# Securing Agentic AI: A Comprehensive Threat Model and Mitigation Framework for Generative AI Agents arXiv: https://arxiv.org/abs/2504.19956 ยท HTML: https://mlsanity.com/paper/2504.19956/ ## Key facts - Cited by 32 papers in the map (data through 14 Oct 2026). - Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. - Builds on 4 of its 21 references that are in the map. - First posted on arXiv 28 Apr 2025. ## Placed in - LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/) ## Builds on (most cited first, 4 of 4) - [AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases](https://mlsanity.com/paper/2407.12784/) (2024) - [The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies](https://mlsanity.com/paper/2407.19354/) (2024) - [Towards Effective GenAI Multi-Agent Collaboration: Design and Evaluation for Enterprise Applications](https://mlsanity.com/paper/2412.05449/) (2024) - [Safeguarding AI Agents: Developing and Analyzing Safety Architectures](https://mlsanity.com/paper/2409.03793/) (2024) ## Built on by (most cited first, 30 of 32) - [Agentic AI: A Comprehensive Survey of Architectures, Applications, and Future Directions](https://mlsanity.com/paper/2510.25445/) (2025) - [Agentic Web: Weaving the Next Web with AI Agents](https://mlsanity.com/paper/2507.21206/) (2025) - [A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents](https://mlsanity.com/paper/2506.23844/) (2025) - [A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes](https://mlsanity.com/paper/2601.05293/) (2026) - [ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control](https://mlsanity.com/paper/2506.01333/) (2025) - [A Survey on Agentic Security: Applications, Threats and Defenses](https://mlsanity.com/paper/2510.06445/) (2025) - [SoK: The Attack Surface of Agentic AI - Tools and Autonomy](https://mlsanity.com/paper/2603.22928/) (2026) - [From Code Foundation Models to Agents and Applications: A Comprehensive Survey and Practical Guide to Code Intelligence](https://mlsanity.com/paper/2511.18538/) (2025) - [Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration](https://mlsanity.com/paper/2605.01970/) (2026) - [AgentDoG 1.5: A Lightweight and Scalable Alignment Framework for AI Agent Safety and Security](https://mlsanity.com/paper/2605.29801/) (2026) - [Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms](https://mlsanity.com/paper/2507.06323/) (2025) - [BetaWeb: Towards a Blockchain-enabled Trustworthy Agentic Web](https://mlsanity.com/paper/2508.13787/) (2025) - [Federation of Agents: A Semantics-Aware Communication Fabric for Large-Scale Agentic AI](https://mlsanity.com/paper/2509.20175/) (2025) - [Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation](https://mlsanity.com/paper/2606.10749/) (2026) - [ATAG: AI-Agent Application Threat Assessment with Attack Graphs](https://mlsanity.com/paper/2506.02859/) (2025) - [Fortifying the Agentic Web: A Unified Zero-Trust Architecture Against Logic-layer Threats](https://mlsanity.com/paper/2508.12259/) (2025) - [Clawed and Dangerous: Can We Trust Open Agentic Systems?](https://mlsanity.com/paper/2603.26221/) (2026) - [Towards Unifying Quantitative Security Benchmarking for Multi Agent Systems](https://mlsanity.com/paper/2507.21146/) (2025) - [Analyzing Code Injection Attacks on LLM-based Multi-Agent Systems in Software Development](https://mlsanity.com/paper/2512.21818/) (2025) - [Human Society-Inspired Approaches to Agentic AI Security: The 4C Framework](https://mlsanity.com/paper/2602.01942/) (2026) - [Parallax: Why AI Agents That Think Must Never Act](https://mlsanity.com/paper/2604.12986/) (2026) - [AgenticVM: Agentic AI for Adaptive Software Vulnerability Management](https://mlsanity.com/paper/2605.01739/) (2026) - [Reflection-Driven Control for Trustworthy Code Agents](https://mlsanity.com/paper/2512.21354/) (2025) - [Differential Privacy in Generative AI Agents: Analysis and Optimal Tradeoffs](https://mlsanity.com/paper/2603.17902/) (2026) - [The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems](https://mlsanity.com/paper/2605.22842/) (2026) - [Intellicise Wireless Networks Meet Agentic AI: A Security and Privacy Perspective](https://mlsanity.com/paper/2602.15290/) (2026) - [PYTHALAB-MERA: Validation-Grounded Memory, Retrieval, and Acceptance Control for Frozen-LLM Coding Agents](https://mlsanity.com/paper/2605.08468/) (2026) - [Security Risks in Tool-Enabled AI Agents: A Systematic Analysis of Privileged Execution Environments](https://mlsanity.com/paper/2605.09721/) (2026) - [Agent Security Meets Regulatory Reality -- A Practitioner Systematization of Autonomous-Agent Threats and Controls in Regulated Financial Systems](https://mlsanity.com/paper/2606.29142/) (2026) - [On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models](https://mlsanity.com/paper/2608.10530/) (2026) ## Abstract (arXiv) As generative AI (GenAI) agents become more common in enterprise settings, they introduce security challenges that differ significantly from those posed by traditional systems. These agents are not just LLMs; they reason, remember, and act, often with minimal human oversight. This paper introduces a comprehensive threat model tailored specifically for GenAI agents, focusing on how their autonomy, persistent memory access, complex reasoning, and tool integration create novel risks. This research work identifies 9 primary threats and organizes them across five key domains: cognitive architecture vulnerabilities, temporal persistence threats, operational execution vulnerabilities, trust boundary violations, and governance circumvention. These threats are not just theoretical they bring practical challenges such as delayed exploitability, cross-system propagation, cross system lateral movement, and subtle goal misalignments that are hard to detect with existing frameworks and standard approaches. To help address this, the research work present two complementary frameworks: ATFAA - Advanced Threat Framework for Autonomous AI Agents, which organizes agent-specific risks, and SHIELD, a framework proposing practical mitigation strategies designed to reduce enterprise exposure. While this work builds on existing work in LLM and AI security, the focus is squarely on what makes agents different and why those differences matter. Ultimately, this research argues that GenAI agents require a new lens for security. If we fail to adapt our threat models and defenses to account for their unique architecture and behavior, we risk turning a powerful new tool into a serious enterprise liability.