Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
arXiv:2608.01558v1 [cs.AI] 3 Aug 2026
This work has been accepted to the ACM AI Leadership Summit 2026, Visionary Track Alireza Lotfi∗
Subangkar Karmaker Shanto∗
Purdue University Department of Computer Science West Lafayette, IN, USA [email protected]
Purdue University Department of Computer Science West Lafayette, IN, USA [email protected]
Imtiaz Karim
Elisa Bertino
University of Texas at Dallas Department of Computer Science Richardson, TX, USA [email protected]
Purdue University Department of Computer Science West Lafayette, IN, USA [email protected]
Abstract Autonomous agents are increasingly used to execute consequential tasks in environments governed by operational constraints, organizational policies, regulatory requirements, and technical standards. Their safety is therefore determined not by the correctness of individual actions, but by whether their overall behavior remains consistent with the rules and invariants of the systems in which they operate. As large language model (LLM)-based agents become more autonomous and increasingly delegate tasks across organizational boundaries, securing them evolves from a single challenge into a broad and interconnected landscape spanning the entire agentic stack. At the single-agent level, untrusted inputs through prompts, memory, retrieved knowledge, and tool interfaces create attack surfaces. In multi-agent settings, delegation and communication introduce challenges related to identity, trust, capability control, and decision transparency, while the underlying model routing and execution control plane remains vulnerable to manipulation and to unverified model provenance. Perhaps the most fundamental challenge is behavioral containment: sequences of individually permissible actions may collectively violate system-level constraints and safety invariants. At the broader level, supply-chain integrity, provenance, accountability, and end-to-end observability remain largely open problems. A common principle unifies these directions: security must become a verifiable property of the architectures, protocols, and runtimes that govern agent behavior, rather than an optional layer of guidance. Charting these challenges provides a roadmap toward trustworthy autonomous agent deployment. ∗ Both authors contributed equally to this research.
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]. ACM AI Leadership Summit ’26, Atlanta, GA, USA © 2026 Copyright held by the owner/author(s). Publication rights licensed to ACM. ACM ISBN 978-1-4503-XXXX-X/2018/06 https://doi.org/XXXXXXX.XXXXXXX
In
ter
Tools Memory
S Re tore tri ev al
Execute Observations
Prompt
User
Planning, Reasoning
ac t
Agent
External Environment
Figure 1: Agentic AI architecture. An agent plans, uses memory and tools, and interacts with users and environments.
1
Introduction
Autonomous agents powered by large language models (LLMs) are increasingly entrusted with critical tasks across enterprise and cyber-physical environments, including healthcare, finance, telecommunications, and critical infrastructure. Unlike traditional AI systems that primarily provide recommendations, these agents plan, reason, invoke tools, interact with external systems, and increasingly collaborate with other agents to accomplish complex objectives. As a result, a single agent may issue thousands of tool calls while a human operator reviews only a handful of decisions. In many of these deployments, agent behavior is constrained by organizational policies, regulatory requirements, or technical standards that specify not only which individual actions are permitted, but also the behavioral envelope within which an entire sequence of actions must remain. Figure 1 illustrates the core components and interaction flows of such an agent. Also agents rarely operate in isolation. Through emerging interoperability protocols they discover, coordinate with, and delegate tasks to other agents, allowing a single workflow to span multiple autonomous entities across organizational and vendor boundaries. This makes securing the agentic systems a broad and interconnected research landscape. Therefore, securing agentic AI has attracted growing attention from
ACM AI Leadership Summit ’26, August 30–September 02, 2026, Atlanta, GA, USA
2
The Single-Agent Surface
A modern LLM agent extends its capabilities by interacting with external resources through tool invocations. Given a task, the agent reasons about an action, issues a structured request (e.g., web search, database query), and incorporates the result into subsequent reasoning. The Model Context Protocol (MCP) [3] standardizes this interaction model, while equivalent function-calling interfaces are supported across major LLM providers. This forms the vertical axis of the agentic ecosystem, connecting agents to external capabilities, while the horizontal axis (Section 3) enables communication and delegation among agents. The three challenges discussed below share a common root cause along the vertical axis: the agent lacks a reliable separation between data and instructions. Untrusted content entering the agent’s context can therefore influence reasoning and redirect behavior. The three directions differ in the attack surface through which untrusted content reaches the agent. Prompt injection. The most established entry point is the agent’s retrieval channel, where adversarial content in web pages, documents, or databases can embed instructions that the agent follows as if they originated from the user [12, 13]. EchoLeak (CVE-202532711) demonstrated this risk in practice by causing Microsoft 365 Copilot to exfiltrate sensitive context from a crafted email without user interaction [30]. Agentic systems amplify this threat because retrieved content can persist across multiple reasoning steps and influence future decisions as the execution context evolves. Moreover, tool-using agents can propagate injected instructions beyond
