A Survey on Agentic Security: Applications, Threats and Defenses

2025/10/07 by Shahriar, Asif, Rahman, Md Nafiu, Ahmed, Sadif +2 · 3 citations
#Artificial Intelligence (cs.AI) #Computation and Language (cs.CL) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences

paper · doi:10.48550/arxiv.2510.06445

Abstract

In this work we present the first holistic survey of the agentic security landscape, structuring the field around three fundamental pillars: Applications, Threats, and Defenses. We provide a comprehensive taxonomy of over 160 papers, explaining how agents are used in downstream cybersecurity applications, inherent threats to agentic systems, and countermeasures designed to protect them. A detailed cross-cutting analysis shows emerging trends in agent architecture while revealing critical research gaps in model and modality coverage. A complete and continuously updated list of all surveyed papers is publicly available at https://github.com/kagnlp/Awesome-Agentic-Security.

Citations

• Breaking the Code: Security Assessment of AI Code Agents Through Systematic Jailbreaking Attacks
• Cloud Investigation Automation Framework (CIAF): An AI-Driven Approach to Cloud Forensics
• CORTEX: Collaborative LLM Agents for High-Stakes Alert Triage
• LISA Technical Report: An Agentic Framework for Smart Contract Auditing
• PSG-Agent: Personality-Aware Safety Guardrail for LLM-based Agents
• Agentic-AI Healthcare: Multilingual, Privacy-First Framework with MCP Agents
• Privacy in Action: Towards Realistic Privacy Mitigation and Evaluation for LLM-Powered Agents
• Architecting Resilient LLM Agents: A Guide to Secure Plan-then-Execute Implementations
• KubeIntellect: A Modular LLM-Orchestrated Agent Framework for End-to-End Kubernetes Management
• From CVE Entries to Verifiable Exploits: An Automated Multi-Agent Framework for Reproducing CVEs
• Locus: Agentic Predicate Synthesis for Directed Fuzzing
• LLM-driven Provenance Forensics for Threat Investigation and Detection
• Agentic Discovery and Validation of Android App Vulnerabilities
• Multi-Agent Penetration Testing AI for the Web
• CyberSleuth: Autonomous Blue-Team LLM Agent for Web Attack Forensics
• Secure Multi-LLM Agentic AI and Agentification for Edge General Intelligence by Zero-Trust: A Survey
• LLMs in the SOC: An Empirical Study of Human-AI Collaboration in Security Operations Centres
• Searching for Privacy Risks in LLM Agents via Simulation
• Advancing Autonomous Incident Response: Leveraging LLMs and Cyber Threat Intelligence
• ScamAgents: How AI Agents Can Simulate Human-Level Scam Calls
• Paper Summary Attack: Jailbreaking LLMs through LLM Safety Papers
• ExCyTIn-Bench: Evaluating LLM agents on Cyber Threat Investigation
• Enhancing Robustness of LLM-Driven Multi-Agent Systems through Randomized Smoothing
• On the Surprising Efficacy of LLMs for Penetration-Testing
• A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures
• Cloud Infrastructure Management in the Age of AI Agents
• SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks
• MalGEN: A Testbed for Modeling and Evaluating Malware Behaviors
• A Systematic Review of Poisoning Attacks Against Large Language Models
• To Protect the LLM Agent Against the Prompt Injection Attack with Polymorphic Prompt
• Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution
• Seven Security Challenges That Must be Solved in Cross-domain Multi-agent LLM Systems
• The Hidden Dangers of Browsing AI Agents
• AutoPentest: Enhancing Vulnerability Management With Autonomous LLM Agents
• AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents
• Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents
• ACE: A Security Architecture for LLM-Integrated App Systems
• Securing Agentic AI: A Comprehensive Threat Model and Mitigation Framework for Generative AI Agents
• Towards a HIPAA Compliant Agentic AI System in Healthcare
• DoomArena: A framework for Testing AI Agents Against Evolving Security Threats
• Progent: Programmable Privilege Control for LLM Agents
• AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents
• CVE-Bench: A Benchmark for AI Agents' Ability to Exploit Real-World Web Application Vulnerabilities
• Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents
• KNighter: Transforming Static Analysis with LLM-Synthesized Checkers
• SafeArena: Evaluating the Safety of Autonomous Web Agents
• ToolFuzz -- Automated Agent Tool Testing
• Memory Injection Attacks on LLM Agents via Query-Only Interaction
