Pith. sign in

REVIEW 4 major objections 5 minor 59 references

Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The tool-calling architecture of an LLM agent, whether centralized Function Calling or distributed MCP, reshapes its vulnerability profile, and multi-stage chained attacks succeed 91–96% of the time in both paradigms.

desk verdict Useful first Function Calling vs MCP comparison, but the headline ASR gap is confounded by implementation differences the authors admit; read it as a framework contribution, not a clean architectural result. read the letter →

arxiv 2507.06323 v1 pith:IICVGMOS submitted 2025-07-08 cs.CR cs.AI

Tarek Gasmi , Ramzi Guesmi , Ines Belhadj , Jihene Bennaceur This is my paper
classification cs.CRcs.AI
keywords LLMagentsFunctionCallingModelContextProtocolarchitecturalsecuritypromptinjectioncomposedattacksvulnerabilityassessmentdeploymentparadigms
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the two dominant ways of wiring tools into an LLM agent—the centralized Function Calling pattern and the distributed client–server Model Context Protocol (MCP)—produce measurably different security postures, and that current single-vector benchmarks understate real-world risk. The authors ran 3,250 attack scenarios across seven language models and found Function Calling more vulnerable overall (73.5% attack success versus 62.59% for MCP), with heavier system-centric exposure, while MCP showed heavier LLM-centric exposure (68.28% versus 59%). The central quantitative finding is that composed and chained attacks—prompt injection combined with JSON injection, tool injection, man-in-the-middle, or denial-of-service, run in sequence—reach 91–96% success in both paradigms, far above the roughly 50% of simple attacks. A reader should care because the result implies that securing an agent is partly an architecture-selection problem, and that defenses must break attack chains rather than harden single components. The paper also reports a counterintuitive pattern it does not fully explain: reasoning-capable models detect threats better yet end up more exploitable once an attack passes their defenses.

What carries the argument

The load-bearing machinery is the paper's attack progression model built on a formalized agent execution flow, $R = \rho(r(S, U, T), O)$ with $O = F_n(F_p)$, which exposes seven attack surfaces (system prompt $S$, user prompt $U$, tool set $T$, function name $F_n$, function parameters $F_p$, tool output $O$, response $R$) and six attack vectors (prompt injection, indirect prompt injection, JSON injection, denial-of-service, man-in-the-middle, tool injection). Simple attacks are single-vector exploits $\alpha(x)$; composed attacks nest techniques via $(\alpha \circ \beta)(x, \sigma_0) = \alpha(x, \beta(x, \sigma_0))$; chained attacks walk a five-node directed graph $N_1 \to N_2 \to N_3 \to N_4 \to N_5$ with success probability $\mathrm{ASR}(\Gamma_{\mathrm{chain}}) = \prod_i P(\alpha_i \mid \sigma_{i-1})$. That product formula is the formal reason the paper expects multi-stage attacks to dominate, and it ties the measured 91–96% chained success to accumulated state corruption along architectural critical paths. The companion unified threat classification framework, which maps nine threats onto STRIDE and ATFAA categories and ties each threat to specific surfaces and vectors, is what lets the same attack be measured identically against Function Calling and MCP, making the cross-architecture comparison coherent.

What would settle it

Run the same 3,250 scenarios with credential handling, state management, and judge validation equalized across both paradigms, for instance a shared secret store, identical session semantics, and human-consensus labels on every case; if the Function Calling versus MCP overall ASR gap (73.5% versus 62.59%) shrinks to statistical noise while chained attacks still land at 91–96%, then the architectural-difference claim fails and only the attack-progression claim survives.

Watch

Extended reading notes

Core claim

On its own terms, the paper claims that architectural design actively determines an LLM agent's threat landscape rather than merely shaping its functionality. With identical models, tool schemas, and test payloads, the centralized Function Calling paradigm concentrated risk in the system layer—tool registry, function parameters, and execution—yielding 87.98% system-centric attack success and an overall attack success rate of 73.5%, whereas MCP's client–server separation contained system-layer attacks (57% ASR) but redistributed exposure to the reasoning layer through context-rich communication, where LLM-centric attacks succeeded 68.28% of the time. The paper further claims that attack complexity amplifies effectiveness in a multiplicative way: composing attack vectors (for example, prompt injection that disables validation, followed by JSON injection) raised success rates to 67.4–73.8%, and five-stage chained attacks traversing the agent's execution flow reached 91–96% success in every configuration tested. Finally, it claims that reasoning-capable models, despite higher refusal rates (averaging 17.8% versus non-reasoning models), are more exploitable once breached, with the most capable models showing the highest success rates (75% for Claude 3-5, 72% for GPT-4.1). Because even a strong documented defense—AgentDojo's 92% isolation-based defense against direct prompt injection—fails against composed attacks, the authors conclude that single-vector assessment frameworks structurally underestimate real exposure.

