ai-research-survey

scan.json (25667B)

---

 {
   "paper": {
     "title": "Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges",
     "authors": [
       "Anshuman Chhabra",
       "Shrestha Datta",
       "Shahriar Kabir Nahin",
       "Prasant Mohapatra"
     ],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2510.23883"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No GitHub link, Zenodo archive, or any code repository is mentioned in the paper. The survey presents taxonomy tables and narrative reviews but releases no analysis scripts or supporting code."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper constructs no dataset of its own and provides no download link for the papers reviewed or the structured data extracted from them. The bibliography is the only artifact, and it is not released as a structured dataset."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specification is provided. The survey does not involve computational experiments, but it also does not specify any tooling or software used to conduct the review (e.g., reference management software, analysis tools)."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No reproduction instructions are provided. There is no description of how a reader could replicate the literature search, paper selection, or taxonomy construction."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": false,
         "answer": false,
         "justification": "This is a narrative survey with no quantitative meta-analysis. Statistical uncertainty measures are not applicable."
       },
       "significance_tests": {
         "applies": false,
         "answer": false,
         "justification": "No comparative statistical claims are made by the survey authors themselves. NA for a narrative survey."
       },
       "effect_sizes_reported": {
         "applies": false,
         "answer": false,
         "justification": "No effect sizes are computed by the survey authors. The paper reports statistics from cited works (e.g., '94.4% of agents vulnerable') but does not compute effect sizes itself."
       },
       "sample_size_justified": {
         "applies": false,
         "answer": false,
         "justification": "No empirical experiments are conducted, so sample size justification is not applicable."
       },
       "variance_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experimental runs are conducted by the survey authors. NA for a narrative survey."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": false,
         "justification": "The survey does not compare its taxonomy or coverage against prior survey papers. Section 2 briefly distinguishes this survey from existing surveys (references 47-52) but does not systematically compare coverage, methodology quality, or scope against them."
       },
       "baselines_contemporary": {
         "applies": false,
         "answer": false,
         "justification": "No baseline comparison experiments are conducted, so contemporariness of baselines is not applicable."
       },
       "ablation_study": {
         "applies": false,
         "answer": false,
         "justification": "No system with components to ablate is proposed; this is a survey paper."
       },
       "multiple_metrics": {
         "applies": false,
         "answer": false,
         "justification": "No empirical evaluation is performed by the survey itself that would require multiple metrics."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "No system outputs are generated by this survey that would warrant human evaluation."
       },
       "held_out_test_set": {
         "applies": false,
         "answer": false,
         "justification": "No empirical evaluation with train/test splits is conducted."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "The survey provides per-category breakdowns of both threats (Section 3: 5 major categories with subcategories) and defenses (Table 1: coverage matrix across 7 defense dimensions), and benchmarks (Table 2: organized by capability vs. security-specific benchmarks)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The survey discusses failure modes and limitations of defense approaches throughout Section 4 (e.g., 'training-based defenses can degrade general-purpose capabilities,' adaptive attacks bypass defenses), and Section 6 explicitly discusses open challenges including failure modes of current benchmarks."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The survey consistently notes where defenses fail (e.g., Section 4.1.4 notes training-free defenses 'remain fragile against adaptive attacks'; Section 4.1.1 notes fine-tuning 'can degrade the general-purpose capabilities of LLMs without providing significant defensive capabilities against adaptive attacks')."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims the paper 'outlines a taxonomy of threats specific to agentic AI, reviews recent benchmarks and evaluation methodologies, and discusses defense strategies.' All three are delivered in Sections 3, 5, and 4 respectively. No overclaiming is present in the abstract."
       },
       "causal_claims_justified": {
         "applies": false,
         "answer": false,
         "justification": "The survey makes no causal claims of its own; it summarizes causal findings reported in cited works. The framing is appropriately attributed ('Lupinacci et al. demonstrated...', 'Prior work has shown...')."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The survey appropriately attributes claims to specific systems, models, or studies (e.g., 'GPT-4 achieving 87% success rate when given CVE descriptions'). The scope is stated as agentic AI security broadly, and limitations of generalization are noted in the open challenges section (e.g., physical world agents noted as underexplored in Section 6.5)."
       },
       "alternative_explanations_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This is a taxonomy/survey paper that presents no original empirical results, so alternative explanations for observed results are not applicable at the survey level."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": false,
         "answer": false,
         "justification": "The survey does not run any LLM experiments itself. When discussing results from cited papers, it uses the model names as reported in those papers (e.g., 'GPT-4'), which is appropriate for a survey."
