  7. [4]

    Mohamad Abou Ali and Fadi Dornaika. 2025. Agentic ai: a comprehensive survey of architectures, applications, and future directions.arXiv (Cornell University), (Oct. 2025). doi:10.48550/arxiv.2510.25445

    work page doi:10.48550/arxiv.2510.25445 2025

  8. [5]

    Daniel Ayzenshteyn, Roy Weiss, and Yisroel Mirsky. 2024. The best defense is a good offense: countering LLM-Powered cyberattacks.arXiv preprint arXiv:2410.15396. doi:10.48550/arxiv.2410.15396

    work page Pith review arXiv doi:10.48550/arxiv.2410.15396 2024

Show all 162 references
  1. [6]

    Ajay Bandi, Bhavani Kongari, Roshini Naguru, Sahitya Pasnoor, and Sri Vidya Vilipala. 2025. The rise of agentic AI: a review of definitions, frameworks, architectures, applications, evaluation metrics, and challenges. (2025). doi:10.3390/fi17090404

    2025 doi

  2. [7]

    Sharmi Barua. 2024. Exploring autonomous agents through the lens of large language models: a review. (2024). doi:10.48550/arxiv.2404.04442

    2024 doi arXiv

  3. [8]

    Kaufman, Tyler Tracy, Vasil Georgiev, Dávid Matolcsi, Akbir Khan, and Buck Shlegeris

    Aryan Bhatt, Cody Rushing, Adam M. Kaufman, Tyler Tracy, Vasil Georgiev, Dávid Matolcsi, Akbir Khan, and Buck Shlegeris. 2025. Ctrl-z: controlling ai agents via resampling.arXiv (Cornell University), (Apr. 2025). doi:10.48550/arxiv.2504.10374

    2025 doi arXiv

  4. [9]

    Léo Boisvert, Abhay Puri, Chandra Kiran Reddy Evuru, Nicolas Chapados, Quentin Cappart, Alexandre Lacoste, Krishnamurthy Dvijotham, and Alexandre Drouin. 2025. Malice in agentland: down the rabbit hole of backdoors in the ai supply chain.arXiv (Cornell University), (Oct. 2025)...

    2025 doi arXiv

  5. [10]

    Valentyn Boreiko, Alexander Panfilov, Vaclav Voracek, Matthias Hein, and Jonas Geiping. 2024. A realistic threat model for large language model jailbreaks.arXiv (Cornell University), (Oct. 2024). doi:10.48550/arxiv.2410.16222

    2024 doi arXiv

  6. [11]

    Sarfraz Nawaz Brohi, Qurat-ul-ain Mastoi, N. Z. Jhanjhi, and Thulasyammal Ramiah Pillai. 2025. A research landscape of agentic AI and large language models: applications, challenges and future directions.Algorithms, 18, 8, 499. doi:10.3390/a18080499

    2025 doi

  7. [12]

    Robin Buchta, George Gkoktsis, Felix Heine, and Carsten Kleiner. 2024. Advanced persistent threat attack detection systems: a review of approaches, challenges, and trends. (Sept. 2024). doi:10.1145/3696014

    2024 doi

  8. [13]

    Verma, Atieh Taheri, Radha Kumaran, Zichen Chen, Jiaao Chen, Tobias Höllerer, and Misha Sra

    Arthur Caetano, Krishna K. Verma, Atieh Taheri, Radha Kumaran, Zichen Chen, Jiaao Chen, Tobias Höllerer, and Misha Sra. 2025. Agentic workflows for conversational human-ai interaction design.arXiv (Cornell University), (Jan. 2025). doi:10.48550/arxiv.2501.18002

    2025 doi arXiv

  9. [14]

    He Cao, Weidi Luo, Yu Wang, and Zijing Liu. 2024. Guide for defense (G4D): dynamic guidance for robust and balanced defense in large language models.arXiv preprint arXiv:2410.17922. doi:10.48550/arxiv.2410.17922

    2024 doi arXiv

  10. [15]

    Tri Cao et al. 2025. Vpi-bench: visual prompt injection attacks for computer-use agents.arXiv (Cornell University), (June 2025). doi:10.48550/arxiv .2506.02456

    2025 doi

  11. [16]

    Nandish Chattopadhyay, Abdul Basit, Bassem Ouni, and Muhammad Shafique. 2025. A survey of adversarial defenses in vision-based systems: categorization, methods and challenges.arXiv (Cornell University), (Mar. 2025). doi:10.48550/arxiv.2503.00384

    2025 doi arXiv

  12. [17]

    Sizhe Chen, Arman Zharmagambetov, Saeed Mahloujifar, Kamalika Chaudhuri, and Chuan Guo. 2024. Aligning llms to be robust against prompt injection.arXiv (Cornell University), (Oct. 2024). doi:10.48550/arxiv.2410.05451

    2024 doi arXiv

  13. [19]

    do anything now

    Wan Chong Choi, Cyril F. Chang, Sze May Ng, and Iek Chong Choi. 2025. A review of “do anything now” jailbreak attacks in large language models.Preprints.org. doi:10.20944/preprints202509.0081.v1

    2025

  14. [20]

    Mihai Christodorescu, Earlence Fernandes, Ashish Hooda, Somesh Jha, Johann Rehberger, and Khawaja Shams. 2025. Systems security foundations for agentic computing.arXiv preprint arXiv:2512.01295. doi:10.48550/arxiv.2512.01295

    2025 doi

  15. [21]

    Jing Cui, Yihua Xu, Zipeng Huang, Shuchang Zhou, Jianbin Jiao, and J H Zhang. 2024. Recent advances in attack and defense approaches of large language models.arXiv (Cornell University), (Sept. 2024). doi:10.48550/arxiv.2409.03274

    2024 doi arXiv

  16. [22]

    Yu Cui and Hongyang Du. 2025. MAD-Spear: a conformity-driven prompt injection attack on multi-agent debate systems.arXiv preprint arXiv:2507.13038. doi:10.48550/arxiv.2507.13038

    2025 doi arXiv

  17. [23]

