Agentic LLMs: Attacks Surge, Defences Lag Behind

Problem

This systematic review examines security vulnerabilities unique to agentic large language model systems—LLMs that perform multi-step planning, invoke tools, execute code and retain memory—when given real-world privileges such as API access, file modification and database queries. The shift from stateless chat to autonomous agents raises new risks: a compromised reasoning step can produce unauthorised data access, irreversible state changes or cascading failures. The paper argues the security research community has not kept pace with these developments and quantifies the gap.

Approach

The authors performed a PRISMA 2020 compliant systematic literature review across six databases, screening 743 records and retaining 85 papers published 2023–2025. They extracted structured data on agent types, threat models, vulnerability classes, and contributions, and developed a four-layer architectural taxonomy mapping 13 vulnerability types to perception, brain, action and interaction layers. Quality and inter-rater agreement were reported; quantitative synthesis measured research focus and gaps.

Key Findings

• Corpus and balance: 85 papers (2023–2025); attack-focused work outnumbers defence-focused work roughly 3.9:1, with 55% of papers on attacks and only 14% on defences.
• Layer coverage skew: Perception-layer vulnerabilities dominate (66% of papers, 56/85) while action-layer issues are rare (4.7%, 4/85); code-execution agents are underrepresented (about 3.5%, 3 papers) despite high consequence.
• Vulnerability taxonomy: A four-layer taxonomy (perception, brain, action, interaction) maps 13 vulnerability types including prompt injection, indirect injection, jailbreaking, adversarial input, backdoors, reasoning manipulation, goal hijacking, tool misuse, code injection, sandbox escape, memory poisoning and inter-agent attacks.
• Most studied attack types: Prompt injection (36 papers), adversarial inputs (30), and jailbreaking (16); high-impact execution attacks such as code injection and sandbox escape were reported in only a handful of studies.
• Detection and mitigation maturity: Detection work is concentrated at input level (filtering and classifier-based detectors); runtime and execution-level anomaly detection are immature. No standardised evaluation protocol exists and adaptive adversary testing is rare.
• Defensive patterns and trade-offs: Proposed defences include input/output filtering, architectural separation and privilege restriction, runtime controls (sandboxing, quotas, policy engines), training-time mitigation (adversarial training, RLHF), governance (human-in-the-loop, audits) and multi-agent measures (signing, consensus). Each approach has trade-offs in latency, coverage and scalability.

Limitations

The review is bounded to English-language literature indexed up to December 2025 and may miss non-indexed or very recent work. Publication and selection bias may overstate effectiveness of proposed defences. The field is fast-moving; 85 papers reflect an emergent subfield rather than exhaustive maturity.

Implications

From an offensive-security perspective, attackers can exploit weak perception controls to perform prompt injection and jailbreaking that alter agent goals, poison memory stores to cause gradual corruption, manipulate reasoning or plant backdoors, coerce tool misuse to trigger unauthorised API calls or data exfiltration, inject malicious code for arbitrary execution and attempt sandbox escapes. Multi-agent and interaction-layer channels enable message injection and impersonation that can cascade through ecosystems. The paper emphasises that architectural coupling and weak isolation permit such cross-layer propagation, making containment and strict isolation high-value targets for defenders and priority objectives for adversaries seeking lasting impact.