Load-bearing premise

The whole comparison rests on the assumption that the two test systems differed only in their tool-calling architecture, but the paper's own Section 4.3 describes extra differences—MCP's credential coordination and distributed state versus Function Calling's unified authentication and centralized state—and the judge that scored outcomes was validated on only 300 of 3,250 cases, so a biased judge or a confounded implementation could move the headline numbers.

Editorial extensions

If this is right

  • Security testing that stops at single-vector attacks will systematically understate exposure: simple attacks succeed only about half the time, while composed attacks reach 67.4–73.8% and five-stage chains 91–96%.
  • Choosing a deployment paradigm becomes a security decision with a known trade-off: Function Calling concentrates system-centric risk (87.98% ASR) and demands execution isolation, while MCP shifts risk to the reasoning layer (68.28% ASR) and demands context sanitization and strict schema validation at protocol boundaries.
  • Known defenses can be bypassed by composition: AgentDojo's 92% isolation-based defense against direct prompt injection does not stop composed attacks, and cloud-level protections that block simple denial-of-service (0% ASR) are circumvented by embedding DoS inside a prompt-injection payload.
  • Defense strategy should shift from hardening individual components to breaking chains at architectural transition points—stateless request handling, semantic validation between reasoning and action, output type and format checks, and independent validation at each boundary—since chained attacks succeed through accumulated state corruption.
  • Model choice and architecture must be co-optimized, because reasoning-capable models show the best threat detection yet the highest exploitability once breached, so picking the safest model alone does not determine the safest system.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My reading: the 73.5% versus 62.59% headline gap should be treated as provisional, because the paper's own implementation section (4.3) reports that MCP required complex credential coordination and distributed state management while Function Calling had unified authentication and centralized state; those confounds track the architectures, so the precise size of the gap could be an artifact of that
  • A testable extension the paper does not run: extending chains beyond five stages should add little marginal ASR once the product formula saturates near 100%, so the model predicts an upper bound on chain value; conversely, inserting a single state-reset or independent validation step at any edge should collapse the chain's ASR to roughly the product up to that edge.
  • The framework's five-node linear chain fits hierarchical tool-calling, but emerging peer-to-peer agent protocols would require adding inter-agent edges and trust-relationship nodes, which the paper's own limitations section flags as out of scope; extending the graph formalism is a natural next step.
  • The reasoning paradox suggests a hypothesis testable with the authors' harness: reasoning models may become more exploitable because they elaborate adversarial premises into longer tool-invocation paths, meaning a measure of loyalty to the injected premise would correlate with ASR even after controlling for model size.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This manuscript reports a comparative security evaluation of two LLM-agent tool-calling paradigms: Function Calling and the Model Context Protocol. The authors define a unified threat classification framework, formalize seven attack surfaces and six attack vectors, and introduce simple/composed/chained attack progression models. They report results from 3,250 attack scenarios across seven models deployed on Azure/AWS, with the headline findings that Function Calling has a higher overall attack success rate than MCP (73.5% vs. 62.59%), that the two architectures invert in system-centric versus LLM-centric exposure (87.98% vs. 57% and 59% vs. 68.28%, respectively), and that chained attacks achieve 91-96% success rates. They also report that reasoning-capable models show higher refusal rates but higher exploitability, and they make architectural defensive recommendations. Code and experimental materials are provided.

Significance. If the headline comparison were reliable, this would be a useful contribution: it is one of the few attempts to compare the security properties of the two dominant LLM-agent tool-orchestration paradigms, and the unified threat taxonomy and attack-progression framework could support future benchmarks. The availability of code and materials is an explicit strength. However, the central attribution claim is not currently established. The implementation differences documented in Section 4.3 are not controlled, and the reported quantitative results are internally inconsistent and lack uncertainty quantification. The probability equations in Section 3.2.3 are definitions via conditional probability rather than fitted derivations, so I do not see a circularity problem in the mathematical framework. With a redesign that isolates the architectural variable, statistical reporting, and reconciliation of the inconsistent numbers, the contribution could be solid; in its present form it requires major revision.