User Request Response Ro uti ng
Ma nip
ula tio
n
A2A (Crafted Entry) Memory poisoning
MCP
Malicious Agent Web Search
(Assign A2A Task)
A2A (Malicious Intent) A2A (Task Delegation)
Booking Agent
Identity loss
Behavioral Containment
Planner Agent
System-Level Containment
academia and industry [25]. Recent efforts have begun to structure this landscape: the OWASP Agentic Security Initiative identifies fifteen categories of agentic threats [33], the Cloud Security Alliance’s MAESTRO framework organizes the agentic stack into seven layers [9], and Microsoft’s updated failure-mode taxonomy highlights emerging risks ranging from supply-chain compromise to goal hijacking [29]. Rather than introducing another taxonomy, our focus is to provide a lens for analyzing the agentic security landscape through the demands of governed deployment, where the intended behavior is an explicit written artifact rather than a matter of designer judgment. We organize the major open problems into eleven research directions spanning the entire agentic stack from a single agent’s reasoning, memory, and tools to multi-agent collaboration, model routing, behavioral containment, and ecosystem governance. As a vision paper, our goal is not to propose complete solutions but to identify fundamental challenges and research opportunities they create. The paper is organized as follows. Section 2 examines the singleagent attack surface, including prompt injection, memory poisoning, and tool integrity. Section 3 addresses multi-agent security through the A2A protocol, focusing on inter-agent communication, identity, delegated authorization, and emergent risks. Section 4 examines model routing as the control-plane mechanism that selects the model serving each request. Section 5 discusses behavioral containment, where individually valid actions may collectively violate system-level constraints. Finally, Section 6 covers supply-chain provenance and observability as cross-cutting assurance challenges. Figure 2 places the attack surfaces within the broader agentic ecosystem.
Lotfi, Shanto, et al.
MCP Unverified Tool
Shopping Agent
Figure 2: An agentic ecosystem with representative challenges marked in red.
reasoning into downstream actions rather than merely altering generated responses. Existing data and control-flow separation techniques [12] mitigate single-step injection, but do not address attacks that persist across multi-step agent execution. Ensuring the integrity of an agent’s evolving context therefore remains an open challenge. Memory and state poisoning. Agents increasingly maintain longterm state through memory systems and retrieval-augmented stores, creating a persistent attack surface. AgentPoison shows that injecting a small number of crafted entries into an agent’s memory or knowledge base can backdoor future retrievals with a poisoning rate below 0.1%, while leaving benign behavior unchanged [6]. PoisonedRAG demonstrates similar attacks against retrieval databases that ground agent decisions [53]. Unlike a transient prompt injection, whose impact is typically confined to a single interaction, poisoned memory persists across sessions and can influence every future reasoning process that retrieves it. This is particularly concerning for long-lived agents in domains such as clinical or network management systems, where memory is central to continuous operation. The fundamental challenge is ensuring the integrity and provenance of an agent’s evolving memory. There is currently no widely accepted notion of what constitutes a trustworthy long-term memory, nor robust mechanisms for verifying that the information it accumulates remains authentic, unaltered, and reliable over time. Tool integrity. An agent trusts the tools it invokes, yet this trust is rarely verified. In a tool poisoning attack, a malicious server embeds
Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
instructions in a tool’s metadata that the agent consumes as part of its context [22]. Because every component of a tool specification can influence agent behavior, the attack surface extends beyond human-readable descriptions to the entire interface. Moreover, trust in a tool is not static. In a rug pull attack, a previously trusted server silently replaces a benign tool definition with a malicious one that many clients never revalidate [22]. The threat is not hypothetical, with 99 MCP-related CVEs reported in 2025 alone [29]. Because tools are often provided by third parties outside the agent operator’s control, their definitions cannot be assumed to remain benign over time. The challenge is therefore to establish and maintain the integrity, provenance, and authenticity of tool interfaces throughout the agent lifecycle, treating tool metadata as untrusted inputs that require continuous validation rather than once at deployment.
