Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges

Agentic AI systems pose fundamentally new security risks that differ from traditional AI safety concerns and conventional software security. The combination of autonomous planning, tool use, memory, and the ability to execute tasks across web, software, and physical environments creates "new and amplified security risks" that require specialized attention rather than applying existing security frameworks.

A comprehensive taxonomy of threats is needed to guide security efforts. The paper outlines a structured taxonomy of threats specific to agentic AI systems, suggesting that understanding the full landscape of potential vulnerabilities—rather than addressing isolated concerns—is essential for developing effective defenses and governance approaches.

Current evaluation methodologies and benchmarks are insufficient. The paper reviews "recent benchmarks and evaluation methodologies," implying that existing tools for assessing agentic AI security are incomplete. This gap means organizations may not have adequate ways to test whether their autonomous systems are actually secure before deployment.

Both technical and governance defenses are necessary. The paper emphasizes that security requires "defense strategies from both technical and governance perspectives," indicating that code-level protections alone are insufficient—policy, oversight mechanisms, and institutional controls must work alongside technical safeguards.

The field faces significant open challenges requiring ongoing research. By highlighting "open challenges," the paper signals that secure-by-design agentic AI systems remain an unsolved problem, suggesting caution is warranted as these systems are deployed while research continues.