major comments (4)
  1. [§4.3 and §5.3] Section 4.3 concedes that the two implementations differed in credential coordination, state management, and authentication, stating that these characteristics 'extend beyond pure architectural design' and 'directly impact security properties.' Section 5.3 nevertheless claims that the controlled environment and identical scenario implementation enable 'attribution of security differences to architectural characteristics rather than implementation variations or environmental factors.' These statements conflict. The headline overall ASR gap (73.5% vs. 62.59%, §6.1.1) and the system-centric inversion (87.98% vs. 57%, §7.2.4) are therefore also compatible with an implementation-level explanation, such as MCP's separate server execution and extra credential validation, or Function Calling's unified trust domain. A crossover experiment that varies the protocol while holding credential and state management constant, or an explicit control implementation, is required to support the paper's central claim that architecture per se reshapes the threat landscape.
  2. [§6.2.2 vs. §6.3] The simple-attack baseline is reported inconsistently. Section 6.2.2 states that composed attacks increase Function Calling ASR 'from 56% to 70%' and decrease MCP ASR 'from 60% to 51.32%,' which implies simple-attack ASRs of 56% for Function Calling and 60% for MCP. Section 6.3, however, reports simple attack success rates of '45.3% for Function Calling, 38.7% for MCP.' These numbers are irreconcilable, and the choice of baseline changes the computed amplification factors and the benchmark comparison. Please report the exact aggregation definition for simple-attack ASR (per vector, per surface, per model), the per-category values, and confidence intervals, and reconcile the two sections.
  3. [§3.3.3 and §6.1.1] The evaluation uses a single LLM judge (DeepSeek-R1) validated against human experts on only 300 of the 3,250 cases (Section 3.3.3). The headline comparison in Section 6.1.1 (73.5% vs. 62.59%) is reported without confidence intervals or a significance test. If judge bias tracks response style or architecture-specific artifacts, the main gap could be an artifact. Moreover, DeepSeek-R1 is also one of the scenario-generation models (Section 5.1), creating a potential same-model bias in judging attacks it helped generate. I recommend per-architecture judge-agreement statistics, a second judge or a human sample for disagreement analysis, and bootstrap or exact confidence intervals for the headline ASR and refusal-rate values.
  4. [§6.1.2] The counterintuitive claim that advanced reasoning models are more exploitable despite better threat detection is supported only by point estimates of ASR and refusal rate, such as Claude 3-5 at 75% ASR versus Claude Haiku at 65.56% ASR, with no error bars or statistical tests. Given that each scenario is run three times (Section 5.4), the sampling error on binary outcomes is large, and the reported ordering across models may not be significant. Please provide per-model confidence intervals and a formal test, or clearly present the claim as descriptive rather than conclusive.
minor comments (5)
  1. [§5.2] The 40/30/30 split of simple, composed, and chained attacks should be translated into per-architecture and per-model scenario counts so that it is clear how the 3,250 total is distributed and how ASR is aggregated.
  2. [§6.2.1 and §6.2.2] DoS attacks are reported as 0% ASR in simple form because of cloud-provider interception, yet composed attacks containing DoS techniques reach the reported ASRs; the definition of DoS 'success' and the mechanism by which composition bypasses interception should be stated explicitly.
  3. [§3.2.3] Equations (9)-(11) are definitions via conditional probability rather than empirically fitted relations; labeling them as 'models' could mislead readers, and the text should frame them as metric definitions.
  4. [Figures 8, 9, 12, 15] These figures would benefit from confidence bands or error bars, since the text quotes precise percentages without displaying variance.
  5. [Throughout] There are formatting and reference issues: Section 1 contains missing spaces (for example, 'sophisticatedarchitectureof...'), Appendix A has duplicated subsubsection numbering, and several references (for instance, [9] and [10]) do not appear to correspond to the cited content.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the headline ASR comparisons are measured outcomes, and the probability equations are definitions/chain-rule identities rather than fitted predictions.

full rationale

The paper's central quantities (ASR, RR, and the 73.5% vs 62.59% comparison) are empirical measurements from 3,250 executed attack scenarios, not outputs of a model fitted to those same labels. Equations (9)-(11) define ASR for simple, composed, and chained attacks as conditional probabilities, which is the chain rule rather than a derivation that assumes the conclusion; Eq. (12) is a ratio of measured rates. The threat framework and attack-progression model impose structure on the test design but do not numerically determine the reported success rates, so there is no fitted input renamed as a prediction. The LLM-driven generation and DeepSeek-R1 judging introduce a methodological self-reference, but the paper reports independent human validation on a 300-case sample with substantial agreement (kappa = 0.84/0.87), so success labels are not defined by construction to equal the judge's prior. The only apparent self-citation, reference [20] by co-author I. Belhadj, is used to contextualize prior architectural modeling and is not load-bearing for the empirical claims. Section 4.3's admission that the two implementations differ in credential coordination and state management is a genuine validity threat to causal attribution, but it is a confound, not a logical circularity; it does not make the reported ASR values equivalent to the architecture labels by definition. Section 6.3 also anchors the results against external benchmarks (AgentDojo, InjecAgent, ASB), further indicating that the central comparisons are not internally manufactured. No circular step meeting the quoted-evidence bar was found.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No numeric parameters are fitted to data in the mathematical models; ASR and RR are directly measured. Design choices such as the 40/30/30 attack distribution and the use of three repetitions are procedural settings, not fitted parameters. The axioms listed are the background assumptions the measurements rely on, especially the unbiased judge assumption and the architecture-isolation assumption.