    Lentati, Jason R

    Rishane Dassanayake, Mario Demetroudi, Jonathan Walpole, L. Lentati, Jason R. Brown, and Edward Young. 2025. Manipulation attacks by misaligned ai: risk analysis and safety case framework.arXiv (Cornell University), (July 2025). doi:10.48550/arxiv.2507.12872

    2025 doi arXiv

  18. [24]

    Shrestha Datta, Shahriar Kabir Nahin, Anshuman Chhabra, and Prasant Mohapatra. 2025. Agentic AI security: threats, defenses, evaluation, and open challenges.arXiv preprint arXiv:2510.23883. doi:10.48550/ARXIV.2510.23883

    2025 doi arXiv

  19. [25]

    Edoardo Debenedetti, Jie Lei Bianchi, Sierra Braunegg, Tushar Kuber, Alex Kurakin, Nicolas Papernot, and Florian Tramèr. 2024. AgentDojo: a dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. InProceedings of NeurIPS. doi:10.48550/arxiv.2406.13352

    2024 doi arXiv

  20. [26]

    Shuiguang Deng et al. 2025. Agentic services computing.arXiv (Cornell University), (Sept. 2025). doi:10.48550/arxiv.2509.24380

    2025 doi arXiv

  21. [29]

    Desai and Mark Riedl

    Deven R. Desai and Mark Riedl. 2025. Responsible ai agents.arXiv (Cornell University), (Feb. 2025). doi:10.48550/arxiv.2502.18359

    2025 doi arXiv

  22. [30]

    Christian Schroeder de Witt. 2025. Open challenges in multi-agent security: towards secure systems of interacting ai agents.arXiv (Cornell University), (May 2025). doi:10.48550/arxiv.2505.02077. Manuscript submitted to ACM 28 Md Jafrin Hossain, Mohammad Arif Hossain, and Nirwan Ansari

    2025 doi arXiv

  23. [31]

    Luigi Gianpio Di Maggio. 2025. Toward autonomous LLM-Based AI agents for predictive maintenance.Applied Sciences, 15, 21, 11515. doi:10.3390 /app152111515

    2025

  24. [32]

    Yi Dong et al. 2024. Safeguarding large language models: a survey.arXiv (Cornell University), (June 2024). doi:10.48550/arxiv.2406.02622

    2024 doi arXiv

  25. [33]

    Yingkai Dong, Zheng Li, Xiangtao Meng, Ning Yu, and Shanqing Guo. 2024. Jailbreaking text-to-image models with LLM-Based agents.arXiv preprint arXiv:2408.00523. doi:10.48550/arxiv.2408.00523

    2024 doi arXiv

  26. [34]

    Fadi Dornaika. 2025. Agentic AI: a comprehensive survey of architectures, applications, and future directions.Artificial Intelligence Review, 59, 1. doi:10.1007/s10462-025-11422-4

    2025 doi

  27. [35]

    Iddo Drori et al. 2025. Diverse inference and verification for advanced reasoning.arXiv (Cornell University), (Feb. 2025). doi:10.48550/arxiv.2502.0 9955

    2025 doi

  28. [36]

    Liam Dugan, Alyssa Hwang, Filip Trhlík, Josh Magnus Ludan, Andrew Zhu, Hainiu Xu, Daphne Ippolito, and Chris Callison-Burch. 2024. Raid: a shared benchmark for robust evaluation of machine-generated text detectors.arXiv (Cornell University), (May 2024). doi:10.48550/arxiv.2405.07940

    2024 doi arXiv

  29. [37]

    Demarcus Edwards and Danda B. Rawat. 2024. Agent deprogramming: finetuning away backdoor triggers for secure machine learning mod- els/LLMs. InProceedings of the IEEE International Conference on Communications and Networking (ICCCN). doi:10.1109/icccn61486.2024.10637573

    2024

  30. [38]

    Herman Errico, Jiquan Ngiam, and Shanita Sojan. 2025. Securing the model context protocol (mcp): risks, controls, and governance.arXiv (Cornell University), (Nov. 2025). doi:10.48550/arxiv.2511.20920

    2025 doi

  31. [39]

    Jonathan Evertz, Merlin Chlosta, Lea Schönherr, and Thorsten Eisenhofer. 2024. Whispers in the machine: confidentiality in agentic systems. arXiv preprint arXiv:2402.06922. doi:10.48550/ARXIV.2402.06922

    2024 doi arXiv

  32. [40]

    Zhiyuan Fang, Haotian Wang, et al. 2025. Breaking barriers: multi-agent prompt fusion for targeted jailbreaks.arXiv preprint arXiv:2503.00865. doi:10.48550/arxiv.2503.00865

    2025 doi arXiv

  33. [41]

    Mohammad Fasha et al. 2024. Mitigating the OWASP top 10 for large language models applications using intelligent agents. InProceedings of the IEEE International Conference on Communications and Computing Research (ICCR). doi:10.1109/iccr61006.2024.10532874

    2024 arXiv

  34. [42]

    Mohamad Fazelnia, Ahmet Okutan, and Mehdi Mirakhorli. 2022. Supporting ai/ml security workers through an adversarial techniques, tools, and common knowledge (ai/ml att&ck) framework.arXiv (Cornell University), (Nov. 2022). doi:10.48550/arxiv.2211.05075

    2022 doi arXiv

  35. [43]

    He Feng, Tianqing Zhu, Dayong Ye, Bo Liu, Wanlei Zhou, and Philip S. Yu. 2024. The emerged security and privacy of llm agent: a survey with case studies.arXiv (Cornell University), (July 2024). doi:10.48550/arxiv.2407.19354

    2024 doi

  36. [44]

    He Feng, Tianqing Zhu, Dayong Ye, Bo Liu, Wanlei Zhou, and Philip S. Yu. 2025. The emerged security and privacy of LLM agent: a survey with case studies.ACM Computing Surveys, 58, 6, 1–36. doi:10.1145/3773080

    2025 doi

  37. [45]

