Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SoK: The Attack Surface of Agentic AI -- Tools, and Autonomy

Ali Dehghantanha, Sajad Homayoun

Abstract

Recent AI systems combine large language models with tools, external knowledge via retrieval-augmented generation (RAG), and even autonomous multi-agent decision loops. This agentic AI paradigm greatly expands capabilities - but also vastly enlarges the attack surface. In this systematization, we map out the trust boundaries and security risks of agentic LLM-based systems. We develop a comprehensive taxonomy of attacks spanning prompt-level injections, knowledge-base poisoning, tool/plug-in exploits, and multi-agent emergent threats. Through a detailed literature review, we synthesize evidence from 2023-2025, including more than 20 peer-reviewed and archival studies, industry reports, and standards. We find that agentic systems introduce new vectors for indirect prompt injection, code execution exploits, RAG index poisoning, and cross-agent manipulation that go beyond traditional AI threats. We define attacker models and threat scenarios, and propose metrics (e.g., Unsafe Action Rate, Privilege Escalation Distance) to evaluate security posture. Our survey examines defenses such as input sanitization, retrieval filters, sandboxes, access control, and "AI guardrails," assessing their effectiveness and pointing out the areas where protection is still lacking. To assist practitioners, we outline defensive controls and provide a phased security checklist for deploying agentic AI (covering design-time hardening, runtime monitoring, and incident response). Finally, we outline open research challenges in secure autonomous AI (robust tool APIs, verifiable agent behavior, supply-chain safeguards) and discuss ethical and responsible disclosure practices. We systematize recent findings to help researchers and engineers understand and mitigate security risks in agentic AI.

SoK: The Attack Surface of Agentic AI -- Tools, and Autonomy

Abstract

Recent AI systems combine large language models with tools, external knowledge via retrieval-augmented generation (RAG), and even autonomous multi-agent decision loops. This agentic AI paradigm greatly expands capabilities - but also vastly enlarges the attack surface. In this systematization, we map out the trust boundaries and security risks of agentic LLM-based systems. We develop a comprehensive taxonomy of attacks spanning prompt-level injections, knowledge-base poisoning, tool/plug-in exploits, and multi-agent emergent threats. Through a detailed literature review, we synthesize evidence from 2023-2025, including more than 20 peer-reviewed and archival studies, industry reports, and standards. We find that agentic systems introduce new vectors for indirect prompt injection, code execution exploits, RAG index poisoning, and cross-agent manipulation that go beyond traditional AI threats. We define attacker models and threat scenarios, and propose metrics (e.g., Unsafe Action Rate, Privilege Escalation Distance) to evaluate security posture. Our survey examines defenses such as input sanitization, retrieval filters, sandboxes, access control, and "AI guardrails," assessing their effectiveness and pointing out the areas where protection is still lacking. To assist practitioners, we outline defensive controls and provide a phased security checklist for deploying agentic AI (covering design-time hardening, runtime monitoring, and incident response). Finally, we outline open research challenges in secure autonomous AI (robust tool APIs, verifiable agent behavior, supply-chain safeguards) and discuss ethical and responsible disclosure practices. We systematize recent findings to help researchers and engineers understand and mitigate security risks in agentic AI.
Paper Structure (108 sections, 4 equations, 4 figures, 2 tables)

This paper contains 108 sections, 4 equations, 4 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Motivation and scope
  3. Stakes
  4. Emerging threats
  5. Contributions and approach
  6. Position within Prior Work
  7. Paper organization
  8. Background & System Model
  9. Agentic LLM Pipeline
  10. Trust Boundaries and TCB
  11. System assumptions
  12. Illustrative scenario
  13. Threat Model
  14. Adversary Classes
  15. Assets and Security Properties
  16. ...and 93 more sections

Figures (4)

  • Figure 1: Reference architecture with trust boundaries, TCB highlights, and numbered attack surfaces (AS1–AS10). AS numbers correspond to Section \ref{['subsec:attack_vectors']} and Table \ref{['tab:taxonomy_agentic_llm']}. Lock symbols indicate policy enforcement or security control points. Thick-bordered boxes denote components belonging to the Trusted Computing Base (TCB).
  • Figure 2: Causal paths from attacker content to unsafe actions; green dashed edges mark potential defense interdict points. P2 denotes an indirect prompt-injection path (defined in Section \ref{['subsec:attack_path']}).
  • Figure 3: Representative attack paths (P1--P5). Red arrows denote attacker-controlled or tainted flows, while black arrows represent normal system interactions.
  • Figure 4: Defense layers around the agentic core with high-level controls.