# Agentic AI Cybersecurity Framework

arXiv: https://arxiv.org/abs/2609.27856 · HTML: https://mlsanity.com/paper/2609.27856/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 2 of its 14 references that are in the map.
- First posted on arXiv 20 Aug 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 2 of 2)

- [Enhancing Prompt Injection Attacks to LLMs via Poisoning Alignment](https://mlsanity.com/paper/2410.14827/) (2024)
- [The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines](https://mlsanity.com/paper/2512.06659/) (2025)

## Abstract (arXiv)

The increasing scale, complexity, and dynamism of modern cyber threats have rendered traditional reactive cybersecurity mechanisms insufficient. This paper introduces an Agentic AI Cybersecurity Framework (AACF) designed to enable autonomous, goal-driven, and adaptive cyber defense operations. Unlike conventional systems that rely on predefined rules and human intervention, the proposed framework leverages agentic artificial intelligence to perceive environmental states, reason about potential threats, and execute context-aware responses with minimal supervision. The framework is structured into key functional layers, including perception, reasoning, decisionmaking, action execution, and feedback-driven learning, enabling continuous adaptation to evolving attack patterns. By integrating intelligent agents with real-time data analysis and automated response mechanisms, AACF supports proactive threat detection, dynamic risk assessment, and coordinated mitigation strategies across distributed environments. A conceptual architecture is presented, along with illustrative use cases demonstrating its applicability to intrusion detection, incident response, and autonomous security orchestration. The proposed framework contributes to the emerging paradigm of self-directed cybersecurity systems and provides a foundation for developing resilient, scalable, and intelligent defense infrastructures.