3
The Inter-Agent Surface
The challenges in Section 2 concern an agent’s vertical interface to tools. A second, horizontal surface governs how agents discover and delegate to one another, extending these risks across organizational boundaries. Several inter-agent protocols emerged in 2024–2025, including Agora, Agent Network Protocol, Cisco Agent Connect, IBM Agent Communication Protocol, and Google’s Agent2Agent (A2A) [14]. A2A has since become the dominant standard, contributed to the Linux Foundation in 2025, and adopted by more than 150 organizations while absorbing IBM’s competing protocol [18, 27, 44, 45]. Alongside MCP, it now forms a complementary horizontal layer for agent collaboration and vertical layer for tool interaction [43]. A2A introduces new security challenges because it coordinates opaque, autonomous peers. A client discovers a remote agent through an Agent Card, delegates tasks over JSON-RPC, and consumes results without visibility into the remote model, memory, or tools [14, 16]. Designed primarily for communication, A2A leaves identity and trust establishment to implementers, with security controls expressed as optional should/may guidance rather than enforced requirements [38]. Inter-agent security. Several structural weaknesses follow from these design choices [2, 14]. A2A carries conversational state through a shared contextId, but contexts lack ownership semantics. Any authenticated client that obtains a valid identifier may attach to the context, access accumulated history, or poison future tasks without triggering task-level controls [11, 17]. Similarly, Agent Card capabilities are self-asserted without attestation or challengeresponse mechanisms, allowing malicious agents to claim unsupported skills, receive sensitive tasks, and return fabricated artifacts without protocol-level detection [8, 24]. These risks extend beyond A2A. Production systems combine A2A horizontally with MCP vertically, allowing a compromised peer identity to drive exposed tool actions and create relay or downgrade paths across the boundary [2, 16]. The challenge is to make properties such as context ownership and capability attestation verifiable protocol invariants, analyzing the A2A↔MCP boundary as a single security surface rather than optional implementer guidance. Agent identity and delegated authorization. Agentic systems lack a coherent model of who is acting and with what authority. Within a single agent, broad tool permissions allow individually
ACM AI Leadership Summit ’26, August 30–September 02, 2026, Atlanta, GA, USA
authorized actions to compose into unintended effects, creating confused-deputy scenarios that per-tool privilege checks cannot prevent [41]. Across agents, the problem worsens as A2A establishes identity only at the transport layer and does not propagate it across delegation hops, leaving agents aware only of their immediate caller [2, 38]. When tasks are re-delegated, authorization requests lack the originating principal and delegation history, forcing decisions without complete provenance. Relayed credentials without sender constraints or reuse restrictions further allow a compromised intermediary to replay credentials across the delegation chain [8]. Existing standards provide building blocks for addressing these gaps. OAuth 2.0 Token Exchange (RFC 8693) supports signed delegation chains, while audience restriction (RFC 8707) and sender-constrained tokens (DPoP, RFC 9449) enable least-privilege delegation and limit credential reuse. The challenge is not the absence of these mechanisms, but that current agent interoperability protocols treat them as optional, preventing interoperating agents from assuming that delegated identities are securely propagated, constrained, and replay-resistant. Emergent multi-agent risk. A compromise need not stay local to one agent. Prompt Infection shows a malicious instruction can self-replicate from agent to agent like a virus, propagating silently through a multi-agent system even when agents do not share all communication [26]. Zero-click GenAI worms generalize this to self-propagating payloads that spread through the applications agents are embedded in [10]. Beyond contagion, collaborating agents can collude, amplify one another’s errors, or enter feedback loops that exhaust shared budget and rate limits, a denial-of-wallet failure [34] with no single-agent analogue. Existing protocol-level defenses offer no formal guarantees against model and reasoning level compromise spreading across a federation [32]. The challenge is bounding emergent behavior across a population of agents whose individual actions are each locally legitimate.
