Agentic AI for 6G: A New Paradigm for Autonomous RAN Security Compliance
Sotiris Chatzimiltis, Mahdi Boloursaz Mashhadi, Mohammad Shojafar, Merouane Debbah, Rahim Tafazolli
TL;DR
The paper addresses securing next-generation RANs through agentic AI that leverages LLM-based agents and a retrieval-augmented generation pipeline to enforce security compliance against O-RAN and 3GPP standards. It proposes a unified framework combining compliance by design and compliance by evidence, demonstrated via a case study on static CU configuration compliance using a two-agent core plus a RAG tooling component. Results show that Agentic RAG improves compliance accuracy across multiple LLMs but incurs latency overhead, and that retrieval configuration substantially drives performance. The authors discuss challenges such as hallucinations and multi-vendor inconsistencies and propose telecom-specific foundation models and standardized evaluation as key directions for scalable, zero-touch, self-healing RAN security.
Abstract
Agentic AI systems are emerging as powerful tools for automating complex, multi-step tasks across various industries. One such industry is telecommunications, where the growing complexity of next-generation radio access networks (RANs) opens up numerous opportunities for applying these systems. Securing the RAN is a key area, particularly through automating the security compliance process, as traditional methods often struggle to keep pace with evolving specifications and real-time changes. In this article, we propose a framework that leverages LLM-based AI agents integrated with a retrieval-augmented generation (RAG) pipeline to enable intelligent and autonomous enforcement of security compliance. An initial case study demonstrates how an agent can assess configuration files for compliance with O-RAN Alliance and 3GPP standards, generate explainable justifications, and propose automated remediation if needed. We also highlight key challenges such as model hallucinations and vendor inconsistencies, along with considerations like agent security, transparency, and system trust. Finally, we outline future directions, emphasizing the need for telecom-specific LLMs and standardized evaluation frameworks.