    Shangbin Feng, Herun Wan, Ningnan Wang, Zhaoxuan Tan, Minnan Luo, and Yulia Tsvetkov. 2024. What does the bot say? opportunities and risks of large language models in social media bot detection.arXiv (Cornell University), (Feb. 2024). doi:10.48550/arxiv.2402.00371

    2024 doi arXiv

  38. [46]

    Mohamed Amine Ferrag, Djallel Hamouda, and Mérouane Debbah. 2025. From prompt injections to protocol exploits: threats in LLM-Powered AI agents workflows.arXiv preprint arXiv:2506.23260. doi:10.48550/arxiv.2506.23260

    2025 doi

  39. [47]

    David Ferraiolo, Vijayalakshmi Atluri, and Serban I. Gavrila. 2010. The policy machine: a novel architecture and framework for access control policy specification and enforcement.Journal of Systems Architecture, 57, (May 2010), 412–424, 4, (May 2010). doi:10.1016/j.sysarc.2010.04.005

    2010 doi

  40. [48]

    Tao Gan and Qiong Sun. 2025. RAG-MCP: mitigating prompt bloat in LLM tool selection via retrieval-augmented generation.arXiv preprint arXiv:2505.03275. doi:10.48550/arxiv.2505.03275

    2025 doi arXiv

  41. [50]

    Yuyou Gan et al. 2024. Navigating the risks: a survey of security, privacy, and ethics threats in llm-based agents.arXiv (Cornell University), (Nov. 2024). doi:10.48550/arxiv.2411.09523

    2024 doi arXiv

  42. [51]

    Soham Ghosh and Gaurav Mittal. 2025. Agentic AI systems in electrical power systems engineering.arXiv preprint arXiv:2511.14478

    2025

  43. [52]

    Shanshan Han, Qifan Zhang, Yuhang Yao, et al. 2024. LLM multi-agent systems: challenges and open problems.arXiv preprint arXiv:2402.03578. doi:10.48550/arxiv.2402.03578

    2024 doi arXiv

  44. [53]

    Jianliang He, Siyu Chen, Fengzhuo Zhang, and Zhuoran Yang. 2024. From words to actions: unveiling the theoretical underpinnings of LLM-Driven autonomous systems.arXiv preprint arXiv:2405.19883. doi:10.48550/arxiv.2405.19883

    2024 doi arXiv

  45. [54]

    Pengfei He, Yue Xing, Jonathan Li, et al. 2025. Comprehensive vulnerability analysis is necessary for trustworthy LLM-MAS.arXiv preprint arXiv:2506.01245. doi:10.48550/arxiv.2506.01245

    2025 doi

  46. [55]

    Yifeng He, Ethan Wang, Yuyang Rong, Zifei Cheng, and Hao Chen. 2024. Security of AI agents.arXiv preprint arXiv:2406.08689. doi:10.48550/arxi v.2406.08689

    2024 doi arXiv

  47. [56]

    Hanbin Hong, Shuyi Feng, Nima Naderloui, Shenao Yan, Jingyu Zhang, Biying Liu, Ali Arastehfard, Heqing Huang, and Hong Yuan. 2025. Sok: taxonomy and evaluation of prompt security in large language models.arXiv (Cornell University), (Oct. 2025). doi:10.48550/arxiv.2510.15476

    2025 doi arXiv

  48. [57]

    Qiang Hu, Xiaofei Xie, Sen Chen, and Lei Ma. 2024. Large language model supply chain: open problems from the security perspective.arXiv (Cornell University), (Nov. 2024). doi:10.48550/arxiv.2411.01604

    2024 doi arXiv

  49. [58]

    Huang et al

    Y. Huang et al. 2025. On the trustworthiness of generative foundation models: guideline, assessment, and perspective.arXiv (Cornell University), (Feb. 2025). doi:10.48550/arxiv.2502.14296

    2025 doi arXiv

  50. [59]

    Zixuan Huang, Jiawei Chen, Zhipeng Zhang, and Chia-Mu Yu. 2024. Prompting the unseen: detecting hidden backdoors in black-box models. arXiv (Cornell University), (Nov. 2024). doi:10.48550/arxiv.2411.09540. Manuscript submitted to ACM On Understanding, Identifying, and Mitigati...

    2024 doi arXiv

  51. [60]

    Strahinja Janjusevic, Anna Baron Garcia, and Sohrob Kazerounian. 2025. Hiding in the AI traffic: abusing MCP for LLM-Powered agentic red teaming.arXiv preprint arXiv:2511.15998. doi:10.48550/arxiv.2511.15998

    2025 doi

  52. [61]

    Pappas, Hamed Hassani, Shuicheng Yan, Eric Wong, and Shiyu Chang

    Jiabao Ji, Bairu Hou, Alexander Robey, George J. Pappas, Hamed Hassani, Shuicheng Yan, Eric Wong, and Shiyu Chang. 2024. Defending large language models against jailbreak attacks via semantic smoothing.arXiv (Cornell University), (Feb. 2024). doi:10.48550/arxiv.2402.16192

    2024 doi arXiv

  53. [62]

    Yuqi Jia, Zhujun Shao, Yupei Liu, Jinyuan Jia, Dawn Song, and Neil Zhenqiang Gong. 2025. A critical evaluation of defenses against prompt injection attacks.arXiv (Cornell University), (May 2025). doi:10.48550/arxiv.2505.18333

    2025 doi arXiv

  54. [63]

    Yu-Gang Jiang, Xingjun Ma, et al. 2025. Safety at scale: a comprehensive survey of large model safety.SuperIntelligence: Robotics, Safety and Alignment, 2, 2. doi:10.70777/si.v2i2.14609

    2025 doi

  55. [64]

    Daniel Jones et al. 2025. A systematization of security vulnerabilities in computer use agents.arXiv (Cornell University), (July 2025). doi:10.48550 /arxiv.2507.05445

    2025 doi arXiv

  56. [65]

    Tianjie Ju et al. 2024. Flooding spread of manipulated knowledge in LLM-Based multi-agent communities.arXiv preprint arXiv:2407.07791. doi:10.48550/arxiv.2407.07791

    2024 doi arXiv

  57. [66]