4
Model Routing: The Control Plane Beneath
The attack surfaces discussed so far concern the execution and collaboration layers of the agentic ecosystem. Production systems introduce a third: the model-routing control plane. Rather than binding an agent to a single model, a router selects the model for each request based on capability, cost, latency, and safety. Operating on the same untrusted input as the agent, it determines which model and thus which capabilities, safety alignment, and cost profile handle the request. This creates a third attack surface, the agent-to-model control plane, underlying both agent-to-tool and agent-to-agent interactions. Adversarial Routing. The routing decision can be attacked across the stack. At the input level, crafted token sequences can force cost-inflating model upgrades [39, 42] or downgrade requests to cheaper, less-aligned models, creating a jailbreak-by-downgrade that bypasses per-tool privilege checks [32, 39, 41]. Router architecture is itself a security variable. Trainable neural routers are more susceptible to adversarial suffixes and training-time backdoors than parameter-free similarity routers, making robustness an architectural choice [28]. The attack surface also extends into model internals. In mixture-of-experts models, adversarial inputs
ACM AI Leadership Summit ’26, August 30–September 02, 2026, Atlanta, GA, USA
can suppress safety-critical experts, leak prompts through crossbatch routing dependencies, or trigger denial-of-service through expert imbalance [21, 49, 50]. These failures occur inside the routing topology and may remain invisible at the output level. Current defenses primarily focus on detection. Contrastive detectors can identify rerouting prompts before execution with strong reported accuracy [51], but they provide no certified robustness, lack evaluation against adaptive attackers, and do not address in-model or cross-batch attacks. The challenge is to treat routing as a policy artifact. A recent declarative approach compiles routing logic into a non-Turing-complete specification with exhaustive, conflict-free decisions, audit trails, and verified routing nodes across MCP and A2A boundaries [5], reflecting the broader shift from advisory guidance to enforceable invariants. Routing Provenance and Observability. The router is itself a supply-chain component. Its weights, training data, and decision thresholds may contain pre-deployment backdoors [28], yet existing provenance frameworks do not cover routing components. Routing telemetry offers a natural signal for detecting anomalies such as denial-of-wallet and silent model downgrades, but it is absent from current observability frameworks. Moreover, the security impact of routing decisions on downstream tool invocation and inter-agent delegation remains largely unexplored. A compromised router can steer requests toward models with exploitable tool or agent bindings, composing the routing surface with those described in Sections 2 and 3 [40, 48]. Addressing this gap requires treating routing like other security-critical components, with provenance for the routing mechanism, policies verifiable against governing standards, and routing decisions exposed as first-class signals in the audit layer.
5
Behavioral Trajectory Containment
The vertical and horizontal surfaces share a gap that neither protocol closes. Tool protocols define what actions are mechanically available, while governing standards define what sequences of actions are permitted. No deployed mechanism connects the two. Containment operates at two levels. Systems-level isolation limits the blast radius of agent execution through sandboxing, scoped credentials, and egress control, and is largely inherited from conventional security. The remaining challenge is behavioral: ensuring an agent’s execution trajectory stays within the behavioral envelope defined by governing standards. A sequence of individually permitted actions can collectively violate a state-conditioned invariant. For example, a 5G scheduling agent can progressively deprioritize a public-safety slice, each reallocation passing local checks, yet miss the mandated recovery window [1]. Likewise, a clinical agent can accelerate several justified discharge decisions while violating the aggregate observation window defined by a FHIR care pathway [19]. In both cases, no adversarial input is involved. The violation emerges from the execution trajectory rather than any individual action, making behavioral assurance, not per-action validation, the central challenge. Existing safety mechanisms are not designed to address this class of failures. Runtime guards enforce stateless, per-action policies [41, 46] without reasoning about how system state evolves over an long execution trajectory. LLM-to-formal-spec
Lotfi, Shanto, et al.
compilers derive rules from specifications [31, 52] but cannot guarantee completeness, consistency, or faithfulness to the governing standards. Probabilistic monitors learn from observed execution traces [47]. A recent line of work enforces hand-authored temporal, state-dependent properties at runtime [23]. However, none of these approaches are grounded in governing policies, leaving them unable to detect unseen but prohibited trajectories. Moreover, enforcement remains single-agent, which makes those unsuitable for multi-agent settings where violations emerge from cross-agent interactions. Moreover, majority of agent benchmarks provide no concrete policy specification at all [20]. The challenge is to bridge local correctness and global behavioral assurance. Future agentic systems must verify that evolving execution trajectories satisfy system-level behavioral constraints, establishing safety over the lifetime of an execution rather than at individual decision points.
