Trustworthy Agentic AI: A Comprehensive Cybersecurity and Systems Survey on Threat Landscapes, Defense Architectures, and Open Challenges
cs.AI
Quick verdict
Broad agentic-AI security survey with useful taxonomies and defense-cost tables, but several citations look unreliable and overhead figures lack provenance.
Summary
This survey organizes the security and trustworthiness landscape of agentic AI — LLM-based systems with reasoning loops, persistent memory, tool execution, and multi-agent coordination — around five research questions. The author claims a PRISMA-S-guided search distilled 206 references, formalizes an agent as a stateful 5-tuple ⟨C,M,T,E,Π⟩ coupled to an adversarial POMDP, and defines a six-dimensional trustworthiness taxonomy (security, safety, privacy, explainability, fairness, accountability). Threat analysis spans intra-execution planes (prompt injection, backdoors, planning errors, RCE/SSRF; Table V) and interaction planes (indirect prompt injection, RAG poisoning, embedding inversion, Byzantine swarms; Table VI), anchored by CVE-2023-34541 (LangChain) and CVE-2024-21513 (AutoGPT). On defense it proposes a four-layer zero-trust architecture, a comparative overhead matrix for nine controls (Table VII), a benchmark taxonomy (Table VIII, e.g., InjecAgent GPT-4 ASR 24.1–45.3% under IPI), and a regulatory mapping to NIST AI RMF, EU AI Act, and ISO/IEC 42001 (Table IX). Main limitations: no original empirical evaluation; Table VII's latency/token figures lack provenance; several citations conflict with known literature or the paper's own timeline (e.g., a USENIX Security 2024 MCP-fuzzing reference predating MCP's stated late-2024 debut); and the 'first comprehensive framework' claim overreaches an eight-row comparison (Table I).
Review complete
Assessment at a glance
5
risk flags identified
● high 1
● medium 3
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Agentic systems collapse the classical data/control boundary: natural language simultaneously serves as input, control logic, and communication protocol (Eq. 1), making untrusted data effectively executable code.
- Threats span two planes — intra-execution (perception/brain/action: injections, backdoors, planning errors, RCE/SSRF) and interaction (environment, memory, swarms: IPI, RAG poisoning, worms, Byzantine subversion) — organized in Tables V and VI.
- A four-layer zero-trust defense-in-depth architecture (cognitive guardrails, cryptographic memory provenance, sandboxing/least privilege, multi-agent zero-trust protocols) mitigates the identified threat spectrum.
- Each defense carries quantified operational trade-offs (Table VII) that should drive risk-aware, Pareto-optimal deployment scheduling (Sec. IX.E).
- Technical controls map directly onto NIST AI RMF, EU AI Act Articles 9/10/12/14, ISO/IEC 42001, and OWASP mandates (Table IX).
Strengths
Broad, well-structured synthesis
Five research questions (Sec. I.F) map cleanly onto Sections II–IX; the master threat tables (Table V, Table VI) organize attack vectors by plane, adversary model, and evaluated impact — a usable navigation aid for newcomers.
Defense cost matrix is operationally concrete
Table VII compares nine controls (Dual-LLM, attention masking, signed vectors, DP noise, CapBAC, micro-VM, eBPF, PBFT, TEEs) across latency overhead, token cost, deployment model, and operational limitations — a dimension most surveys omit entirely.
Regulatory bridge is specific
Grounded in real incidents
Reusable evaluation formalism
Weaknesses
Citation reliability is compromised
No original empirical evaluation
Table VII overheads lack provenance
Novelty overclaim with thin comparison
Formalization is largely rhetorical
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This is a single-author survey (arXiv:2609.13731, cs.AI, Sep 2026) positioning itself as "the first comprehensive systems-security reference framework for Trustworthy Agentic AI," synthesizing "206 foundational studies and regulatory standards" (Abstract; Sec. I.D). The scope is genuinely broad: agent formalization (Sec. II), a six-dimensional trustworthiness taxonomy (Sec. III), intra-execution threats (Sec. IV), interaction threats (Sec. V), a zero-trust defense-in-depth blueprint (Sec. VI), benchmarks and metrics (Sec. VII), regulatory mapping (Sec. VIII), and open problems (Sec. IX), structured around five research questions (Sec. I.F). The central conceptual claim is the "Systems Boundary Collapse Principle" (Eq. 1): in agentic systems, natural language is simultaneously input, control logic, and protocol, so untrusted data is effectively executable code.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is the six-dimensional trustworthiness taxonomy proposed in this survey?
The paper divides agentic-AI trustworthiness into six dimensions: Security (confidentiality of system prompts/secrets, integrity of planning and tool calls, availability against DoS), Safety & Operational Robustness (bounded action envelopes, reversibility of irreversible actions), Privacy (leak-free tool dispatches, embedding-inversion resistance, multi-tenant isolation), Explainability & Verifiability (action-chain audit trails, neural-symbolic SMT checks, reasoning-chain faithfulness), Fairness (unbiased tool allocation, anti-collusion in agent markets), and Accountability (DID-signed actions, Merkle audit trees, governance alignment). Each dimension is paired with formal invariants and controls in Section III.
How does the survey propose defending LLM agents against prompt injection?
It proposes a four-layer zero-trust defense: (1) cognitive guardrails such as Dual-LLM inspector-executor isolation and tokenizer-level attention delimiters; (2) memory integrity via cryptographically signed vector embeddings, Merkle audit trees, and differential-privacy noise; (3) OS-level sandboxing with capability-based access-control tokens, Firecracker/gVisor micro-VMs, and eBPF syscall probes; (4) multi-agent protocols using decentralized identifiers, mTLS, and Byzantine fault tolerance. Table VII estimates the price: dual-LLM isolation roughly doubles token costs and adds 1.5–3.0 seconds of latency.
Does the paper include original experiments or code?
No. It is a survey synthesizing 206 published works, benchmarks, and standards. All quantitative figures are drawn from prior studies or stated without sources (as in the defense-overhead table), and no code or dataset is released. Its deliverables are an agent formalization (a 5-tuple with an adversarial POMDP), a six-dimension taxonomy, threat tables, a defense blueprint, and regulatory mappings.
Which AI regulations does the survey map technical defenses to?
NIST AI RMF 1.0 plus its Generative AI Profile (GOVERN/MAP/MEASURE/MANAGE functions), the EU AI Act (Article 9 risk management, Article 10 data governance, Article 12 tamper-evident logging, Article 14 human oversight with HITL/HOTL/HIC tiers), ISO/IEC 42001 (AI management system) and ISO/IEC 27001, IEEE P3119/2830, and the OWASP Top 10 for LLMs and for agentic AI. Its Table IX maps each mandate to controls such as capability tokens, Merkle-tree logging, and signed embeddings.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The provided text is a sampled excerpt with three '[...sampling gap...]' breaks omitting parts of Sections IV–VII, the conclusion tail, and references ~135–155; judgments depending on those parts (e.g., full defense-layer detail, PRISMA materials) are lower confidence.
- No PRISMA flow diagram or screening counts appear in the provided excerpt; they may exist in skipped sections, so the methodological-opacity judgment is based on the excerpt only.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.