       },
       "prompts_provided": {
         "applies": false,
         "answer": false,
         "justification": "The survey does not use prompting in its own methodology."
       },
       "hyperparameters_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments are conducted by the survey authors."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used by the survey itself."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "No systematic search methodology is described. The paper does not explain how papers were identified for inclusion, what databases were searched, what search terms were used, or what inclusion/exclusion criteria were applied. There is no paper selection pipeline documented."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations or threats-to-validity section. Section 6 is titled 'Open Challenges' and discusses gaps in the field, but this is forward-looking and does not discuss limitations of the survey itself (e.g., coverage gaps, selection bias, recency of sources)."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity of the survey's own methodology are discussed. The paper does not address whether it missed relevant papers, whether its taxonomy is complete or exhaustive, or whether the cited statistics are representative."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.5 explicitly notes 'this survey primarily focuses on software-based agents' and that 'physically embodied agents introduce additional and largely unexplored security risks.' The paper also notes in the introduction that it focuses on security specifically, distinguishing from capability surveys."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No structured dataset of reviewed papers is released. The bibliography provides references but not a machine-readable corpus with coded attributes, making independent verification of coverage claims impossible."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "No description of how papers were collected is provided. The survey does not specify search databases, date ranges, search queries, or any systematic selection process. Papers appear to have been selected by the authors' awareness and judgment without a documented protocol."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this survey paper."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "There is no documented pipeline from paper collection to final taxonomy. The authors present a taxonomy and cite supporting papers, but the process by which papers were screened, included, or excluded is entirely opaque."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No acknowledgments section is present in the paper, and no funding sources are disclosed anywhere in the text."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed on the title page: 'Bellini College of AI, Cybersecurity, and Computing, University of South Florida.' Contact email addresses are also provided."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so funder independence cannot be assessed. The schema says 'NA if unfunded,' but the paper does not confirm it is unfunded—university researchers typically receive some form of funding support. The absence of a funding disclosure is not the same as confirmation of being unfunded."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "There is no competing interests or financial disclosure statement in the paper. Absence of declaration is not the same as absence of conflict."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This is a survey paper that does not evaluate any pre-trained model's capabilities on benchmarks. Contamination questions are not applicable."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "No model evaluation is conducted by the survey itself. NA."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No model evaluation is conducted. NA."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. This is a survey of AI security literature."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants or experimental conditions are involved."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants or experimental conditions are involved."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": false,
         "answer": false,
         "justification": "This is a survey paper and does not propose or evaluate a system with inference costs."
       },
       "compute_budget_stated": {
         "applies": false,
         "answer": false,
         "justification": "This is a survey paper requiring no computational budget."
       }
     }
   },
   "claims": [
     {
       "claim": "94.4% of state-of-the-art LLM agents are vulnerable to prompt injection, 83.3% to retrieval-based backdoors, and 100% to inter-agent trust exploits.",
       "evidence": "Attributed to Lupinacci et al. [38] (arXiv:2507.06850, 2025), cited in Section 2 (Motivation and Contributions).",
       "supported": "weak"
     },
     {
       "claim": "Adaptive attacks achieve a 50% success rate in penetrating eight different defenses designed for indirect prompt injection attacks.",
       "evidence": "Attributed to Zhan et al. [61] (NAACL 2025), cited in Section 3.1.1.",
       "supported": "moderate"
     },
     {
       "claim": "GPT-4 achieves 87% success rate exploiting one-day vulnerabilities when given CVE descriptions, outperforming all other examined models and conventional vulnerability scanners like OWASP ZAP and Metasploit.",
       "evidence": "Attributed to Fang et al. [98] (arXiv:2404.08144, 2024), cited in Section 3.2.1.",