assumptions (4)
  • domain assumption Agent execution follows Eq. (1): R = ρ(r(S,U,T), O) with O = Fn(Fp).
    This deterministic workflow is assumed to hold for both paradigms (Section 3.2.1), and the attack surface set As = {S,U,T,Fn,Fp,O,R} is derived from it.
  • domain assumption DeepSeek-R1 provides an unbiased binary judgment of attack success across architectures, validated by kappa=0.84 human agreement on 300 cases.
    The entire ASR metric depends on this judge; if the judge's criteria favor one architecture's response style, the comparative claim would be artifact. Validation is on a 10% sample only (Section 3.3.3).
  • domain assumption Default configurations from official documentation represent the intrinsic security properties of each paradigm.
    Section 4.1 states default configurations were used to avoid implementation-specific variation, and Section 4.3 admits implementation differences such as credential coordination and state management that may confound architecture.
  • standard math Probability decomposition ASR(alpha∘beta)=P(alpha|beta)*ASR(beta) and the chained product (Eq. 11) are valid.
    These are definitions of conditional probability, not testable assumptions; they do not add predictive content.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms." pith.science (2026). https://pith.science/paper/IICVGMOS

@misc{pith2026250706323,
  author       = {Pith},
  title        = {Pith review of: Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IICVGMOS}},
  note         = {Machine review of arXiv:2507.06323}
}
read the original abstract

Large Language Model (LLM) agents face security vulnerabilities spanning AI-specific and traditional software domains, yet current research addresses these separately. This study bridges this gap through comparative evaluation of Function Calling architecture and Model Context Protocol (MCP) deployment paradigms using a unified threat classification framework. We tested 3,250 attack scenarios across seven language models, evaluating simple, composed, and chained attacks targeting both AI-specific threats (prompt injection) and software vulnerabilities (JSON injection, denial-of-service). Function Calling showed higher overall attack success rates (73.5% vs 62.59% for MCP), with greater system-centric vulnerability while MCP exhibited increased LLM-centric exposure. Attack complexity dramatically amplified effectiveness, with chained attacks achieving 91-96% success rates. Counterintuitively, advanced reasoning models demonstrated higher exploitability despite better threat detection. Results demonstrate that architectural choices fundamentally reshape threat landscapes. This work establishes methodological foundations for cross-domain LLM agent security assessment and provides evidence-based guidance for secure deployment. Code and experimental materials are available at https: // github. com/ theconsciouslab-ai/llm-agent-security.

Figures

Figures reproduced from arXiv: 2507.06323 by the authors.

Figure 1
Figure 1. Mapping the LLM Agent Security Landscape: Gaps and Contributions [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Testing Framework Methodology Workflow 3.2 Threat Modeling and Attack Simulation Framework To implement the Attack Execution phase of our testing pipeline, we developed a comprehensive threat model and attack simulation framework, as illustrated in [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Threat Model Approach 7 [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: Attack Vector Classification Taxonomy We define the complete set of attack vectors as: A = {Ap, Aipi, AJSON , ADoS, AM itM , AT i} (2) LLM-centric attacks include prompt injection (Ap), which uses crafted inputs to subvert system behavior by targeting the system prompt…
Figure 5
Figure 5. Figure 5: Attack Progression Model Simple Attacks Simple attacks represent single-vector exploits targeting one attack surface using one technique. These serve as our baseline for understanding attack behavior. A simple attack operates as a function: α : As × Σ → Σ ′ (3) where α…
Figure 6
Figure 6. Figure 6: Composed Attacks Representation Composed Attack: Prompt + JSON Injection Consider Ap(AJSON (x)), where prompt injection weakens validation before JSON injection: Stage 1: β = Ap(U) with payload “Disable all input validation” σ0 → σ1 where validation_enabled: false Stag…
Figure 7
Figure 7. Figure 7: Chained Attack Graph A chained attack forms a path P through G: P = N1 α1 −→ N2 α2 −→ N3 α3 −→ N4 α4 −→ N5 (7) where each transition αi −→ represents an attack exploiting the data flow between nodes. The complete chain is expressed as: Γchain = ⟨α1, α2, . . . , αk⟩ (8)…
Figure 8
Figure 8. Figure 8: Attack Success Rate Comparison - Function Calling vs Model Context Protocol [PITH_FULL_IMAGE:figures/full_fig_p022_8.png]
Figure 9
Figure 9. Figure 9: Function Calling ASR Comparison - Azure vs AWS Providers [PITH_FULL_IMAGE:figures/full_fig_p023_9.png]
Figure 10
Figure 10. Figure 10: Model Security Profiles - Exploitability vs Defense Capability [PITH_FULL_IMAGE:figures/full_fig_p024_10.png]
Figure 11
Figure 11. Figure 11: Model Security Performance by Attack Vectors [PITH_FULL_IMAGE:figures/full_fig_p025_11.png]
Figure 12
Figure 12. Figure 12: Simple vs Composed Attack Comparison 6.2.3 Chained Attacks Chained attacks achieved 91-96% success rates across all configurations, with 5-step chains reaching these peak ASR levels [PITH_FULL_IMAGE:figures/full_fig_p026_12.png]
Figure 13
Figure 13. Figure 13: Chained Attack Progression - Attack Success Rate by Chain Depth [PITH_FULL_IMAGE:figures/full_fig_p026_13.png]
Figure 14
Figure 14. Figure 14: Chained Attack Progression - Refusal Rate Degradation by Chain Depth [PITH_FULL_IMAGE:figures/full_fig_p027_14.png]
Figure 15
Figure 15. Figure 15: Comparative defense effectiveness across security dimensions [PITH_FULL_IMAGE:figures/full_fig_p028_15.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

