SoK: Security Vulnerabilities in Agentic AI Systems
Abstract
Agentic AI systems extend large language models with tools,
retrieval, persistent memory, and multi-agent coordination, enabling
autonomous, long-horizon execution of complex tasks. However, these capabilities introduce new attack surfaces that existing LLM security frameworks do not capture systematically. We survey 71 papers (2022–2026)
and three production CVEs, organizing prior work into a five-layer taxonomy structured by execution boundaries: the input, external data, tool
and protocol, memory, and multi-agent layers. Our analysis reveals a
common structural root across all layers: untrusted content acts with
authority it was never granted, which we formalize as the violation of four
security invariants. We highlight the multi-agent layer as both the most
dangerous and least defended: current protocols track only the calling
agent, not the user whose authority is delegated, letting authority be
laundered through a trusted intermediary. To close this gap, we propose a
hardening model that reframes agent security as provenance-conditioned
authorization, separating the user from the agent acting on its behalf. We
conclude by outlining the key open challenges for building and deploying
secure agentic systems.
retrieval, persistent memory, and multi-agent coordination, enabling
autonomous, long-horizon execution of complex tasks. However, these capabilities introduce new attack surfaces that existing LLM security frameworks do not capture systematically. We survey 71 papers (2022–2026)
and three production CVEs, organizing prior work into a five-layer taxonomy structured by execution boundaries: the input, external data, tool
and protocol, memory, and multi-agent layers. Our analysis reveals a
common structural root across all layers: untrusted content acts with
authority it was never granted, which we formalize as the violation of four
security invariants. We highlight the multi-agent layer as both the most
dangerous and least defended: current protocols track only the calling
agent, not the user whose authority is delegated, letting authority be
laundered through a trusted intermediary. To close this gap, we propose a
hardening model that reframes agent security as provenance-conditioned
authorization, separating the user from the agent acting on its behalf. We
conclude by outlining the key open challenges for building and deploying
secure agentic systems.