    Yubin Kim, Ken Gu, Chanwoo Park, et al. 2025. Towards a science of scaling agent systems.arXiv preprint arXiv:2512.08296. doi:10.48550/arxiv.25 12.08296

    2025 doi arXiv

  58. [67]

    Mikołaj Kniejski, Matthieu David, Jason Hoelscher-Obermaier, Christian Schroeder de Witt, and Esben Kran. 2025. Multi-agent security tax: trading off security and collaboration capabilities in multi-agent systems.arXiv (Cornell University), (Feb. 2025). doi:10.48550/arxiv.2502.19145

    2025 doi arXiv

  59. [68]

    Andrei Kucharavy, Z. M. Schillaci, Loïc Maréchal, Maxime Würsch, Ljiljana Dolamic, Remi Sabonnadiere, Dimitri Percia David, Alain Mermoud, and Vincent Lenders. 2023. Fundamentals of generative large language models and perspectives in cyber-defense.arXiv (Cornell University), ...

    2023 doi arXiv

  60. [69]

    Kulkarni and Assaf Namer

    P. Kulkarni and Assaf Namer. 2025. Temporal context awareness: a defense framework against multi-turn manipulation attacks on large language models.arXiv (Cornell University), (Mar. 2025). doi:10.48550/arxiv.2503.15560

    2025 doi arXiv

  61. [70]

    Sunwoo Lee, Ji-Hoon Hwang, Yonghyeon Jo, and Seungyul Han. 2025. Wolfpack adversarial attack for robust multi-agent reinforcement learning. arXiv (Cornell University), (Feb. 2025). doi:10.48550/arxiv.2502.02844

    2025 doi arXiv

  62. [71]

    Gaotang Li, Ting-Wei Li, and Xuying Ning. 2025. Mind the agent: a comprehensive survey on large language model-based agent safety

    2025

  63. [72]

    Li and Benjamin C

    Miles Q. Li and Benjamin C. M. Fung. 2025. Security concerns for large language models: a survey.arXiv preprint arXiv:2505.18889. doi:10.48550/a rxiv.2505.18889

    2025 doi arXiv

  64. [73]

    Li et al

    X. Li et al. 2024. Targeting the core: a simple and effective method to attack RAG-based agents via direct LLM manipulation.arXiv preprint arXiv:2412.04415. doi:10.48550/arxiv.2412.04415

    2024 doi arXiv

  65. [74]

    Yuxi Li, Zijing Zhang, Kailong Wang, Ling Shi, and Haoyu Wang. 2024. Model-editing-based jailbreak against safety-aligned large language models.arXiv (Cornell University), (Dec. 2024). doi:10.48550/arxiv.2412.08201

    2024 doi arXiv

  66. [75]

    Zhongxing Liao, Kang Chen, Yuanjie Lin, K. Li, Y.Z. Liu, Hefeng Chen, Xingwang Huang, and Yuanhui Yu. 2025. Attack and defense techniques in large language models: a survey and new perspectives.arXiv (Cornell University), (May 2025). doi:10.48550/arxiv.2505.00976

    2025 doi arXiv

  67. [76]

    Huan Lin, Yingjie Lao, Tong Geng, Yu Tan, and Weijie Zhao. 2025. Uniguardian: a unified defense for detecting prompt injection, backdoor attacks and adversarial attacks in large language models.arXiv (Cornell University), (Feb. 2025). doi:10.48550/arxiv.2502.13141

    2025 doi arXiv

  68. [77]

    Aishan Liu et al. 2024. Compromising embodied agents with contextual backdoor attacks.arXiv preprint arXiv:2408.02882. doi:10.48550/arxiv.240 8.02882

    2024 doi arXiv

  69. [79]

    Bang Liu et al. 2025. Advances and challenges in foundation agents: from brain-inspired intelligence to evolutionary, collaborative, and safe systems.arXiv (Cornell University), (Mar. 2025). doi:10.48550/arxiv.2504.01990

    2025 doi arXiv

  70. [80]

    Xiaogeng Liu, Zhiyuan Yu, Yizhe Zhang, Ning Zhang, and Chaowei Xiao. 2024. Automatic and universal prompt injection attacks against large language models.arXiv (Cornell University), (Mar. 2024). doi:10.48550/arxiv.2403.04957

    2024 doi arXiv

  71. [81]

    Xingjun Ma, Yifeng Gao, Yixu Wang, et al. 2025. Safety at scale: a comprehensive survey of large model and agent safety.Foundations and Trends in Privacy and Security, 8, 254–469. doi:10.1561/3300000051

    2025 doi

  72. [83]

    Tula Masterman, Sandi Besen, Mason Sawtell, and Alex Chao. 2024. The landscape of emerging ai agent architectures for reasoning, planning, and tool calling: a survey.arXiv (Cornell University), (Apr. 2024). doi:10.48550/arxiv.2404.11584

    2024 doi arXiv

  73. [84]

    Federico Mazzone, Ahmad Al Badawi, et al. 2024. Investigating privacy attacks in the gray-box setting.arXiv preprint arXiv:2409.17283. doi:10.485 50/arxiv.2409.17283

    2024 doi arXiv

  74. [85]

    McIntosh, Teo Sušnjak, Tong Liu, Paul Watters, and Malka N

    Timothy R. McIntosh, Teo Sušnjak, Tong Liu, Paul Watters, and Malka N. Halgamuge. 2024. Inadequacies of large language model benchmarks in the era of generative artificial intelligence.arXiv (Cornell University), (Feb. 2024). doi:10.48550/arxiv.2402.09880

    2024 doi arXiv

  75. [86]

    Miller, Zhen Xiang, and George Kesidis

    David J. Miller, Zhen Xiang, and George Kesidis. 2022. Adversarial learning in statistical classification: a comprehensive review of defenses against attacks. (Feb. 2022). doi:10.48550/arxiv.1904.06292

    2022 doi arXiv

  76. [87]

    Lingbo Mo, Zeyi Liao, Boyuan Zheng, Yu Su, Chaowei Xiao, and Huan Sun. 2024. A trembling house of cards? mapping adversarial attacks against language agents.arXiv preprint arXiv:2402.10196. doi:10.48550/arxiv.2402.10196. Manuscript submitted to ACM 30 Md Jafrin Hossain, Mohamm...