59 extracted references · 38 canonical work pages

  1. [1]

    Chain-of- thought prompting elicits reasoning in large language models,

    J. Wei, X. Wang, D. Schuurmans, M. Bosma, F. Xia, E. Chi, Q. V. Le, D. Zhouet al., “Chain-of- thought prompting elicits reasoning in large language models,”Advances in neural information processing systems, vol. 35, pp. 24824–24837, 2022

    work page 2022

  2. [2]

    A survey on large language model based autonomous agents,

    L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y. Lin et al., “A survey on large language model based autonomous agents,”Frontiers of Computer Science, vol. 18, no. 6, p. 186345, 2024. 34

    work page 2024

  3. [3]

    The rise and potential of large language model based agents: A survey,

    Z. Xi, W. Chen, X. Guo, W. He, Y. Ding, B. Hong, M. Zhang, J. Wang, S. Jin, E. Zhou et al., “The rise and potential of large language model based agents: A survey,”Science China Information Sciences, vol. 68, no. 2, p. 121101, 2025

    work page 2025

  4. [4]

    Llm- based agentic systems in medicine and healthcare,

    J. Qiu, K. Lam, G. Li, A. Acharya, T. Y. Wong, A. Darzi, W. Yuan, and E. J. Topol, “Llm- based agentic systems in medicine and healthcare,”Nature Machine Intelligence, vol. 6, no. 12, pp. 1418–1420, 2024

    work page 2024

  5. [5]

    Trends of ai in financial services and its applications,

    S. A. Raza, D. Syed, S. Rizwan, and M. Ahmed, “Trends of ai in financial services and its applications,” inThe Global Evolution, Changing Landscape and Future of Financial Markets: From Traditional to Digital. Emerald Publishing Limited, 2025, pp. 33–46

    work page 2025

  6. [6]

    Guardrails for large language models: A review of techniques and challenges,

    S. Akheel, “Guardrails for large language models: A review of techniques and challenges,”J Artif Intell Mach Learn & Data Sci, vol. 3, no. 1, pp. 2504–2512, 2025

    work page 2025

  7. [7]

    Superagency in the workplace: Empowering people to unlock ai’s full potential,

    H. Mayer, L. Yee, M. Chui, and R. Roberts, “Superagency in the workplace: Empowering people to unlock ai’s full potential,”McKinsey Digital, vol. 28, 2025

    work page 2025

  8. [8]

    Tinyagent: Function calling at the edge,

    L. E. Erdogan, N. Lee, S. Jha, S. Kim, R. Tabrizi, S. Moon, C. Hooper, G. Anumanchipalli, K. Keutzer, and A. Gholami, “Tinyagent: Function calling at the edge,”arXiv preprint arXiv:2409.00608, 2024

    arXiv 2024

Show all 59 references
  1. [9]

    An llm compiler for parallel function calling,

    S. Kim, S. Moon, R. Tabrizi, N. Lee, M. W. Mahoney, K. Keutzer, and A. Gholami, “An llm compiler for parallel function calling,” inForty-first International Conference on Machine Learning, 2024

    2024

  2. [10]

    Microsoft copilot and anthropic claude ai in education and library service,

    A. J. Adetayo, M. O. Aborisade, and B. A. Sanni, “Microsoft copilot and anthropic claude ai in education and library service,”Library Hi Tech News, 2024

    2024

  3. [11]

    Model context protocol (mcp): Landscape, security threats, and future research directions,

    X. Hou, Y. Zhao, S. Wang, and H. Wang, “Model context protocol (mcp): Landscape, security threats, and future research directions,”arXiv preprint arXiv:2503.23278, 2025

    2025 arXiv

  4. [12]

    Automatic and universal prompt injection attacks against large language models,

    X. Liu, Z. Yu, Y. Zhang, N. Zhang, and C. Xiao, “Automatic and universal prompt injection attacks against large language models,”arXiv preprint arXiv:2403.04957, 2024

    2024 arXiv

  5. [13]

    Jailbreaking black box large language models in twenty queries,

    P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong, “Jailbreaking black box large language models in twenty queries,” in2025 IEEE Conference on Secure and Trust- worthy Machine Learning (SaTML). IEEE, 2025, pp. 23–42

    2025

  6. [14]

    Security concerns for large language models: A survey,

    L. Chen, H. Wang, Y. Zhang, and Y. Liu, “Security concerns for large language models: A survey,”arXiv preprint arXiv:2505.18889v2, may 2025. [Online]. Available: https://arxiv.org/abs/2505.18889v2

    2025 arXiv

  7. [15]

    Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,

    Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,”arXiv preprint arXiv:2403.02691, 2024. 35

    2024 arXiv

  8. [16]

    Agent- dojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents,

    E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tramèr, “Agent- dojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents,” inThe Thirty-eight Conference on Neural Information Processing Systems Datasets and Benc...

