Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challenges
This paper surveys 66 recent studies on agentic AI security and proposes a cross-dimensional taxonomy that connects attacked surfaces, trust boundaries, violated security properties, and evaluated agent architectures, then uses it to assess where red-teaming work and benchmarks actually provide empirical coverage. Its useful contribution is making the mismatch between threat taxonomies and real evaluations concrete—showing that current evidence is skewed toward prompt/reasoning, memory, tool use, and single-agent setups—though its conclusions are limited by the selected corpus, uneven benchmark quality, and the still-immature state of reproducible, architecture-aware agent security evaluation.
Abstract
Agentic AI extends LLM security beyond generated content to persistent state, autonomous actions, tool use, and interactions with humans and other agents. Existing threat classifications often emphasize individual dimensions, obscuring connections among entry points, affected components, and security consequences. The known threat landscape also differs from the coverage demonstrated by empirical research. Through a structured review of 66 studies published from 2022 to 2026, we introduce T={S, B, P, A}, a cross-dimensional representation linking affected functional or system surfaces {S}, interaction or trust boundaries {B}, violated security properties {P}, and empirically examined architectures {A}. We analyze 22 artifact-backed red-teaming studies and 11 representative security benchmarks to characterize empirical coverage and evaluation maturity. Within the selected studies, evidence concentrates on prompt/reasoning, memory, and tool-mediated attacks, predominantly in single-agent settings. Persistent, Human--Agent, complex multi-agent, systemic, and long-horizon threats receive less coverage. These findings describe the selected corpus rather than establish gaps across all empirical research. Heterogeneous metrics, limited adaptive defense evaluation, architectural imbalance, and incomplete execution-state capture further constrain comparison and reproducibility. We derive 13 open research questions to guide more systematic, architecture-aware, and reproducible security evaluation of agentic AI.