6
Assurance and Governance
The preceding directions secure agent behavior during execution. Two lifecycle challenges matter equally, namely establishing trust before deployment and accountability after it. Together they determine whether an agentic system can be deployed and governed with confidence. Supply chain integrity. An agent is assembled from parts supplied by many parties, namely foundation models and embeddings, system prompts, plugins, and the growing ecosystem of third-party tool servers. Any of these can be compromised, and unlike a onetime code dependency, a tool definition can turn malicious after it has been trusted. The postmark-mcp package behaved correctly for fifteen releases before a single added line silently copied every outgoing email to an attacker, reaching hundreds of organizations before its removal [36]. The same risk extends to the instruction and skill documents an agent obeys as trusted guidance, such as editor rules files and SKILL.md descriptors, which can hide directives yet arrive through the same untrusted ecosystem [35, 37]. Both the OWASP Agentic Security Initiative and Microsoft’s red-team taxonomy identify supply-chain compromise as a fundamental agentic security risk [29, 33]. Ensuring provenance and integrity across the agent supply chain remains an open challenge, requiring softwarebill-of-materials principles to extend to models, prompts, and dynamically discovered tools whose behavior is not fixed at deployment. As Microsoft’s taxonomy emphasizes, these capabilities must be designed into agent architectures rather than retrofitted [29]. Accountability Through Auditability. When an autonomous agent causes harm, a security analyst must reconstruct its actions, attribute responsibility, and produce records that satisfy requirements such as MiFID II and NIST SP 800-61 [7, 15]. This is difficult because agent reasoning is opaque, actions span tools and agents, and audit blind spots remain common in current deployments. Recent work identifies the need for visibility into agent behavior through agent identifiers, real-time monitoring, and activity logs that support attribution and forensics [4]. However, these mechanisms are neither standardized nor mandatory, and they introduce privacy and cost tradeoffs. Unlike human operators, autonomous agents can generate structured, verifiable execution traces documenting their decisions and actions, making agentic systems potentially more transparent and auditable than the processes they
Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
replace. Achieving this requires auditability to be designed as an end-to-end property spanning agent protocols, execution environments, and behavioral containment mechanisms.
7
Concluding Remarks
Securing autonomous agents is not a collection of isolated challenges but a systems problem spanning the entire agentic stack, from reasoning, memory, and tool use to multi-agent collaboration, model routing, behavioral containment, and ecosystem governance. Across these directions, a common theme emerges: security is fundamentally a property of an agent’s behavior over time and across interacting components, rather than of individual actions in isolation. This calls for a shift from advisory guidance and stateless guardrails to verifiable behavioral invariants and from per-action checks to reasoning about composed, stateful, multi-party behavior. As agents become increasingly autonomous and interconnected, developing such guarantees will be essential for building trustworthy agentic systems and represents a critical research agenda for the security community.
Acknowledgment The work reported in this paper has been supported by NSF under grants 2112471 and 2229876, the University of Texas System Rising STARs Award (No. 40071109), and the startup funding from the University of Texas at Dallas.