       "supported": "moderate"
     },
     {
       "claim": "CrossInject, a cross-modal prompt injection method embedding adversarial signals in both vision and text, boosts attack effectiveness by at least 30.1% across various tasks.",
       "evidence": "Attributed to Wang et al. [77] (arXiv:2504.14348, 2025), cited in Section 3.1.3.",
       "supported": "moderate"
     },
     {
       "claim": "Even advanced multimodal agents struggle with CAPTCHAs, achieving at best 40% success rate compared to nearly 100% for humans.",
       "evidence": "Attributed to Luo et al. Open CaptchaWorld [164] (arXiv:2505.24878, 2025), cited in Section 3.4.3.",
       "supported": "moderate"
     },
     {
       "claim": "Defensive fine-tuning can degrade the general-purpose capabilities of LLMs without providing significant defensive capabilities against adaptive attacks.",
       "evidence": "Attributed to Jia et al. [179] (arXiv:2505.18333, 2025), cited in Section 4.1.1.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": [
     "qualitative"
   ],
   "key_findings": "This survey provides a taxonomy of agentic AI security threats organized into five broad categories: prompt injection and jailbreaks, autonomous cyber-exploitation and tool abuse, multi-agent and protocol-level threats, interface and environment risks, and governance and autonomy concerns. It reviews defenses across four dimensions (prompt-injection-resistant designs, policy filtering, sandboxing, detection/monitoring), catalogs over 20 security-relevant benchmarks, and identifies six open challenges including long-horizon security, multi-agent trust, and adaptive attack evaluation. The survey concludes that no single defense is sufficient and practical deployments must combine complementary strategies.",
   "red_flags": [
     {
       "flag": "No systematic review methodology",
       "detail": "The survey provides no description of how papers were identified, searched for, or selected. There is no search protocol, no databases listed, no date range, no inclusion/exclusion criteria, and no PRISMA-style flow diagram. This makes it impossible to verify whether coverage is representative or reproducible, and the paper set appears to be selected by the authors' awareness rather than a systematic process."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper has no dedicated limitations or threats-to-validity section. Section 6 discusses open challenges in the field, but not limitations of this survey itself. The survey does not acknowledge potential coverage gaps, recency bias (many citations are mid-2025), or selection bias in which papers were included."
     },
     {
       "flag": "No funding disclosure",
       "detail": "There is no acknowledgments section and no funding source is disclosed anywhere in the paper. No competing interests statement is provided. This is a gap in transparency, especially as the corresponding author (Chhabra) cites two of his own prior works [145, 146] in the survey."
     },
     {
       "flag": "Narrative survey laundering weak evidence",
       "detail": "The survey presents statistics from individual cited papers (e.g., '94.4% of agents vulnerable') as unqualified facts without noting the methodological limitations of those underlying studies. A survey that uncritically aggregates results from papers of varying methodological quality amplifies noise rather than extracting signal."
     },
     {
       "flag": "No quality assessment of cited papers",
       "detail": "The survey makes no attempt to assess the methodological quality of the papers it cites and synthesizes. Claims from individual empirical papers are presented without noting sample sizes, whether they were replicated, or whether the studies were peer-reviewed. This means weak or unreliable results receive equal weight to robust findings."
     }
   ],
   "cited_papers": [
     {
       "title": "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents",
       "authors": [
         "Qiusi Zhan",
         "Zhixiang Liang",
         "Zifan Ying",
         "Daniel Kang"
       ],
       "year": 2024,
       "relevance": "Key benchmark for indirect prompt injection attacks on tool-using LLM agents, directly relevant to survey scope on agentic AI evaluation."
     },
     {
       "title": "AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents",
       "authors": [
         "Maksym Andriushchenko",
         "Alexandra Souly",
         "Mateusz Dziemian"
       ],
       "year": 2024,
       "arxiv_id": "2410.09024",
       "relevance": "Security-specific benchmark for measuring harmful behavior in tool-using LLM agents, central to agentic AI evaluation methodology."
     },
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
       "authors": [
         "Edoardo Debenedetti",
         "Jie Zhang",
         "Mislav Balunovic",
         "Luca Beurer-Kellner",
         "Marc Fischer",
         "Florian Tramer"
       ],
       "year": 2024,
       "arxiv_id": "2406.13352",
       "relevance": "Dynamic benchmark framework for evaluating prompt injection attacks and defenses in tool-using agents."
     },
     {
       "title": "WebArena: A Realistic Web Environment for Building Autonomous Agents",
       "authors": [
         "Shuyan Zhou",
         "Frank F Xu",
         "Hao Zhu"
       ],
       "year": 2023,
       "arxiv_id": "2307.13854",
       "relevance": "Major capability benchmark for web agents used extensively in agentic AI security evaluation and referenced throughout the survey."
