Technical Summary: A Survey on Agentic Security: Applications, Threats and Defenses

Problem Statement

The rapid integration of Large Language Model (LLM) agents into cybersecurity has created a fragmented research landscape. While agents offer autonomous capabilities for tasks ranging from penetration testing to incident response, their autonomy introduces novel attack surfaces that base model safety alignments do not reliably cover. Existing literature treats applications, threats, and defenses in isolation, failing to provide a unified account of how an agent's capabilities, vulnerabilities, and countermeasures interconnect. This lack of a holistic framework hinders the ability of researchers and practitioners to understand which threats are mitigated by current defenses and how dual-use capabilities (e.g., red-teaming agents) might be weaponized.

Methodology

The authors conducted a comprehensive survey of over 260 papers published between 2024 and 2026. The work is structured around three fundamental pillars:

1. Applications: Analyzing how agents are deployed in downstream cybersecurity tasks.
2. Threats: Cataloging inherent vulnerabilities and attack vectors specific to agentic systems.
3. Defenses: Examining countermeasures and hardening strategies.

Beyond cataloging, the authors performed a cross-cutting analysis across these pillars. They mapped papers to specific stages of the offensive and defensive security lifecycles, classified systems by autonomy levels and architectural paradigms (e.g., monolithic vs. planner-executor), analyzed foundation model usage and data modalities, and evaluated the fragmentation of benchmarking efforts. The analysis distinguishes between threats inherited from base LLMs, those amplified by the agentic framework, and those native to the agentic setting.

Key Contributions

1. Holistic Three-Pillar Taxonomy

The paper presents the first unified survey of agentic security, organizing the field into Applications, Threats, and Defenses. It provides a detailed taxonomy of 260+ papers, offering a structured view of the field that connects offensive capabilities with defensive needs.

2. Application Landscape Analysis

• Lifecycle Coverage: Research is heavily concentrated in stages with immediate feedback (vulnerability discovery, exploitation, detection, remediation). Stages requiring sustained stealth or long-term awareness, such as persistence and exfiltration, are largely unexplored in both offensive and defensive contexts.
• Autonomy Asymmetry: A significant gap exists between offensive and defensive agents. 88.1% of offensive systems operate at Level 3 autonomy (fully autonomous), whereas 100% of defensive systems require human-in-the-loop controls (Levels 0–2). Defensive agents function primarily as copilots, while offensive agents are optimized for end-to-end task completion.
• Dual-Use Nature: 55.3% of application-oriented systems expose capabilities that are directly offensive or dual-use. The paper highlights that red-teaming agents often lower the skill floor for attackers, reducing operational costs by 2.8x to 8.9x compared to human baselines and increasing scalability through parallel execution.

3. Threat Landscape Analysis

• Inherited vs. Native Threats: Approximately 67% of attacks are inherited from or amplified by the base LLM (e.g., prompt injection, jailbreaking), confirming that safety alignment degrades when tools and memory are added. Only 25% of threats are agent-native (e.g., inter-agent message compromise, plan hijacking).
• Attack Surface: The most attacked entry points are conversational inputs (user queries/system prompts) and autonomous interfaces (retrieved documents, tool responses). Conversely, inter-agent communication, persistent memory, and reflection outputs are the least studied surfaces.
• Failure Stages: Attacks predominantly target the perception and action-selection stages of the agent loop. The reflection stage is the least targeted, creating a coverage gap where intermediate reasoning logic may be subverted without altering final outputs.
• Threat Models: Most studies assume a black-box threat model (70%), suggesting agents are structurally fragile by default, as severe compromises can be achieved without elevated privileges.

4. Defense Landscape Analysis

• Strategy Limitations: No single defense strategy is robust across all dimensions (scalability, adversarial robustness, latency, and coverage). The field is shifting toward hybrid, multi-layer architectures.
• Cost-Security Trade-off: Stronger protection consistently incurs higher latency and token costs, tracing a clear security-cost Pareto frontier. For instance, while some filters operate at sub-millisecond speeds, comprehensive forensic systems may require minutes of processing.
• Lifecycle Placement: There is a decisive shift toward an "assume-breach" posture. 75.2% of papers investigate post-computation defenses (monitoring, auditing), and 40.0% adopt defense-in-depth strategies combining pre- and post-computation controls.
• Coverage Gaps: Defenses are heavily focused on injection and manipulation attacks. Prompt infection and pre-execution attacks (e.g., poisoned supply chains) remain the least covered attack classes.

5. Cross-Cutting Trends

• Architecture: The field is migrating from monolithic agents to multi-agent and planner-executor designs.
• Backbone Models: GPT variants are the near-universal backbone (95.7% of papers), creating a potential monoculture risk.
• Data Modalities: Coverage is skewed toward text (91.3%) and code (50.6%). Low-level modalities like network traces (8.7%) and binaries (5.9%) are significantly underrepresented.
• Benchmark Fragmentation: The threat literature is highly fragmented, with roughly 85% of named benchmarks being single-use, hindering cross-paper comparison.

Results and Findings

The survey reveals that agentic systems are structurally fragile by default. The transition from passive LLMs to autonomous agents significantly enlarges the attack surface, often negating base model safety. Key findings include:

• Offensive Efficiency: Red-teaming agents can exploit vulnerabilities at a fraction of the cost of human experts, with some systems achieving 87% success on one-day CVEs at roughly $8.80 per exploit.
• Defensive Constraints: Defensive agents remain constrained by safety and accountability, rarely achieving full autonomy, which limits their scalability against automated, high-volume attacks.
• Evaluation Gaps: Current benchmarks fail to adequately test agent-native surfaces like memory poisoning and inter-agent communication, and there is a lack of universally comparable metrics beyond Attack Success Rate (ASR).

Significance and Claims

The paper claims to provide the first holistic survey of the agentic security landscape, bridging the gap between isolated studies of threats, defenses, and applications. Its significance lies in:

1. Unifying the Field: Offering a structured framework to understand the interconnections between agent capabilities, vulnerabilities, and countermeasures.
2. Highlighting Structural Fragility: Demonstrating that current agentic systems are inherently vulnerable due to the mismatch between base model alignment and agentic autonomy.
3. Identifying Critical Gaps: Pinpointing specific areas requiring future research, including the under-explored stages of the security lifecycle (persistence, exfiltration), agent-native attack surfaces (memory, reflection), and the need for unified, multi-modal benchmarks.
4. Guiding Future Defense: Arguing that securing agentic systems requires lifecycle-wide, defense-in-depth architectures rather than single-layer fixes, and that the field must address the autonomy gap to build scalable, trustworthy autonomous security systems.

The authors conclude that while the field has made rapid progress, securing agentic systems will require a paradigm shift toward holistic, multi-layered defenses and standardized evaluation frameworks that reflect the complexity of real-world agent interactions.