mlsanityData to 7 Oct 2026

Security of Foundation-Model-Powered Embodied Agents: Attack Surfaces, Attacks, Defenses, and Evaluation

arXiv 2608.16843 ↗First posted 17 Aug 2026cs.ROcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Foundation models are increasingly used for perception, reasoning, planning, and action generation in embodied agents, creating security risks that can propagate from digital inputs to physical behavior. Existing surveys often organize threats by mechanisms such as jailbreaks, prompt injection, backdoors, poisoning, or adversarial examples, but these categories do not consistently identify where an adversary first enters the embodied control loop. We present a trust-boundary-centric survey of foundation-model-powered embodied-agent security. Using a first-compromised-trust-boundary principle, we separate attack surface from attack mechanism and organize the system into five layers and twelve attack surfaces spanning the model supply chain, user instructions, context and memory, physical semantic environments, multimodal perception, world state, internal reasoning, task planning, action interfaces, middleware, multi-agent communication, and execution control. Based on 58 attack records and 61 defense records collected through August 15, 2026, we analyze representative attacks, cross-layer propagation, defense placement, and evaluation practices. Our quantitative analysis shows that attack research is concentrated on multimodal perception and action interfaces, while defenses are especially concentrated on action-level and runtime protection. Context and long-term memory, middleware and networking, world-state integrity, and multi-agent trust remain comparatively underexplored. We conclude with open challenges in state provenance, compositional defenses, long-horizon attack propagation, physical realizability, Byzantine multi-robot behavior, and unified closed-loop evaluation.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 63 of its 123 references that are in the map. First posted on arXiv 17 Aug 2026.

Builds on

63 of 123 references.

Closest ancestors · 8

Same direction, newest first

  1. 2026When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems1 Aug
  2. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation9 Jun
  3. 2026If you're waiting for a sign... that might not be it! Mitigating Trust Boundary Confusion from Visual Injections on Vision-Language Agentic Systems21 Apr
  4. 2026PINA: Prompt Injection Attack against Navigation Agents20 Jan
  5. 2025RoboSafe: Safeguarding Embodied Agents via Executable Safety Logic24 Dec
  6. 2025SafeMind: Benchmarking and Mitigating Safety Risks in Embodied LLM Agents30 Sep
  7. 2025Manipulating Multimodal Agents via Cross-Modal Prompt Injection19 Apr
  8. 2023Plug in the Safety Chip: Enforcing Constraints for LLM-driven Robot Agents18 Sep