    2024 doi arXiv

  77. [88]

    Gaëlle Molinari and Fabio Ciravegna. 2025. Towards pervasive distributed agentic generative AI: a state of the art.arXiv preprint arXiv:2506.13324. doi:10.48550/arxiv.2506.13324

    2025 doi

  78. [89]

    Honglin Mu et al. 2024. Stealthy jailbreak attacks on large language models via benign data mirroring.arXiv (Cornell University), (Oct. 2024). doi:10.48550/arxiv.2410.21083

    2024 doi arXiv

  79. [90]

    Vineeth Sai Narajala and Om Narayan. 2025. Securing agentic AI: a comprehensive threat model and mitigation framework for generative AI agents.arXiv preprint arXiv:2504.19956. doi:10.48550/ARXIV.2504.19956

    2025 doi arXiv

  80. [91]

    Milad Nasr et al. 2025. The attacker moves second: stronger adaptive attacks bypass defenses against llm jailbreaks and prompt injections.arXiv (Cornell University), (Oct. 2025). doi:10.48550/arxiv.2510.09023

    2025 doi arXiv

  81. [92]

    Satyam Kumar Navneet and Joydeep Chandra. 2025. Rethinking autonomy: preventing failures in AI-Driven software engineering.arXiv preprint arXiv:2508.11824. doi:10.48550/arxiv.2508.11824

    2025 doi arXiv

  82. [93]

    Haitham Ameen Noman and Osama M. F. Abu-Sharkh. 2023. Code injection attacks in wireless-based internet of things (IoT): a comprehensive review and practical implementations. (2023). doi:10.3390/s23136067

    2023 doi

  83. [94]

    Simon Ostermann, Kevin Baum, Christoph Endres, Julia Masloh, and Patrick Schramowski. 2024. Soft begging: modular and efficient shielding of llms against prompt injection and jailbreaking based on prompt tuning.arXiv (Cornell University), (July 2024). doi:10.48550/arxiv.2407.03391

    2024 doi arXiv

  84. [95]

    Pan, Negar Arabzadeh, Riccardo Cogo, et al

    Melissa Z. Pan, Negar Arabzadeh, Riccardo Cogo, et al. 2025. Measuring agents in production.arXiv preprint arXiv:2512.04123. doi:10.48550/arxiv .2512.04123

    2025 doi arXiv

  85. [96]

    Devansh Pandya, Hitika Teckani, and Shreyas Sanjay Raybole. 2024. Limiting prompt bypass in llm-integrated applications.International Journal for Research in Applied Science and Engineering Technology, 12, (Dec. 2024), 2168–2183, 12, (Dec. 2024). doi:10.22214/ijraset.2024.66176

    2024

  86. [97]

    Ashwin Hebbar, Prateek Mittal, and Pramod Viswanath

    Atharv Singh Patlan, Peiyao Sheng, S. Ashwin Hebbar, Prateek Mittal, and Pramod Viswanath. 2025. Real AI agents with fake memories: fatal context manipulation attacks on Web3 agents.arXiv preprint arXiv:2503.16248. doi:10.48550/ARXIV.2503.16248

    2025 doi arXiv

  87. [98]

    Nikhil Patnaik, Joseph Hallett, and Awais Rashid. 2024. Saltzer & schroeder for 2030: security engineering principles in a world of ai.arXiv (Cornell University), (July 2024). doi:10.48550/arxiv.2407.05710

    2024 doi arXiv

  88. [99]

    Maya Pavlova, Erik Brinkman, Krithika Iyer, and Vítor Albiero. 2024. Automated red teaming with GOAT: the generative offensive agent tester. arXiv preprint arXiv:2410.01606. doi:10.48550/arxiv.2410.01606

    2024 doi arXiv

  89. [100]

    Rafael Pedro, Castro Daniel, and Rosso Paolo. 2024. Prompt infection: LLM-to-LLM prompt injection within multi-agent systems.arXiv preprint arXiv:2407.12926. doi:10.48550/arxiv.2407.12926

    2024 doi arXiv

  90. [101]

    Benji Peng et al. 2024. Jailbreaking and mitigation of vulnerabilities in large language models.arXiv (Cornell University), (Oct. 2024). doi:10.48550 /arxiv.2410.15236

    2024 doi arXiv

  91. [102]

    Fàbio Perez and Ian Ribeiro. 2022. Ignore previous prompt: attack techniques for language models.arXiv preprint arXiv:2211.09527. doi:10.48550/a rxiv.2211.09527

    2022 doi arXiv

  92. [103]

    Lorena Qendro, Sangwon Ha, de Jong Rene, and Partha Maji. 2022. Stochastic-shield: a probabilistic approach towards training-free adversarial defense in quantized cnns.arXiv (Cornell University), (Feb. 2022). doi:10.48550/arxiv.2105.06512

    2022 doi arXiv

  93. [104]

    Abhinav Rao, Sachin Vashistha, Atharva Naik, Somak Aditya, and Monojit Choudhury. 2023. Tricking llms into disobedience: formalizing, analyzing, and detecting jailbreaks.arXiv (Cornell University), (May 2023). doi:10.48550/arxiv.2305.14965

    2023 doi arXiv

  94. [105]

    Shaina Raza, Ranjan Sapkota, Manoj Karkee, and Christos Emmanouilidis. 2025. TRiSM for agentic AI: a review of trust, risk, and security management.arXiv preprint arXiv:2506.04133. doi:10.48550/arxiv.2506.04133

    2025 doi

  95. [106]

    Zhenzhen Ren, Zhenxing Qian, Yan Gao, Yu Shi, Shuxin Zheng, and J. He. 2025. GTM: simulating the world of tools for AI agents.arXiv preprint arXiv:2512.04535. doi:10.48550/arxiv.2512.04535

    2025 doi

  96. [107]

