From Stateless Queries to Autonomous Actions: A Layered Security Framework for Agentic AI Systems

• URL: http://arxiv.org/abs/2604.23338v1
• Date: Sat, 25 Apr 2026 14:57:15 GMT
• Title: From Stateless Queries to Autonomous Actions: A Layered Security Framework for Agentic AI Systems
• Abstract summary: Agentic AI systems plan across extended horizons, maintain persistent memory, invoke external tools, and coordinate with peer agents.<n>Existing security analyses organize threats by attack type (prompt injection, jailbreaking), but provide no principled model of which architectural component is vulnerable.<n>We introduce the Layered Attack Surface Model (LASM), a seven-layer framework that maps threats to distinct architectural components.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Agentic AI systems face security challenges that stateless large language models do not. They plan across extended horizons, maintain persistent memory, invoke external tools, and coordinate with peer agents. Existing security analyses organize threats by attack type (prompt injection, jailbreaking), but provide no principled model of which architectural component is vulnerable or over what timescale the threat manifests. This paper makes five contributions. First, we introduce the Layered Attack Surface Model (LASM), a seven-layer framework that maps threats to distinct architectural components: Foundation, Cognitive, Memory, Tool Execution, Multi-Agent Coordination, Ecosystem, and Governance, the accountability and observability layer that spans the stack analogously to the network management plane. Second, we introduce attack temporality as an orthogonal analytical dimension with four classes: Instantaneous (T1), Session-Persistent (T2), Cross-Session Cumulative (T3), and Sub-Session-Stack, Non-Session-Bounded (T4). Third, through a systematic review of 94 papers (2021--2025), we show that the most dangerous emerging threats concentrate at the intersection of high-layer attacks (L5--L7) and slow-burn temporality (T3--T4): covert agent collusion, long-term memory poisoning, MCP supply-chain compromise, and alignment failure that manifests as an insider threat with no external adversary. Only 8 of 120 paper-cell assignments (7%) fall in this zone. Fourth, we propose a cross-layer defense taxonomy spanning all seven LASM layers and all four temporality classes, exposing which threat classes existing defenses leave unaddressed. Fifth, we survey evaluation benchmarks, identify five research gaps in the under-studied high-layer, slow-burn zone, and argue that agentic security must be treated as a distributed systems problem embedded in an adversarial ecosystem.