Other references · 55

  1. 2023REFLECT: Summarizing Robot Experiences for Failure Explanation and Correctioncited by 171
  2. 2024AHA: A Vision-Language-Model for Detecting and Reasoning Over Failures in Robotic Manipulationcited by 118
  3. 2025SAFE: Multitask Failure Detection for Vision-Language-Action Modelscited by 74
  4. 2025SafeVLA: Towards Safety Alignment of Vision-Language-Action Model via Constrained Learningcited by 69
  5. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimizationcited by 37
  6. 2024Run-time Observation Interventions Make Vision-Language-Action Models More Visually Robustcited by 33
  7. 2025FailSafe: Reasoning and Recovery from Failures in Vision-Language-Action Modelscited by 33
  8. 2025VLSA: Vision-Language-Action Models with Plug-and-Play Safety Constraint Layercited by 32
  9. 2024Exploring the Robustness of Decision-Level Through Adversarial Attacks on LLM-Based Embodied Modelscited by 31
  10. 2025Adversarial Attacks on Robotic Vision Language Action Modelscited by 31
  11. 2025Safety Guardrails for LLM-Enabled Robotscited by 30
  12. 2023Safe-VLN: Collision Avoidance for Vision-and-Language Navigation of Autonomous Robots Operating in Continuous Environmentscited by 22
38 more
  1. 2025FPC-VLA: A Vision-Language-Action Framework with a Supervisor for Failure Prediction and Correctioncited by 21
  2. 2025Robust Finetuning of Vision-Language-Action Robot Policies via Parameter Mergingcited by 19
  3. 2025Goal-oriented Backdoor Attack against Vision-Language-Action Models via Physical Objectscited by 16
  4. 2025When Alignment Fails: Multimodal Adversarial Attacks on Vision-Language-Action Modelscited by 16
  5. 2024On the Vulnerability of LLM/VLM-Controlled Roboticscited by 15
  6. 2024A Study on Prompt Injection Attack Against LLM-Integrated Mobile Robotic Systemscited by 15
  7. 2024Robot Collapse: Supply Chain Backdoor Attacks Against VLM-based Robotic Manipulationcited by 13
  8. 2025Human-assisted Robotic Policy Refinement via Action Preference Optimizationcited by 13
  9. 2025Affordance Field Intervention: Enabling VLAs to Escape Memory Traps in Robotic Manipulationcited by 12
  10. 2026Vision-Language-Action Safety: Threats, Challenges, Evaluations, and Mechanismscited by 12
  11. 2025EvoVLA: Self-Evolving Vision-Language-Action Modelcited by 11
  12. 2026When World Models Dream Wrong: Physical-Conditioned Adversarial Attacks against World Modelscited by 11
  13. 2025SafePlan: Leveraging Formal Logic and Chain-of-Thought Reasoning for Enhanced Safety in LLM-based Robotic Task Planningcited by 9
  14. 2026State Backdoor: Towards Stealthy Real-world Poisoning Attack on Vision-Language-Action Model in State Spacecited by 9
  15. 2026VLA-Forget: Vision-Language-Action Unlearning for Embodied Foundation Modelscited by 9
  16. 2025Safe LLM-Controlled Robots with Formal Guarantees via Reachability Analysiscited by 7
  17. 2026Inject Once Survive Later: Backdooring Vision-Language-Action Models to Persist Through Downstream Fine-tuningcited by 7
  18. 2026Generative Scenario Rollouts for End-to-End Autonomous Drivingcited by 6
  19. 2025Towards Safe Robot Foundation Models Using Inductive Biasescited by 5
  20. 2025LogicGuard: Improving Embodied LLM agents through Temporal Logic based Criticscited by 5
  21. 2025Human-in-the-loop Online Rejection Sampling for Robotic Manipulationcited by 5
  22. 2026Safe-Night VLA: Seeing the Unseen via Thermal-Perceptive Vision-Language-Action Models for Safety-Critical Manipulationcited by 5
  23. 2026TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patchescited by 5
  24. 2026Causal Scene Narration with Runtime Safety Supervision for Vision-Language-Action Drivingcited by 5
  25. 2026JailWAM: Jailbreaking World Action Models in Robot Controlcited by 5
  26. 2026Propagating Unsafe Actions in LLM Controlled Multi-Robot Collaboration via Single Robot Compromisecited by 5
  27. 2024Safety Optimized Reinforcement Learning via Multi-Objective Policy Optimizationcited by 4
  28. 2025The Shawshank Redemption of Embodied AI: Understanding and Benchmarking Indirect Environmental Jailbreakscited by 4
  29. 2026When Attention Betrays: Erasing Backdoor Attacks in Robotic Policies by Reconstructing Visual Tokenscited by 4
  30. 2023Byzantine Resilience at Swarm Scale: A Decentralized Blocklist Protocol from Inter-robot Accusationscited by 2
  31. 2025Preventing Robotic Jailbreaking via Multimodal Domain Adaptationcited by 2
  32. 2026Jailbreaking Embodied LLMs via Action-level Manipulationcited by 2
  33. 2026From Prompt to Physical Action: Structured Backdoor Attacks on LLM-Mediated Robotic Control Systemscited by 2
  34. 2026Partially Observable Adversarial Patch Attacks on Vision-Language-Action Models in Roboticscited by 2
  35. 2026Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluationcited by 2
  36. 2026Hijacking Robots with a Piece of Paper: A Systematic Study of Physical Prompt Injection in VLM-Controlled Robotscited by 2
  37. 2025Supply Chain Exploitation of Secure ROS 2 Systems: A Proof-of-Concept on Autonomous Platform Compromise via Keystore Exfiltrationcited by 1
  38. 2026Pedagogical Alignment for Vision-Language-Action Models: A Comprehensive Framework for Data, Architecture, and Evaluation in Educationcited by 1

50 most cited of 55 All 55 (JSON)

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directions
  2. 2026Benchmarking Jailbreak Guardrails for Embodied Agents
  3. 2025Advancing Embodied Agent Security: From Safety Benchmarks to Input Moderation
  4. 2026Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses
  5. 2025Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attacks
  6. 2026RoboJailBench: Benchmarking Adversarial Attacks and Defenses in Embodied Robotic Agents
  7. 2025Trust in LLM-controlled Robotics: a Survey of Security Threats, Defenses and Challenges
  8. 2024Can We Trust Embodied Agents? Exploring Backdoor Attacks against Embodied LLM-based Decision-Making Systems