    Rivera et al

    Corban G. Rivera et al. 2024. Conceptagent: llm-driven precondition grounding and tree search for robust task planning and execution.arXiv (Cornell University), (Oct. 2024). doi:10.48550/arxiv.2410.06108

    2024 doi arXiv

  97. [108]

    Sippo Rossi, Alisia Marianne Michel, Raghava Rao Mukkamala, and Jason Bennett Thatcher. 2024. An early categorization of prompt injection attacks on large language models.arXiv (Cornell University), (Jan. 2024). doi:10.48550/arxiv.2402.00898

    2024 doi arXiv

  98. [109]

    Sager, Benjamin Meyer, Peng Yan, et al

    Pascal J. Sager, Benjamin Meyer, Peng Yan, et al. 2025. A comprehensive survey of agents for computer use: foundations, challenges, and future directions. doi:10.48550/ARXIV.2501.16150

    2025 doi arXiv

  99. [110]

    Zhen Shang and William Wei. 2025. Evolving security in llms: a study of jailbreak attacks and defenses.arXiv (Cornell University), (Apr. 2025). doi:10.48550/arxiv.2504.02080

    2025 doi

  100. [111]

    David Shapiro, Wangfan Li, Manuel Delaflor, and Carlos Toxtli. 2023. Conceptual framework for autonomous cognitive entities.arXiv (Cornell University), (Oct. 2023). doi:10.48550/arxiv.2310.06775

    2023 doi arXiv

  101. [113]

    Erfan Shayegani, Md Abdullah Al Mamun, Yu Fu, Pedram Zaree, Yue Dong, and Nael Abu-Ghazaleh. 2023. Survey of vulnerabilities in large language models revealed by adversarial attacks.arXiv (Cornell University), (Oct. 2023). doi:10.48550/arxiv.2310.10844

    2023 doi arXiv

  102. [114]

    Chongyang Shi et al. 2025. Lessons from defending gemini against indirect prompt injections, (Jan. 2025). doi:10.48550/ARXIV.2505.14534

    2025 doi arXiv

  103. [116]

    Dan Shi et al. 2024. Large language model safety: a holistic survey.arXiv (Cornell University), (Dec. 2024). doi:10.48550/arxiv.2412.17686. Manuscript submitted to ACM On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models 31

    2024 doi arXiv

  104. [117]

    Sudhir Shrestha, Chipiliro Banda, Amit Kumar Mishra, Fatiha Djebbar, and Deepak Puthal. 2025. Investigation of cybersecurity bottlenecks of ai agents in industrial automation.Computers, 14, (Oct. 2025), 456–456, 11, (Oct. 2025). doi:10.3390/computers14110456

    2025 doi

  105. [118]

    Aditi Singh, Abul Ehtesham, Saket Kumar, and Tala Talaei Khoei. 2025. Agentic retrieval-augmented generation: a survey on agentic RAG.arXiv preprint arXiv:2501.09136. doi:10.48550/arxiv.2501.09136

    2025 doi arXiv

  106. [119]

    Tobin South, Samuele Marro, Thomas Hardjono, Robert Mahari, Cedric Deslandes Whitney, Dazza Greenwood, Alan Chan, and Alex Pentland

  107. [120]

    Harold Triedman, Rishi Jha, and Vitaly Shmatikov. 2025. Multi-agent systems execute arbitrary malicious code.arXiv preprint arXiv:2503.12188. doi:10.48550/arxiv.2503.12188

    2025 doi arXiv

  108. [121]

    Simon Valentin, Jinmiao Fu, Gianluca Detommaso, Shaoyuan Xu, Giovanni Zappella, and Bryan Wang. 2024. Cost-effective hallucination detection for llms.arXiv (Cornell University), (July 2024). doi:10.48550/arxiv.2407.21424

    2024 doi arXiv

  109. [122]

    Lei Wang et al. 2024. A survey on large language model based autonomous agents.Frontiers of Computer Science, 18, (Mar. 2024), 6, (Mar. 2024). doi:10.1007/s11704-024-40231-1

    2024 doi

  110. [123]

    Mengxiao Wang, Yuxuan Zhang, and Guofei Gu. 2025. Promptsleuth: detecting prompt injection via semantic intent invariance.arXiv (Cornell University), (Aug. 2025). doi:10.48550/arxiv.2508.20890

    2025 doi

  111. [124]

    Shang Wang, Tianqing Zhu, Bo Liu, Ming Ding, Xu Guo, Dayong Ye, and Wanlei Zhou. 2024. Unique security and privacy threats of large language model: a comprehensive survey.arXiv (Cornell University), (June 2024). doi:10.48550/arxiv.2406.07973

    2024 doi

  112. [126]

    Shenao Wang, Yanjie Zhao, Xinyi Hou, and Haoyu Wang. 2024. Large language model supply chain: a research agenda.arXiv (Cornell University), (Apr. 2024). doi:10.48550/arxiv.2404.12736

    2024 doi arXiv

  113. [127]

    Tianchun Wang, Yuanzhou Chen, Zichuan Liu, Zhanwen Chen, Haifeng Chen, Xiang Zhang, and Wei Cheng. 2024. Humanizing the machine: proxy attacks to mislead llm detectors.arXiv (Cornell University), (Oct. 2024). doi:10.48550/arxiv.2410.19230

    2024 doi arXiv

  114. [128]

    Tianyang Wang et al. 2024. Deep learning model security: threats and defenses.arXiv (Cornell University), (Dec. 2024). doi:10.48550/arxiv.2412.08 969

    2024 doi

  115. [129]

    Wang, Sizhe Chen, Raghad Alkhudair, Basel Alomair, and David Wagner

    Y.-M. Wang, Sizhe Chen, Raghad Alkhudair, Basel Alomair, and David Wagner. 2025. Defending against prompt injection with datafilter.arXiv (Cornell University), (Oct. 2025). doi:10.48550/arxiv.2510.19207

    2025 doi

  116. [130]

    Yingxu Wang, Siwei Liu, Jinyuan Fang, and Zaiqiao Meng. 2025. EvoAgentX: an automated framework for evolving agentic workflows.arXiv preprint arXiv:2507.03616. doi:10.48550/arxiv.2507.03616

    2025 doi

  117. [131]

    Yuntao Wang, Yanghe Pan, Shaolong Guo, and Zhou Su. 2025. Security of internet of agents: attacks and countermeasures.arXiv (Cornell University), (May 2025). doi:10.48550/arxiv.2505.08807

    2025 doi arXiv

  118. [132]

    Luan, Jiawen Kang, and Dusit Niyato

    Yuntao Wang, Yanghe Pan, Zhou Su, Yi Deng, Quan Zhao, Linkang Du, Tom H. Luan, Jiawen Kang, and Dusit Niyato. 2025. Large model based agents: state-of-the-art, cooperation paradigms, security and privacy, and future trends.IEEE Communications Surveys & Tutorials, (Jan. 2025), ...