References [1] 3GPP. 2024. System architecture for the 5G System (TS 23.501). Technical Report. 3rd Generation Partnership Project. [2] Zeynab Anbiaee, Mahdi Rabbani, Mansur Mirani, Gunjan Piya, Igor Opushnyev, Ali Ghorbani, and Sajjad Dadkhah. 2026. Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP. arXiv:2602.11327 doi:10.48550/arXiv.2602.11327 [3] Anthropic. 2024. Model Context Protocol. https://modelcontextprotocol.io. [4] Alan Chan, Carson Ezell, Max Kaufmann, Kevin Wei, Lewis Hammond, Herbie Bradley, Emma Bluemke, Nitarshan Rajkumar, David Krueger, Noam Kolt, Lennart Heim, and Markus Anderljung. 2024. Visibility into AI Agents. In Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency (FAccT). doi:10.1145/3630106.3658948 [5] Huamin Chen, Xunzhuo Liu, Bowei He, and Xue Liu. 2026. From Inference Routing to Agent Orchestration: Declarative Policy Compilation with CrossLayer Verification. arXiv:2603.27299 [cs.SE] https://arxiv.org/abs/2603.27299 [6] Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. AgentPoison: Red-Teaming LLM Agents via Poisoning Memory or Knowledge Bases. In Advances in Neural Information Processing Systems (NeurIPS). doi:10.48550/arXiv.2407.12784 [7] Paul Cichonski, Tom Millar, Tim Grance, and Karen Scarfone. 2012. Computer Security Incident Handling Guide (NIST SP 800-61 Rev. 2). Technical Report. National Institute of Standards and Technology. [8] Cisco. 2025. Securing AI Agents with Cisco’s Open-Source A2A Scanner. https: //blogs.cisco.com/ai/securing-ai-agents-with-ciscos-open-source-a2a-scanner [9] Cloud Security Alliance. 2025. MAESTRO: Agentic AI Threat Modeling Framework. https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threatmodeling-framework-maestro. Accessed 2026. [10] Stav Cohen, Ron Bitton, and Ben Nassi. 2024. Here Comes the AI Worm: Unleashing Zero-Click Worms that Target GenAI-Powered Applications. arXiv:2403.02817 [cs.CR] doi:10.48550/arXiv.2403.02817 [11] Shrestha Datta, Shahriar Kabir Nahin, Anshuman Chhabra, and Prasant Mohapatra. 2025. Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges. arXiv:2510.23883 doi:10.48550/arXiv.2510.23883 [12] Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. 2025. Defeating Prompt Injections by Design. arXiv:2503.18813 doi:10. 48550/arXiv.2503.18813 [13] Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. 2024. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. arXiv:2406.13352
ACM AI Leadership Summit ’26, August 30–September 02, 2026, Atlanta, GA, USA
doi:10.48550/arXiv.2406.13352 [14] Abul Ehtesham, Aditi Singh, Gaurav Kumar Gupta, and Saket Kumar. 2025. A Survey of Agent Interoperability Protocols: Model Context Protocol (MCP), Agent Communication Protocol (ACP), Agent-to-Agent Protocol (A2A), and Agent Network Protocol (ANP). arXiv:2505.02279 [cs.AI] doi:10.48550/arXiv.2505.02279 [15] ESMA. 2018. MiFID II Articles 17 and 21; RTS 6 Algorithmic Trading. Technical Report. European Securities and Markets Authority. [16] Mohamed Amine Ferrag, Norbert Tihanyi, Djallel Hamouda, Leandros Maglaras, Abderrahmane Lakas, and Merouane Debbah. 2026. From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows. ICT Express 12, 2 (2026), 353–383. doi:10.1016/j.icte.2025.12.001 [17] Yu Fu, Jay Chen, Yantian Hou, Yilin Zhao, Hui Gao, Royce Lu, and May Wang. 2025. Safeguarding AI Agents: An In-Depth Look at A2A Protocol Risks. Palo Alto Networks. https://live.paloaltonetworks.com/t5/community-blogs/safeguardingai-agents-an-in-depth-look-at-a2a-protocol-risks/ba-p/1235996 [18] Google Developers. 2025. Google Cloud Donates A2A to the Linux Foundation. Google Developers Blog. https://developers.googleblog.com/en/google-clouddonates-a2a-to-linux-foundation/ [19] HL7 International. 2023. HL7 FHIR Release 5: Workflow Module. Technical Report. Health Level Seven International. [20] Yining Hong, Yining She, Eunsuk Kang, Christopher S. Timperley, and Christian Kästner. 2026. Symbolic Guardrails for Domain-Specific Agents: Stronger Safety and Security Guarantees Without Sacrificing Utility. arXiv:2604.15579 [cs.SE] doi:10.48550/arXiv.2604.15579 [21] Ruixuan Huang, Qingyue Wang, Hantao Huang, Yudong Gao, Dong Chen, Shuai Wang, and Wei Wang. 2025. RepetitionCurse: Measuring and Understanding Router Imbalance in Mixture-of-Experts LLMs under DoS Stress. arXiv:2512.23995 [cs.CR] https://arxiv.org/abs/2512.23995 [22] Invariant Labs. 2025. MCP Security Notification: Tool Poisoning Attacks. https: //invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks. Accessed 2026. [23] Adharsh Kamath, Sishen Zhang, Calvin Xu, Shubham Ugare, Gagandeep Singh, and Sasa Misailovic. 