Search papers, labs, and topics across Lattice.
This paper conducts a systematic literature review to assess vulnerabilities in agentic large language models (LLMs), revealing a significant imbalance where attack research outpaces defense efforts by a ratio of 3.9:1. The analysis identifies that 66% of vulnerabilities are perception-layer issues, such as prompt injection and jailbreaking, while action-layer vulnerabilities, which pose greater real-world risks, are underrepresented at only 4.7%. A novel four-layer taxonomy is introduced to categorize 13 types of vulnerabilities, highlighting the critical issue of architectural coupling that facilitates the propagation of these vulnerabilities across layers.
A staggering 66% of vulnerabilities in agentic LLMs stem from perception-layer issues, while action-layer risks remain alarmingly underexplored.
Large Language Models (LLMs) have undergone a shift from stateless conversational interfaces to autonomous agents capable of multi-step planning, tool invocation, code execution, and maintaining persistent memory. When these agents operate with real-world privileges---calling APIs, modifying files, and querying databases---a compromised reasoning step can trigger unauthorized data access, irreversible state changes, or cascading failures, yet the security research community has not kept pace. To quantify the state of the field, we conducted a systematic literature review under PRISMA 2020 guidelines across six databases, screening 743 records and retaining 85 papers (2023--2025) on agentic LLM security. Attack research outpaces defense work by 3.9:1. Perception-layer vulnerabilities (prompt injection, jailbreaking, adversarial perturbations) dominate, accounting for 66\% of papers, while action-layer vulnerabilities (tool misuse, code injection, sandbox escape) appear in only 4.7\%, misaligned with real-world risk. Code execution security accounts for 3.5\%, and tool-augmented agents 12\%. We contribute a four-layer taxonomy mapping 13 vulnerability types across perception, brain, action, and interaction layers, and identify seven open problems centered on containment. Agentic LLM insecurity stems from architectural coupling, where weak isolation allows vulnerabilities to propagate across layers.