    2025

  119. [133]

    Yuntao Wang, Yanghe Pan, Quan Zhao, Yi Deng, Zhou Su, Linkang Du, and Tom H. Luan. 2024. Large model agents: state-of-the-art, cooperation paradigms, security and privacy, and future trends.arXiv (Cornell University), (Sept. 2024). doi:10.48550/arxiv.2409.14457

    2024 doi arXiv

  120. [134]

    Zhijie Wang, Zhehua Zhou, Jiayang Song, Yuheng Huang, Zhan Shu, and Lei Ma. 2024. Towards testing and evaluating vision-language-action models for robotic manipulation: an empirical study.arXiv (Cornell University), (Sept. 2024). doi:10.48550/arxiv.2409.12894

    2024 doi arXiv

  121. [135]

    Emily Wenger, Josephine Passananti, Arjun Nitin Bhagoji, Yuanshun Yao, Hai-Tao Zheng, and Ben Y. Zhao. 2021. Backdoor attacks against deep learning systems in the physical world. In (June 2021). doi:10.1109/cvpr46437.2021.00614

    2021

  122. [136]

    Chen Wu, Jing Yu Koh, Ruslan Salakhutdinov, Daniel Fried, and Aditi Raghunathan. 2024. Dissecting adversarial robustness of multimodal LM agents.arXiv preprint arXiv:2406.12814. doi:10.48550/arxiv.2406.12814

    2024 doi arXiv

  123. [137]

    Fangzhou Wu, Shutong Wu, Yulong Cao, and Chaowei Xiao. 2024. WIPI: a new web threat for LLM-Driven web agents.arXiv preprint arXiv:2402.16965. doi:10.48550/arxiv.2402.16965

    2024 doi arXiv

  124. [138]

    Xing Wu, Minghao Li, Mohan Li, and Meng Han. 2025. Towards robust and secure embodied ai: a survey on vulnerabilities and attacks.arXiv (Cornell University), (Feb. 2025). doi:10.48550/arxiv.2502.13175

    2025 doi arXiv

  125. [139]

    Yaxiong Wu, Sheng Liang, Chen Zhang, et al. 2025. From human memory to AI memory: a survey on memory mechanisms in the era of LLMs. arXiv preprint arXiv:2504.15965. doi:10.48550/arxiv.2504.15965

    2025 doi arXiv

  126. [140]

    Zhengxian Wu, Juan Wen, Wanli Peng, and Haowei Chang. 2025. SLIP: soft label mechanism and key-extraction-guided CoT-based defense against instruction backdoor in APIs.arXiv preprint arXiv:2508.06153. doi:10.48550/arxiv.2508.06153

    2025 doi arXiv

  127. [141]

    Ping Xia, Kai Zeng, Jiaqi Liu, Can Qin, and Fang Wu. 2025. Agent0: unleashing self-evolving agents from zero data via tool-integrated reasoning. arXiv preprint arXiv:2511.16043. doi:10.48550/arxiv.2511.16043

    2025 doi

  128. [142]

    Xu, Yufan Song, Boxuan Li, et al

    Frank F. Xu, Yufan Song, Boxuan Li, et al. 2024. TheAgentCompany: benchmarking LLM agents on consequential real world tasks.arXiv preprint arXiv:2412.14161. doi:10.48550/arxiv.2412.14161

    2024 doi arXiv

  129. [143]

    Haiyang Xu, Shenao Wang, Ningke Li, et al. 2025. Large language models for cyber security: a systematic literature review.ACM Transactions on Software Engineering and Methodology. doi:10.1145/3769676. Manuscript submitted to ACM 32 Md Jafrin Hossain, Mohammad Arif Hossain, and...

    2025 doi

  130. [144]

    Haowen Xu, Jinghui Yuan, Anye Zhou, et al. 2024. GenAI-powered multi-agent paradigm for smart urban mobility.arXiv preprint arXiv:2409.00494. doi:10.48550/arxiv.2409.00494

    2024 doi arXiv

  131. [145]

    He Xu, Di Wu, Yan Zhai, and Kun Sun. 2025. Sentinelagent: graph-based anomaly detection in multi-agent systems.arXiv (Cornell University), (May 2025). doi:10.48550/arxiv.2505.24201

    2025 doi arXiv

  132. [146]

    Ruiyao Xu and Kaize Ding. 2024. Large language models for anomaly and out-of-distribution detection: a survey.arXiv (Cornell University), (Sept. 2024). doi:10.48550/arxiv.2409.01980

    2024 doi arXiv

  133. [147]

    Li, Chenhao Lin, Zhengyu Zhao, Chao Shen, and Tianwei Zhang

    Yulong Yang, Xinshan Yang, S. Li, Chenhao Lin, Zhengyu Zhao, Chao Shen, and Tianwei Zhang. 2024. Security matrix for multimodal agents on mobile devices: a systematic and proof of concept study.arXiv preprint arXiv:2407.09295. doi:10.48550/arxiv.2407.09295

    2024 doi arXiv

  134. [148]

    Zhuoyi Yang and I. Harris. 2025. Logllama: transformer-based log anomaly detection with llama.arXiv (Cornell University), (Mar. 2025). doi:10.48550/arxiv.2503.14849

    2025 doi arXiv

  135. [149]

    Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. 2022. ReAct: synergizing reasoning and acting in language models.arXiv preprint arXiv:2210.03629. doi:10.48550/arxiv.2210.03629

    2022 doi arXiv

  136. [150]

    Andrew Yeo and Daiwoo Choi. 2025. Multimodal prompt injection attacks: risks and defenses for modern llms.arXiv (Cornell University), (Sept. 2025). doi:10.48550/arxiv.2509.05883

    2025 doi arXiv

  137. [151]

    Miao Yu et al. 2024. LLM-Virus: evolutionary jailbreak attack on large language models.arXiv preprint arXiv:2501.00055. doi:10.48550/arxiv.2501.0 0055

    2024 doi arXiv

  138. [152]

    Mohammad Zahid and Taran Singh Bharati. 2025. Enhancing cybersecurity in IoT systems: a hybrid deep learning approach for real-time attack detection.Discover Internet of Things, 5, 1. doi:10.1007/s43926-025-00156-y

    2025 doi

  139. [153]

    IGI Global, 277–300

    2024.Large language models in cybersecurity. IGI Global, 277–300. doi:10.4018/979-8-3373-1102-9.ch009

    2024 doi

  140. [154]

    Yifan Zeng, Yiran Wu, Xiao Zhang, Huazheng Wang, and Qingyun Wu. 2024. AutoDefense: multi-agent LLM defense against jailbreak attacks. arXiv preprint arXiv:2403.04783. doi:10.48550/arxiv.2403.04783

    2024 doi arXiv

  141. [155]

    Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. InjecAgent: benchmarking indirect prompt injections in tool-integrated LLM agents. InFindings of the Association for Computational Linguistics: ACL 2024. doi:10.48550/arxiv.2403.02691

    2024 doi arXiv

  142. [156]

    Boyang Zhang, Yicong Tan, Yun Shen, Ahmed Salem, Michael Backes, Savvas Zannettou, and Yang Zhang. 2024. Breaking agents: compromising autonomous LLM agents through malfunction amplification.arXiv preprint arXiv:2407.20859. doi:10.48550/arxiv.2407.20859

    2024 doi arXiv

  143. [157]

    Hanrong Zhang, Jingyuan Huang, Kai Mei, Yifei Yao, Zhenting Wang, Chenlu Zhan, Hongwei Wang, and Yongfeng Zhang. 2024. Agent security bench (asb): formalizing and benchmarking attacks and defenses in llm-based agents.arXiv (Cornell University), (Oct. 2024). doi:10.48550/arxiv....

    2024 doi

  144. [158]

    Bu, Hui Wen, Yu Chen, Lun Li, and Hongsong Zhu

    Jie Zhang, H. Bu, Hui Wen, Yu Chen, Lun Li, and Hongsong Zhu. 2024. When LLMs meet cybersecurity: a systematic literature review.arXiv preprint arXiv:2405.03644. doi:10.48550/arxiv.2405.03644

    2024 doi arXiv

  145. [159]

    Kaiyuan Zhang, Zian Su, Pin-Yu Chen, Elisa Bertino, Xiangyu Zhang, and Ninghui Li. 2025. Llm agents should employ security principles.arXiv (Cornell University), (May 2025). doi:10.48550/arxiv.2505.24019

    2025 doi arXiv

  146. [160]

    Wenlin Zhang, Xiaopeng Li, Yingyi Zhang, et al. 2025. Deep research: a survey of autonomous research agents.arXiv preprint arXiv:2508.12752. doi:10.48550/arxiv.2508.12752

    2025 doi arXiv

  147. [161]

    Xiaoyu Zhang, Cen Zhang, Tianlin Li, Yihao Huang, Xiaojun Jia, Xiaofei Xie, Yang Liu, and Chao Shen. 2023. Jailguard: a universal detection framework for llm prompt-based attacks.arXiv (Cornell University), (Dec. 2023). doi:10.48550/arxiv.2312.10766

    2023 doi arXiv

  148. [162]

    Junhao Zheng, Jiahao Sun, Chenhao Lin, Zhengyu Zhao, Chen Ma, Chong Zhang, Cong Wang, Haijun Wang, and C. P. Shen. 2025. Revisiting adversarial patch defenses on object detectors: unified evaluation, large-scale dataset, and new insights.arXiv (Cornell University), (Aug. 2025)...

    2025 doi arXiv

  149. [163]

    Titzer, Heather Miller, and Phillip B

    Peter Yong Zhong, Siyuan Chen, Ruiqi Wang, McKenna McCall, Ben L. Titzer, Heather Miller, and Phillip B. Gibbons. 2025. Rtbas: defending llm agents against prompt injection and privacy leakage.arXiv (Cornell University), (Feb. 2025). doi:10.48550/arxiv.2502.08966

    2025 doi arXiv

  150. [164]

    Xuhui Zhou et al. 2024. Haicosystem: an ecosystem for sandboxing safety risks in human-ai interactions.arXiv (Cornell University), (Sept. 2024). doi:10.48550/arxiv.2409.16427

    2024 doi arXiv

  151. [165]

    Yujun Zhou et al. 2024. Defending jailbreak prompts via in-context adversarial game.arXiv preprint arXiv:2402.13148. doi:10.48550/arxiv.2402.13148

    2024 doi arXiv

  152. [166]

    Zhang, Yi Yang, and Yawei Luo

    Yifan Zhu, Chao Zhang, Xin Shi, X.J. Zhang, Yi Yang, and Yawei Luo. 2025. MASTER: multi-agent security through exploration of roles and topological structures.arXiv preprint arXiv:2505.18572. doi:10.48550/arxiv.2505.18572

    2025 doi arXiv

  153. [167]

    Shaked Zychlinski. 2025. A whole new world: creating a parallel-poisoned web only ai-agents can see.arXiv (Cornell University), (Aug. 2025). doi:10.48550/arxiv.2509.00124. Manuscript submitted to ACM

    2025 doi arXiv

  154. [2025]

    Authenticated delegation and authorized ai agents.arXiv (Cornell University), (Jan. 2025). doi:10.48550/arxiv.2501.09674

    2025 doi arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.