• Why Are Web AI Agents More Vulnerable Than Standalone LLMs? A Security Analysis
• Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents
• Reward Shaping to Mitigate Reward Hacking in RLHF
• ARACNE: An LLM-Based Autonomous Shell Pentesting Agent
• Red-Teaming LLM Multi-Agent Systems via Communication Attacks
• Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attacks
• Demonstrating specification gaming in reasoning models
• AGrail: A Lifelong Agent Guardrail with Effective and Adaptive Safety Detection
• D-CIPHER: Dynamic Collaborative Intelligent Multi-Agent System with Planner and Heterogeneous Executors for Offensive Security
• Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks
• Can LLMs Hack Enterprise Networks? --- RCR Package
• LLMSecConfig: An LLM-Based Approach for Fixing Software Container Misconfigurations
• Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety
• RepoAudit: An Autonomous LLM-Agent for Repository-Level Code Auditing
• VulnBot: Autonomous Penetration Testing for A Multi-Agent Collaborative Framework
• Refining Input Guardrails: Enhancing LLM-as-a-Judge Efficiency Through Chain-of-Thought Fine-Tuning and Alignment
• SmartLLM: Smart Contract Auditing using Custom Generative AI
• The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents
• Towards Action Hijacking of Large Language Model-based Agent
• BARTPredict: Empowering IoT Security with LLM-Driven Cyber Threat Prediction
• HackSynth: LLM Agent and Evaluation Framework for Autonomous Penetration Testing
• Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents
• PentestAgent: Incorporating LLM Agents to Automated Penetration Testing
• Pseudo-Conversation Injection for LLM Goal Hijacking
• Towards Automated Penetration Testing: Introducing LLM Benchmark, Analysis, and Improvements
• Enhancing Prompt Injection Attacks to LLMs via Poisoning Alignment
• AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
• AutoPenBench: Benchmarking Generative Agents for Penetration Testing
• Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
• Scaling Trends for Data Poisoning in LLMs
• AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases
• R²-Guard: Robust Reasoning Enabled LLM Guardrail via Knowledge-Enhanced Logical Reasoning
• LLMCloudHunter: Harnessing LLMs for Automated Extraction of Detection Rules from Cloud-Based CTI
• τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains
• Teams of LLM Agents can Exploit Zero-Day Vulnerabilities
• IRIS: LLM-Assisted Static Analysis for Detecting Security Vulnerabilities
• LLM Agents can Autonomously Exploit One-day Vulnerabilities
• AuditGPT: Auditing Smart Contracts with ChatGPT
• RepairAgent: An Autonomous, LLM-Based Agent for Program Repair
• Combining Fine-Tuning and LLM-based Agents for Intuitive Smart Contract Auditing with Justifications
• InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents
• A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models
• Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents
• InfoRM: Mitigating Reward Hacking in RLHF via Information-Theoretic Reward Modeling
• MART: Improving LLM Safety with Multi-round Automatic Red-Teaming
• Formally Specifying the High-Level Behavior of LLM-Based Agents
• Universal and Transferable Adversarial Attacks on Aligned Language Models
• Autonomous Tester Agent Benchmark
• Large Language Models
• Jailbroken: How Does LLM Safety Training Fail?
• Prompt Injection attack against LLM-integrated Applications
• Byzantine Robust Cooperative Multi-Agent Reinforcement Learning as a Bayesian Game
• Reflexion: Language Agents with Verbal Reinforcement Learning
• Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
• Toolformer: Language Models Can Teach Themselves to Use Tools
• Ignore Previous Prompt: Attack Techniques For Language Models
• Distributing Accountability, Not Capability: Phase Separation and the LLM Workflow Quadrant in Autonomous AI Agent Architectures
• Red Teaming Language Models with Language Models
• The Effects of Reward Misspecification: Mapping and Mitigating Misaligned Models

Cited by

• The Road of Adaptive AI for Precision in Cybersecurity
• PBFuzz: Agentic Directed Fuzzing for PoV Generation
• Authenticated Workflows: A Systems Approach to Protecting Agentic AI

Related

• Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges
• Systems Security Foundations for Agentic Computing
• Toward a Safe Internet of Agents
• Securing Agentic AI Systems -- A Multilayer Security Framework
• Agent Security is a Systems Problem