     },
     {
       "title": "Identifying the Risks of LM Agents with an LM-Emulated Sandbox (ToolEmu)",
       "authors": [
         "Yangjun Ruan",
         "Honghua Dong",
         "Andrew Wang",
         "Silviu Pitis",
         "Yongchao Zhou",
         "Jimmy Ba",
         "Tatsunori Hashimoto"
       ],
       "year": 2023,
       "arxiv_id": "2309.15817",
       "relevance": "Proposes LM-emulated sandbox for safety evaluation of LLM agents, a foundational methodology for agentic AI security evaluation."
     },
     {
       "title": "LLM Agents Can Autonomously Exploit One-Day Vulnerabilities",
       "authors": [
         "Richard Fang",
         "Rohan Bindu",
         "Akul Gupta",
         "Daniel Kang"
       ],
       "year": 2024,
       "arxiv_id": "2404.08144",
       "relevance": "Demonstrates that GPT-4 agents can autonomously exploit real-world CVEs, central to autonomous cyber-exploitation threat category."
     },
     {
       "title": "LLM Agents Can Autonomously Hack Websites",
       "authors": [
         "Richard Fang",
         "Rohan Bindu",
         "Akul Gupta",
         "Qiusi Zhan",
         "Daniel Kang"
       ],
       "year": 2024,
       "arxiv_id": "2402.06664",
       "relevance": "Shows GPT-4 agents autonomously breaking into sandboxed websites through multi-step exploits."
     },
     {
       "title": "Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents",
       "authors": [
         "Qiusi Zhan",
         "Richard Fang",
         "Henil Shalin Panchal",
         "Daniel Kang"
       ],
       "year": 2025,
       "relevance": "Key finding that adaptive attacks undermine most existing defenses against indirect prompt injection, motivating open challenge on adaptive attack evaluation."
     },
     {
       "title": "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection",
       "authors": [
         "Kai Greshake",
         "Sahar Abdelnabi",
         "Shailesh Mishra",
         "Christoph Endres",
         "Thorsten Holz",
         "Mario Fritz"
       ],
       "year": 2023,
       "relevance": "Foundational paper on indirect prompt injection attacks against real-world LLM-integrated applications."
     },
     {
       "title": "AI Agents That Matter",
       "authors": [
         "Sayash Kapoor",
         "Benedikt Stroebl",
         "Zachary S Siegel",
         "Nitya Nadgir",
         "Arvind Narayanan"
       ],
       "year": 2024,
       "arxiv_id": "2407.01502",
       "relevance": "Addresses evaluation methodology for LLM agents, including cost-performance tradeoffs, relevant to methodology quality in agentic AI research."
     },
     {
       "title": "The BrowserGym Ecosystem for Web Agent Research",
       "authors": [
         "De Chezelles, Thibault Le Sellier",
         "Sahar Omidi Shayegan"
       ],
       "year": 2024,
       "arxiv_id": "2412.05467",
       "relevance": "Unified benchmark ecosystem for web agents that emphasizes reproducibility and comparability across models and environments."
     },
     {
       "title": "tau-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains",
       "authors": [
         "Shunyu Yao",
         "Noah Shinn",
         "Pedram Razavi",
         "Karthik Narasimhan"
       ],
       "year": 2024,
       "arxiv_id": "2406.12045",
       "relevance": "Introduces pass^k metric for measuring consistency of tool-using agents, directly relevant to reliability evaluation methodology."
     },
     {
       "title": "OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environments",
       "authors": [
         "Tianbao Xie",
         "Danyang Zhang",
         "Jixuan Chen"
       ],
       "year": 2024,
       "relevance": "Comprehensive benchmark for computer-use agents in realistic environments, used for both capability and security evaluation."
     },
     {
       "title": "Here Comes the AI Worm: Unleashing Zero-Click Worms That Target GenAI-Powered Applications",
       "authors": [
         "Stav Cohen",
         "Ron Bitton",
         "Ben Nassi"
       ],
       "year": 2024,
       "arxiv_id": "2403.02817",
       "relevance": "Demonstrates autonomous propagating attacks (AI worms) in multi-agent systems, key to understanding propagation-orientation of agentic threats."
     },
     {
       "title": "Design Patterns for Securing LLM Agents against Prompt Injections",
       "authors": [
         "Luca Beurer-Kellner",
         "Beat Buesser",
         "Ana-Maria Crestu"
       ],
       "year": 2025,
       "arxiv_id": "2506.08837",
       "relevance": "Systematic defense design patterns for LLM agents against prompt injection, with classification into agent-, user-, and system-focused approaches."
     }
   ]
 }