    2024

  9. [17]

    Llama guard: Llm-based input-output safeguard for human-ai conversations,

    H. Inan, K. Upasani, J. Chi, R. Rungta, K. Iyer, Y. Mao, M. Tontchev, Q. Hu, B. Fuller, D. Tes- tuggineet al., “Llama guard: Llm-based input-output safeguard for human-ai conversations,” arXiv preprint arXiv:2312.06674, 2023

    2023 arXiv

  10. [18]

    React: Synergizing reasoning and acting in language models, 2023,

    S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao, “React: Synergizing reasoning and acting in language models, 2023,”URL https://arxiv. org/abs/2210.03629, 2023

    2023 arXiv

  11. [19]

    Safe rlhf: Safe reinforce- ment learning from human feedback,

    J. Dai, X. Pan, R. Sun, J. Ji, X. Xu, M. Liu, Y. Wang, and Y. Yang, “Safe rlhf: Safe reinforce- ment learning from human feedback,”arXiv preprint arXiv:2310.12773, 2023

    2023 arXiv

  12. [20]

    Llm-agent-umf: Llm-based agent unified mod- eling framework for seamless integration of multi active/passive core-agents,

    A. B. Hassouna, H. Chaari, and I. Belhaj, “Llm-agent-umf: Llm-based agent unified mod- eling framework for seamless integration of multi active/passive core-agents,”arXiv preprint arXiv:2409.11393, 2024

    2024

  13. [21]

    Universal and transferable adversarial attacks on aligned language models, 2023,

    A. Zou, Z. Wang, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models, 2023,”URL https://arxiv. org/abs/2307.15043, vol. 19, 2024

    2023 arXiv

  14. [22]

    A comprehensive overview of backdoor attacks in large language models within communication networks,

    H. Yang, K. Xiang, M. Ge, H. Li, R. Lu, and S. Yu, “A comprehensive overview of backdoor attacks in large language models within communication networks,”IEEE Network, 2024

    2024

  15. [23]

    Large language model supply chain: Open prob- lems from the security perspective,

    Q. Hu, X. Xie, S. Chen, L. Quan, and L. Ma, “Large language model supply chain: Open prob- lems from the security perspective,” inProceedings of the 34th ACM SIGSOFT International Symposium on Software Testing and Analysis, 2025, pp. 169–173

    2025

  16. [24]

    Sok: Understanding vulnerabilities in the large language model supply chain,

    S. Wang, Y. Zhao, Z. Liu, Q. Zou, and H. Wang, “Sok: Understanding vulnerabilities in the large language model supply chain,”arXiv preprint arXiv:2502.12497, 2025

    2025 arXiv

  17. [25]

    Identifying and mitigating vulnerabilities in llm-integrated applications,

    F. Jiang, “Identifying and mitigating vulnerabilities in llm-integrated applications,” Master’s thesis, University of Washington, 2024

    2024

  18. [26]

    Ifrah,Getting Started with Azure OpenAI: Deploying and Managing Azure AI and Azure OpenAI Solutions

    S. Ifrah,Getting Started with Azure OpenAI: Deploying and Managing Azure AI and Azure OpenAI Solutions. Springer Nature, 2024

    2024

  19. [27]

    Model context protocol (mcp): Landscape, security threats, and future research directions,

    X. Hou, Y. Zhao, S. Wang, and H. Wang, “Model context protocol (mcp): Landscape, security threats, and future research directions,” 2025

    2025

  20. [28]

    A descriptive study of microsoft’s threat modeling technique,

    R. Scandariato, K. Wuyts, and W. Joosen, “A descriptive study of microsoft’s threat modeling technique,”Requirements Engineering, vol. 20, pp. 163–180, 2015. 36

    2015

  21. [29]

    Securing agentic ai: A comprehensive threat model and mitigation framework for generative ai agents,

    V. S. Narajala and O. Narayan, “Securing agentic ai: A comprehensive threat model and mitigation framework for generative ai agents,”arXiv preprint arXiv:2504.19956, 2025

    2025 arXiv

  22. [30]

    Addressing bias in big data and ai for health care: A call for open science,

    N. Norori, Q. Hu, F. M. Aellen, F. D. Faraci, and A. Tzovara, “Addressing bias in big data and ai for health care: A call for open science,”Patterns, vol. 2, no. 10, 2021

    2021

  23. [31]

