mlsanityData to 7 Oct 2026

Toward a Safe Internet of Agents

arXiv 2512.00520 ↗First posted 29 Nov 2025cs.MAcited by 6

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Autonomous Artificial Intelligence (AI) agents, powered by Large Language Models (LLMs), advance rapidly toward interconnected systems -- an Internet of Agents (IoA). This vision enables complex problem-solving while introducing systemic safety and security risks. Beyond existing threat taxonomies, we provide a principled guide addressing architectural vulnerability sources. We offer a framework for engineering safe agentic systems through bottom-up deconstruction, analyzing each component as a dual-use interface where capability expansion creates attack surface growth. We examine three tiers: (1) Single Agents -- analyzing inherent risks in models, memory, design patterns, tools, and guardrails; (2) Multi-Agent Systems (MAS) -- examining collective behavior components including architectural patterns, communication mechanisms, verification, and system guardrails; and (3) Interoperable Multi-Agent Systems (IMAS) -- exploring four secure ecosystem pillars: standardized protocols, agent registration/discovery, resource vetting, and governance. Our analysis reveals a central principle: agentic safety must be co-designed with capability as a fundamental architectural property. We identify specific vulnerabilities at each level and derive core mitigation principles. The result is a foundational guide enabling developers and researchers to build not merely capable but safe, reliable agentic AI, contributing to secure IoA development.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 76 of its 119 references that are in the map. First posted on arXiv 29 Nov 2025.

Builds on

76 of 119 references.

Closest ancestors · 12

Same direction, newest first

  1. 2025ToolTweak: An Attack on Tool Selection in LLM-based Agents2 Oct
  2. 2025The AGNTCY Agent Directory Service: Architecture and Implementation23 Sep
  3. 2025Security of Internet of Agents: Attacks and Countermeasures12 May
  4. 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
  5. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment22 Apr
  6. 2024Towards Action Hijacking of Large Language Model-based Agent14 Dec
  7. 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents14 Nov
  8. 2024Breaking ReAct Agents: Foot-in-the-Door Attack Will Get You In22 Oct
  9. 2024DAWN: Designing Distributed Agents in a Worldwide Network11 Oct
  10. 2024Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification30 Jul
  11. 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies28 Jul
  12. 2024Secret Collusion among AI Agents: Multi-Agent Deception via Steganography12 Feb

Other references · 64

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  2. 2022Self-Consistency Improves Chain of Thought Reasoning in Language Modelscited by 5,601
  3. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  4. 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,064
  5. 2023Let's Verify Step by Stepcited by 3,598
  6. 2023Self-Refine: Iterative Refinement with Self-Feedbackcited by 3,317
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  8. 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,906
  9. 2016Concrete Problems in AI Safetycited by 1,582
  10. 2023A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questionscited by 1,582
  11. 2023CAMEL: Communicative Agents for "Mind" Exploration of Large Language Model Societycited by 1,348
  12. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
38 more
  1. 2023Gorilla: Large Language Model Connected with Massive APIscited by 1,302
  2. 2023Graph of Thoughts: Solving Elaborate Problems with Large Language Modelscited by 873
  3. 2023Reasoning with Language Model is Planning with World Modelcited by 846
  4. 2023CRITIC: Large Language Models Can Self-Correct with Tool-Interactive Critiquingcited by 751
  5. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  6. 2024A Systematic Survey of Prompt Engineering in Large Language Models: Techniques and Applicationscited by 428
  7. 2024Understanding the planning of LLM agents: A surveycited by 414
  8. 2018AI safety via debatecited by 384
  9. 2023NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Railscited by 347
  10. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 337
  11. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
  12. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  13. 2022Large Language Models are Better Reasoners with Self-Verificationcited by 304
  14. 2023A Dynamic LLM-Powered Agent Network for Task-Oriented Agent Collaborationcited by 281
  15. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  16. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
  17. 2023ToolkenGPT: Augmenting Frozen Language Models with Massive Tools via Tool Embeddingscited by 238
  18. 2023Large Language Models as Commonsense Knowledge for Large-Scale Task Planningcited by 231
  19. 2023AI Control: Improving Safety Despite Intentional Subversioncited by 207
  20. 2024SecAlign: Defending Against Prompt Injection with Preference Optimizationcited by 179
  21. 2023Removing RLHF Protections in GPT-4 via Fine-Tuningcited by 165
  22. 2025Multi-agent Architecture Search via Agentic Supernetcited by 164
  23. 2024AgentSquare: Automatic LLM Agent Search in Modular Design Spacecited by 141
  24. 2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 122
  25. 2022Goal Misgeneralization: Why Correct Specifications Aren't Enough For Correct Goalscited by 120
  26. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMscited by 117
  27. 2020Sponge Examples: Energy-Latency Attacks on Neural Networkscited by 108
  28. 2025Multi-Agent Design: Optimizing Agents with Better Prompts and Topologiescited by 106
  29. 2024Coercing LLMs to do and reveal (almost) anythingcited by 88
  30. 2024Language Agents as Optimizable Graphscited by 81
  31. 2024Internet of Agents: Weaving a Web of Heterogeneous Agents for Collaborative Intelligencecited by 80
  32. 2025Superintelligent Agents Pose Catastrophic Risks: Can Scientist AI Offer a Safer Path?cited by 70
  33. 2025Authenticated Delegation and Authorized AI Agentscited by 63
  34. 2024The Limits of Inference Scaling Through Resamplingcited by 51
  35. 2024A Scalable Communication Protocol for Networks of Large Language Modelscited by 43
  36. 2025Agentic Web: Weaving the Next Web with AI Agentscited by 43
  37. 2024Denial-of-Service Poisoning Attacks against Large Language Modelscited by 34
  38. 2025Agent-R1: A Unified and Modular Framework for Agentic Reinforcement Learningcited by 28

50 most cited of 64 All 64 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 6.

6 papers.

  1. 2026Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANPcited by 14
  2. 2026Holos: A Web-Scale LLM-Based Multi-Agent System for the Agentic Webcited by 4
  3. 2026Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directionscited by 1
  4. 2026Distributed Legal Infrastructure for a Trustworthy Agentic Webcited by 0
  5. 2026Faithful, Not Corrective: Model Capability Governs Message-Format Effects in Multi-Hop Agent Relayscited by 0
  6. 2026InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025A Safety and Security Framework for Real-World Agentic Systems
  2. 2026Security Considerations for Multi-agent Systems
  3. 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges
  4. 2026Architecture Matters for Multi-Agent Security
  5. 2026Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
  6. 2026From Secure Agentic AI to Secure Agentic Web: Challenges, Threats, and Future Directions
  7. 2025Systems Security Foundations for Agentic Computing
  8. 2025Formalizing the Safety, Security, and Functional Properties of Agentic AI Systems