Related papers

• Poisoning Agentic Alpha: Adversarial Vulnerabilities Across Roles and Architectures in Multi-Agent Trading Systems [103.90831279037094]
  LLM-based multi-agent trading systems are moving rapidly from research prototypes to live deployments that control real assets.<n>A corrupted signal can propagate to the final decision and translate into realized financial loss.<n>We present the first systematic empirical study in the financial domain to characterize how an adversarial signal enters a multi-agent trading system.
  arXiv  Detail & Related papers  (2026-08-25T05:07:37Z)
• Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies [62.65225104423404]
  Self-evolving agent systems introduce a qualitatively new threat landscape in which adversarial influences become permanently encoded.<n>We present a systematic security and privacy analysis organized around the Module-Lifecycle Attack Surface matrix.<n>Our findings establish that self-evolution converts every known attack category from session-bounded to lineage-persistent.
  arXiv  Detail & Related papers  (2026-06-22T09:23:50Z)
• Provably Secure Agent Guardrail [89.79561918065122]
  Existing defense architectures rely on empirical semantic guardrails and probabilistic large model adjudicators.<n>This paper proposes a new security paradigm for agents based on the fundamental limitations of logical reasoning.
  arXiv  Detail & Related papers  (2026-05-28T02:12:41Z)
• Benchmarking Autonomous Agents against Temporal, Spatial, and Semantic Evasions [15.535628544812326]
  We propose a novel, multi-dimensional evasion framework targeting LLM-based agent systems.<n>To quantify these threats, we construct A3S-Bench, a comprehensive benchmark comprising 2,254 real-world agent execution trajectories.<n>Our evasion framework elevates the average risk trigger rate from a 28.3% baseline to 52.6%.
  arXiv  Detail & Related papers  (2026-05-21T11:07:51Z)
• Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study [6.816972488354133]
  This survey presents a layered review of security risks and defense strategies in autonomous agent frameworks.<n>We organize the analysis into four security-relevant layers: the context and instruction layer, the tool and action layer, the state and persistence layer, and the ecosystem and automation layer.<n>We identify that threats in autonomous agent frameworks may propagate across layers, from manipulated inputs to unsafe actions, persistent state contamination, and broader ecosystem-level impact.
  arXiv  Detail & Related papers  (2026-04-30T06:04:34Z)
• AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents [16.761926457126428]
  This paper presents AgentWard, a lifecycle-oriented, defense-in-depth architecture that systematically organizes protection across five stages.<n>AgentWard integrates stage-specific, heterogeneous controls with cross-layer coordination, enabling threats to be intercepted along their propagation paths while safeguarding critical assets.
  arXiv  Detail & Related papers  (2026-04-27T16:22:27Z)
• Vision-Language-Action Safety: Threats, Challenges, Evaluations, and Mechanisms [61.29786895012393]
  Vision-Language-Action (VLA) models are emerging as a unified substrate for embodied intelligence.<n>This survey provides a unified and up-to-date overview of safety in Vision-Language-Action models.
  arXiv  Detail & Related papers  (2026-04-26T15:58:19Z)
• SafeHarness: Lifecycle-Integrated Security Architecture for LLM-based Agent Deployment [19.947119280467934]
  safeharness is a security architecture in which four proposed defense layers are woven directly into the agent lifecycle.<n>We evaluate safeharness on benchmark datasets across diverse harness configurations.
  arXiv  Detail & Related papers  (2026-04-15T08:59:00Z)
• A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms [0.0]
  The Model Context Protocol (MCP) has become the de facto standard for connecting large language model (LLM)-based agents to external tools and data sources.<n>This paper presents MCPSHIELD, a comprehensive formal security framework for MCP-based AI agents.
  arXiv  Detail & Related papers  (2026-04-07T15:02:47Z)
• Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw [87.97230960702274]
  We present the first real-world safety evaluation of OpenClaw.<n>We introduce the CIK taxonomy, which unifies an agent's persistent state into three dimensions.<n>Our evaluations cover 12 attack scenarios on a live OpenClaw instance.
  arXiv  Detail & Related papers  (2026-04-06T15:27:05Z)
• Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs [32.38053469964495]
  Extended action spaces, including hidden inter-system interactions, pose severe security challenges.<n>IPI, which conceals malicious instructions within third-party content, can trigger unauthorized actions such as data exfiltration.<n>We evaluate six defense strategies against four sophisticated IPI attack vectors across nine LLM backbones.
  arXiv  Detail & Related papers  (2026-04-04T21:27:04Z)
• Poisoning the Pixels: Revisiting Backdoor Attacks on Semantic Segmentation [28.208102468217394]
  This work systematically examines backdoor attacks tailored to semantic segmentation.<n>We introduce BADSEG, a unified framework that optimize trigger designs and apply label manipulation strategies to maximize attack performance.<n>Our work reveals previously overlooked security vulnerabilities in semantic segmentation, and motivates the development of defenses tailored to segmentation-specific threat models.
  arXiv  Detail & Related papers  (2026-03-17T11:42:17Z)
• Just Ask: Curious Code Agents Reveal System Prompts in Frontier LLMs [65.6660735371212]
  We present textbftextscJustAsk, a framework that autonomously discovers effective extraction strategies through interaction alone.<n>It formulates extraction as an online exploration problem, using Upper Confidence Bound--based strategy selection and a hierarchical skill space spanning atomic probes and high-level orchestration.<n>Our results expose system prompts as a critical yet largely unprotected attack surface in modern agent systems.
  arXiv  Detail & Related papers  (2026-01-29T03:53:25Z)
• BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents [58.83028403414688]
  Large language model (LLM) agents execute tasks through multi-step workflow that combine planning, memory, and tool use.<n>Backdoor triggers injected into specific stages of an agent workflow can persist through multiple intermediate states and adversely influence downstream outputs.<n>We propose textbfBackdoorAgent, a modular and stage-aware framework that provides a unified agent-centric view of backdoor threats in LLM agents.
  arXiv  Detail & Related papers  (2026-01-08T03:49:39Z)
• QSAF: A Novel Mitigation Framework for Cognitive Degradation in Agentic AI [2.505520948667288]
  We introduce Cognitive Degradation as a novel vulnerability class in agentic AI systems.<n>These failures originate internally, arising from memory starvation, planner recursion, context flooding, and output suppression.<n>To address this class of failures, we introduce the Qorvex Security AI Framework for Behavioral & Cognitive Resilience.
  arXiv  Detail & Related papers  (2025-07-21T07:41:58Z)
• An LLM-based Self-Evolving Security Framework for 6G Space-Air-Ground Integrated Networks [49.605335601285496]
  6G space-air-ground integrated networks (SAGINs) offer ubiquitous coverage for various mobile applications.<n>We propose a novel security framework for SAGINs based on Large Language Models (LLMs)<n>Our framework produces highly accurate security strategies that remain robust against a variety of unknown attacks.
  arXiv  Detail & Related papers  (2025-05-06T04:14:13Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.