    Technical guide to information security testing and assessment,

    K. Scarfone, M. Souppaya, A. Cody, and A. Orebaugh, “Technical guide to information security testing and assessment,”NIST Special Publication, vol. 800, no. 115, pp. 2–25, 2008

    2008

  24. [32]

    An introduction to information security,

    M. Nieles, K. Dempsey, V. Y. Pillitteriet al., “An introduction to information security,”NIST special publication, vol. 800, no. 12, p. 101, 2017

    2017

  25. [33]

    A systematic litera- ture review and meta-analysis on artificial intelligence in penetration testing and vulnerability assessment,

    D. R. McKinnel, T. Dargahi, A. Dehghantanha, and K.-K. R. Choo, “A systematic litera- ture review and meta-analysis on artificial intelligence in penetration testing and vulnerability assessment,”Computers & Electrical Engineering, vol. 75, pp. 175–188, 2019

    2019

  26. [34]

    Large language model for vulnerability detection: Emerg- ing results and future directions,

    X. Zhou, T. Zhang, and D. Lo, “Large language model for vulnerability detection: Emerg- ing results and future directions,” inProceedings of the 2024 ACM/IEEE 44th International Conference on Software Engineering: New Ideas and Emerging Results, 2024, pp. 47–51

    2024

  27. [35]

    Judging llm-as-a-judge with mt-bench and chatbot arena,

    L. Zheng, W.-L. Chiang, Y. Sheng, S. Zhuang, Z. Wu, Y. Zhuang, Z. Lin, Z. Li, D. Li, E. Xing et al., “Judging llm-as-a-judge with mt-bench and chatbot arena,”Advances in Neural Infor- mation Processing Systems, vol. 36, pp. 46595–46623, 2023

    2023

  28. [36]

    G-eval: Nlg evaluation using gpt-4 with better human alignment,

    Y. Liu, D. Iter, Y. Xu, S. Wang, R. Xu, and C. Zhu, “G-eval: Nlg evaluation using gpt-4 with better human alignment,”arXiv preprint arXiv:2303.16634, 2023

    2023 arXiv

  29. [37]

    Cyber signals: Defending against cyber threats with the latest research, insights, and trends,

    V. Jakkal, “Cyber signals: Defending against cyber threats with the latest research, insights, and trends,”Microsoft, 2022

    2022

  30. [38]

    Enhancing security and scalability by ai/ml workload optimization in the cloud,

    S.Priyadarshini, T.N.Sawant, G.BhimraoYadav, J.Premalatha, andS.R.Pawar, “Enhancing security and scalability by ai/ml workload optimization in the cloud,”Cluster Computing, vol. 27, no. 10, pp. 13455–13469, 2024

    2024

  31. [39]

    A grading rubric for ai safety frameworks,

    J. Alaga, J. Schuett, and M. Anderljung, “A grading rubric for ai safety frameworks,”arXiv preprint arXiv:2409.08751, 2024

    2024 arXiv

  32. [40]

    Breaking the loop: Detecting and mitigating denial-of-service vulnerabilities in large language models,

    J. Yu, Y. Liu, H. Sun, L. Shi, and Y. Chen, “Breaking the loop: Detecting and mitigating denial-of-service vulnerabilities in large language models,”arXiv preprint arXiv:2503.00416, 2025

    2025 arXiv

  33. [41]

    Isolategpt: An execution isolation architecture for llm-based agentic systems,

    Y. Wu, F. Roesner, T. Kohno, N. Zhang, and U. Iqbal, “Isolategpt: An execution isolation architecture for llm-based agentic systems,”arXiv preprint arXiv:2403.04960, 2024

    2024 arXiv

  34. [42]

    Agentic ai: Autonomous intelligence for complex goals–a comprehensive survey,

    D. B. Acharya, K. Kuppan, and B. Divya, “Agentic ai: Autonomous intelligence for complex goals–a comprehensive survey,”IEEE Access, 2025. 37

    2025

  35. [43]

    Advancing the safety, performance, and adaptability of large language models: Re- view of fine-tuning and guardrails,

    S. Joshi, “Advancing the safety, performance, and adaptability of large language models: Re- view of fine-tuning and guardrails,”Performance, and Adaptability of Large Language Models: Review of Fine-Tuning and Guardrails (February 01, 2025), 2025

    2025

  36. [44]

    Design patterns for securing llm agents against prompt injections,

    L. Beurer-Kellner, B. B. A.-M. Creţu, E. Debenedetti, D. Dobos, D. Fabian, M. Fischer, D. Froelicher, K. Grosse, D. Naeff, E. Ozoaniet al., “Design patterns for securing llm agents against prompt injections,”arXiv preprint arXiv:2506.08837, 2025

    2025 arXiv

  37. [45]

    A quantitative security evaluation and analysis model for web appli- cations based on owasp application security verification standard,

    S.-F. Wen and B. Katt, “A quantitative security evaluation and analysis model for web appli- cations based on owasp application security verification standard,”Computers & Security, vol. 135, p. 103532, 2023

