# MobiLLM: An Agentic AI Framework for Closed-Loop Threat Mitigation in 6G Open RANs

arXiv: https://arxiv.org/abs/2509.21634 · HTML: https://mlsanity.com/paper/2509.21634/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Placed in Agentic AI for wireless networks, one of 16 directions in LLM agents and tool use.
- Builds on 16 of its 30 references that are in the map.
- First posted on arXiv 25 Sep 2025.

## Placed in

- LLM agents and tool use / [Agentic AI for wireless networks](https://mlsanity.com/agents/agentic-ai-for-wireless-networks/)

## Builds on (most cited first, 16 of 16)

- [LoRA: Low-Rank Adaptation of Large Language Models](https://mlsanity.com/paper/2106.09685/) (2021)
- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [Small Language Models are the Future of Agentic AI](https://mlsanity.com/paper/2506.02153/) (2025)
- [Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems](https://mlsanity.com/paper/2410.07283/) (2024)
- [Understanding O-RAN: Architecture, Interfaces, Algorithms, Security, and Research Challenges](https://mlsanity.com/paper/2202.01032/) (2022)
- [BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models](https://mlsanity.com/paper/2408.12798/) (2024)
- [TelecomGPT: A Framework to Build Telecom-Specfic Large Language Models](https://mlsanity.com/paper/2407.09424/) (2024)
- [ColO-RAN: Developing Machine Learning-based xApps for Open RAN Closed-loop Control on Programmable Experimental Platforms](https://mlsanity.com/paper/2112.09559/) (2021)
- [Programmable and Customized Intelligence for Traffic Steering in 5G Networks Using Open RAN Architectures](https://mlsanity.com/paper/2209.14171/) (2022)
- [OrchestRAN: Network Automation through Orchestrated Intelligence in the Open RAN](https://mlsanity.com/paper/2201.05632/) (2022)
- [End-to-End Edge AI Service Provisioning Framework in 6G ORAN](https://mlsanity.com/paper/2503.11933/) (2025)
- [LLM-hRIC: LLM-empowered Hierarchical RAN Intelligent Control for O-RAN](https://mlsanity.com/paper/2504.18062/) (2025)
- [AdaptOver: Adaptive Overshadowing Attacks in Cellular Networks](https://mlsanity.com/paper/2106.05039/) (2021)
- [ORAN-GUIDE: RAG-Driven Prompt Learning for LLM-Augmented Reinforcement Learning in O-RAN Network Slicing](https://mlsanity.com/paper/2506.00576/) (2025)
- [LTrack: Stealthy Tracking of Mobile Phones in LTE](https://mlsanity.com/paper/2106.05007/) (2021)
- [You have been warned: Abusing 5G's Warning and Emergency Systems](https://mlsanity.com/paper/2207.02506/) (2022)

## Built on by (most cited first, 2 of 2)

- [Autonomy in Check: Governor-Mediated Adaptive Security at the Edge](https://mlsanity.com/paper/2609.18338/) (2026)
- [A Proposal for an Agentic AI Architecture to Support Multi-Domain Decision-Making in the Brazilian Armed Forces](https://mlsanity.com/paper/2609.20080/) (2026)

## Abstract (arXiv)

The evolution toward 6G networks is being accelerated by the Open Radio Access Network (O-RAN) paradigm -- an open, interoperable architecture that enables intelligent, modular applications across public telecom and private enterprise domains. While this openness creates unprecedented opportunities for innovation, it also expands the attack surface, demanding resilient, low-cost, and autonomous security solutions. Legacy defenses remain largely reactive, labor-intensive, and inadequate for the scale and complexity of next-generation systems. Current O-RAN applications focus mainly on network optimization or passive threat detection, with limited capability for closed-loop, automated response. To address this critical gap, we present an agentic AI framework for fully automated, end-to-end threat mitigation in 6G O-RAN environments. MobiLLM orchestrates security workflows through a modular multi-agent system powered by Large Language Models (LLMs). The framework features a Threat Analysis Agent for real-time data triage, a Threat Classification Agent that uses Retrieval-Augmented Generation (RAG) to map anomalies to specific countermeasures, and a Threat Response Agent that safely operationalizes mitigation actions via O-RAN control interfaces. Grounded in trusted knowledge bases such as the MITRE FiGHT framework and 3GPP specifications, and equipped with robust safety guardrails, MobiLLM provides a blueprint for trustworthy AI-driven network security. Initial evaluations demonstrate that MobiLLM can effectively identify and orchestrate complex mitigation strategies, significantly reducing response latency and showcasing the feasibility of autonomous security operations in 6G.