The Big Picture
Security must move beyond checking single actions to verifying an agent's behavior over time and across interacting components—covering tool integrity, inter-agent trust, model routing, and supply chains.
ON THIS PAGE
The Evidence
Agentic systems face four broad, linked risks: untrusted inputs that hijack reasoning, persistent memory poisoning, and malicious tool metadata at the single-agent level; weak identity, delegation, and contagious attacks across agents; a hidden attack surface in the model-routing control plane that can force unsafe or cheaper models; and the need to enforce rules over whole execution trajectories rather than only per-action checks. Current protocols often treat critical protections as optional, leaving gaps in provenance, observability, and delegated authority. Addressing these requires treating routing, tools, memories, and agent-to-agent protocols as first-class security artifacts, and building verifiable behavioral guarantees that span multiple agents and time. Dynamic Task Routing Pattern Additionally, systems can benefit from a structured approach to decision flow and routing that a Defense in Depth Pattern supports.
Not sure where to start?Get personalized recommendations
Data Highlights
1A poisoning attack can succeed with under 0.1% of memory entries corrupted and still backdoor future retrievals.
2150+ organizations adopted the A2A-style agent-to-agent protocol family by 2025, spreading interoperability risks widely.
399 vulnerabilities related to the Model Context Protocol were reported in 2025, showing tool metadata is already a real-world attack vector.
What This Means
Engineers building or operating autonomous agents, platform security teams, and technical leaders evaluating agent deployments should care because these gaps let small, hard-to-detect compromises persist and propagate across systems. Regulators and compliance teams should also pay attention: agent-generated action traces and supply-chain provenance will be needed for auditability and accountability. Audit Trail
Key Figures
Fig 1: Figure 1. Agentic AI architecture. An agent plans, uses memory and tools, and interacts with users and environments.
Fig 2: Figure 2. An agentic ecosystem with representative challenges marked in red.
Ready to evaluate your AI agents?
Learn how ReputAgent helps teams build trustworthy AI through systematic evaluation.
Learn MoreYes, But...
This is a vision and threat-analysis paper rather than an empirical evaluation, so specific mitigations are proposed but not comprehensively tested. Some suggested defenses reuse existing standards (for example, constrained delegation tokens), but current agent protocols treat them as optional, limiting interoperability. Practical deployment will need new tooling for continuous validation, provenance capture, and runtime trajectory checks, which are not yet standardized. Planning Pattern
Methodology & More
Secure agentic AI requires shifting focus from single-step checks to ensuring correct behavior across time, components, and interacting agents. At the single-agent level, three attack surfaces stand out: prompt injection via retrieved content that can persist across steps; memory poisoning that can backdoor future decisions even when only a tiny fraction of stored entries are malicious; and tool integrity failures where third-party tool definitions change or hide malicious instructions. Treating context, memory, and tool metadata as untrusted inputs needing continuous validation is critical. Across agents, weak identity, delegation, and context ownership in emerging agent-to-agent protocols let malicious or compromised peers claim capabilities, replay credentials, or silently propagate harmful instructions. Model routing — the control plane that chooses which model handles each request — adds another attack surface because adversaries can manipulate routing to force unsafe upgrades or downgrades. The most important gap is behavioral: sequences of individually allowed actions can together violate governance policies. The recommended direction is building verifiable behavioral invariants, richer provenance and observability (including routing telemetry), and mandatory protocol-level guarantees for identity, delegation, and tool provenance so multi-agent systems can be deployed with accountability and continuous assurance. Hallucination Propagation
Avoid common pitfallsLearn what failures to watch for
Credibility Assessment:
All authors from University of Texas at Dallas (recognized but not top-tier AI lab) and low h-indexes; arXiv preprint with no citations — emerging/limited signal.