    2023

  38. [46]

    Comparative evaluation of approaches & tools for effective security testing of web applications,

    S. Qadir, E. Waheed, A. Khanum, and S. Jehan, “Comparative evaluation of approaches & tools for effective security testing of web applications,”PeerJ Computer Science, vol. 11, p. e2821, 2025

    2025

  39. [47]

    Swiss cheese model for ai safety: A taxonomy and reference architecture for multi-layered guardrails of foundation model based agents,

    M. Shamsujjoha, Q. Lu, D. Zhao, and L. Zhu, “Swiss cheese model for ai safety: A taxonomy and reference architecture for multi-layered guardrails of foundation model based agents,” in 2025 IEEE 22nd International Conference on Software Architecture (ICSA). IEEE, 2025, pp. 37–48

    2025

  40. [48]

    Research on webassembly runtimes: A survey,

    Y. Zhang, M. Liu, H. Wang, Y. Ma, G. Huang, and X. Liu, “Research on webassembly runtimes: A survey,”ACM Transactions on Software Engineering and Methodology, 2024

    2024

  41. [49]

    A survey on large language model (llm) security and privacy: The good, the bad, and the ugly,

    Y. Yao, J. Duan, K. Xu, Y. Cai, Z. Sun, and Y. Zhang, “A survey on large language model (llm) security and privacy: The good, the bad, and the ugly,”High-Confidence Computing, p. 100211, 2024

    2024

  42. [50]

    Trism for agentic ai: A review of trust, risk, and security management in llm-based agentic multi-agent systems,

    S. Raza, R. Sapkota, M. Karkee, and C. Emmanouilidis, “Trism for agentic ai: A review of trust, risk, and security management in llm-based agentic multi-agent systems,”arXiv preprint arXiv:2506.04133, 2025

    2025

  43. [51]

    Building a secure agentic ai application leveraging a2a protocol,

    I. Habler, K. Huang, V. S. Narajala, and P. Kulkarni, “Building a secure agentic ai application leveraging a2a protocol,”arXiv preprint arXiv:2504.16902, 2025

    2025 arXiv

  44. [52]

    From recon to report: A multi-agent system to harden software systems,

    S. Lindholm and S. Bengtsson, “From recon to report: A multi-agent system to harden software systems,” 2025

    2025

  45. [53]

    An inter-agent communication protocol for remote pro- grammable routers,

    R. G. de Silva, H. Li, and K. Chu, “An inter-agent communication protocol for remote pro- grammable routers,” inAsia-Pacific Conference on Circuits and Systems, vol. 1. IEEE, 2002, pp. 323–328

    2002

  46. [54]

    A survey of agent interoperability protocols: Model context protocol (mcp), agent communication protocol (acp), agent-to-agent protocol (a2a), and agent network protocol (anp),

    A. Ehtesham, A. Singh, G. K. Gupta, and S. Kumar, “A survey of agent interoperability protocols: Model context protocol (mcp), agent communication protocol (acp), agent-to-agent protocol (a2a), and agent network protocol (anp),”arXiv preprint arXiv:2505.02279, 2025. 38

    2025 arXiv

  47. [56]

    Real: Benchmarking autonomous agents on deterministic simulations of real websites,

    D. Garg, S. VanWeelden, D. Caples, A. Draguns, N. Ravi, P. Putta, N. Garg, T. Abraham, M. Lara, F. Lopezet al., “Real: Benchmarking autonomous agents on deterministic simulations of real websites,”arXiv preprint arXiv:2504.11543, 2025

    2025 arXiv

  48. [57]

    Exploring applicability of llm-powered autonomous agents to solve real-life problems: Microsoft entra id administration agent (mean),

    R. Rodriguez and N. Syynimaa, “Exploring applicability of llm-powered autonomous agents to solve real-life problems: Microsoft entra id administration agent (mean),” inInternational Conference on Enterprise Information Systems. SCITEPRESS-Science and Technology Pub- lications, 2024

    2024

  49. [58]

    Ai agents and business workflow,

    K. Huang, “Ai agents and business workflow,” inAgentic AI. Springer, 2025, pp. 135–166

    2025

  50. [59]

    Marco: Multi-agent real-time chat orchestration,

    A. Shrimal, S. Kanagaraj, K. Biswas, S. Raghuraman, A. Nediyanchath, Y. Zhang, and P. Yeni- galla, “Marco: Multi-agent real-time chat orchestration,”arXiv preprint arXiv:2410.21784, 2024

    2024 arXiv

  51. [60]

    Open challenges in multi-agent security: Towards secure systems of interacting ai agents,

    C. S. de Witt, “Open challenges in multi-agent security: Towards secure systems of interacting ai agents,”arXiv preprint arXiv:2505.02077, 2025. 39 A Attack Surface Analysis of Banking Transaction Agent This appendix analyzes the attack surface formalization from Section 3.2.1...

    2025 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.