Search papers, labs, and topics across Lattice.
This paper synthesizes findings from 247 studies to analyze the security risks associated with large language model (LLM) agents as they evolve from conversational interfaces to more complex software components. The research identifies key threat surfaces, such as prompt injection and tool-mediated control-flow hijacking, while highlighting emerging concerns like persistent state corruption and multi-agent propagation. The authors argue for the establishment of explicit trust boundaries and improved evaluation practices to enhance the security of LLM agents in real-world applications.
Prompt injection and tool-mediated control-flow hijacking dominate LLM agent security threats, but emerging risks like persistent state corruption are on the rise.
Large language model (LLM) agents are rapidly moving from conversational interfaces to software components that plan, invoke tools, maintain memory, and act on external environments. This transition changes the nature of security risk. In agentic settings, failures are no longer limited to unsafe text generation. Untrusted content may redirect control flow, misuse tool privileges, corrupt persistent state, leak sensitive information, or trigger harmful external actions. At the same time, research on LLM agent security is expanding quickly but remains fragmented across attack families, defense layers, application domains, and evaluation settings. This paper synthesizes 247 papers through a lifecycle-based, systems-oriented framework that models agent security around the interaction of information flow, delegated authority, and persistent state. We organize the literature around four questions: how LLM agent security should be modeled, which threat surfaces and attack families dominate, what defenses have been proposed and with what tradeoffs, and how security claims are evaluated. We find that prompt injection and tool-mediated control-flow hijacking still dominate the field, while persistent state corruption and multi-agent propagation are becoming central emerging concerns. We further find that current defenses provide useful building blocks but remain weakly compositional, and that existing benchmarks still underrepresent long-horizon, stateful, and deployment-sensitive risks. We argue that secure LLM agents require explicit trust boundaries, principled privilege control, provenance-aware state management, and evaluation practices aligned with realistic operational settings.