2025. Enforcing Temporal Constraints for LLM Agents. arXiv:2512.23738 doi:10.48550/arXiv.2512.23738 [24] Keysight Technologies. 2025. Potential Attack Surfaces in Agent2Agent (A2A) Protocol. https://www.keysight.com/blogs/en/tech/nwvs/2025/05/28/potentialattack-surfaces-in-a2a [25] Sahaya Jestus Lazer, Kshitiz Aryal, Maanak Gupta, and Elisa Bertino. 2026. A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes. arXiv:2601.05293 [cs.CR] https://arxiv.org/abs/2601.05293 [26] Donghyun Lee, Mo Tiwari, and Brando Miranda. 2026. Prompt Infection: LLMto-LLM Prompt Injection within Multi-Agent Systems. In Computer Security. ESORICS 2025 International Workshops (Lecture Notes in Computer Science, Vol. 16232). Springer. doi:10.1007/978-3-032-16092-8_28 [27] LF AI & Data Foundation. 2025. ACP Joins Forces with A2A Under the Linux Foundation’s LF AI & Data. https://lfaidata.foundation/communityblog/2025/08/ 29/acp-joins-forces-with-a2a-under-the-linux-foundations-lf-ai-data/ [28] Qiqi Lin, Xiaoyang Ji, Shengfang Zhai, Qingni Shen, Zhi Zhang, Yuejian Fang, and Yansong Gao. 2025. Life-Cycle Routing Vulnerabilities of LLM Router. arXiv:2503.08704 [cs.CR] https://arxiv.org/abs/2503.08704 [29] Microsoft AI Red Team. 2026. Updating the Taxonomy of Failure Modes in Agentic AI Systems: What a Year of Red Teaming Taught Us. Microsoft Security Blog. https://www.microsoft.com/en-us/security/blog/2026/06/04/updatingtaxonomy-failure-modes-agentic-ai-systems-year-red-teaming-taught-us/ [30] Microsoft Security Response Center. 2025. CVE-2025-32711: Microsoft 365 Copilot Information Disclosure Vulnerability. Microsoft Security Update Guide. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711 [31] Lesly Miculicich, Mihir Parmar, Hamid Palangi, Krishnamurthy Dj Dvijotham, Mirko Montanari, Tomas Pfister, and Long T. Le. 2025. VeriGuard: Enhancing LLM Agent Safety via Verified Code Generation. arXiv:2510.05156 doi:10.48550/ arXiv.2510.05156 [32] Tam Nguyen, Moses Ndebugre, and Dheeraj Arremsetty. 2026. Security Considerations for Multi-agent Systems. arXiv:2603.09002 [cs.CR] doi:10.48550/arXiv. 2603.09002 [33] OWASP Gen AI Security Project. 2025. Agentic AI: Threats and Mitigations. https://genai.owasp.org/initiatives/#agentic-security-initiative. Agentic Security Initiative. Accessed 2026. [34] OWASP Gen AI Security Project. 2025. LLM10:2025 Unbounded Consumption. OWASP Top 10 for Large Language Model Applications. https://genai.owasp. org/llmrisk/llm102025-unbounded-consumption/. [35] Pillar Security. 2025. New Vulnerability in GitHub Copilot and Cursor: How Hackers Can Weaponize Code Agents (Rules File Backdoor). Pillar Security; MITRE ATLAS case study AML-CS0041. https://www.pillar.security/blog/new-vulnerability-in-github-copilot-andcursor-how-hackers-can-weaponize-code-agents [36] reversinglabs. 2025. Postmark-MCP: A Malicious MCP Package Exfiltrating Email. https://www.reversinglabs.com/blog/postmark-mcp-attack-takeaways.
ACM AI Leadership Summit ’26, August 30–September 02, 2026, Atlanta, GA, USA
[37] Shoumik Saha, Kazem Faghih, and Soheil Feizi. 2026. Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry. arXiv:2605.11418 [cs.CR] https://arxiv.org/abs/2605.11418 [38] SecureW2. 2026. A2A Protocol Security: Authenticating Agent-to-Agent Communication. https://securew2.com/blog/a2a-protocol-security [39] Avital Shafran, Roei Schuster, Thomas Ristenpart, and Vitaly Shmatikov. 2025. Rerouting LLM Routers. In Conference on Language Modeling (COLM). arXiv:2501.01818 [cs.CR] https://arxiv.org/abs/2501.01818 [40] Jiawen Shi, Zenghui Yuan, Guiyao Tie, Pan Zhou, Neil Zhenqiang Gong, and Lichao Sun. 2025. Prompt Injection Attack to Tool Selection in LLM Agents. arXiv:2504.19793 [cs.CR] https://arxiv.org/abs/2504.19793 [41] Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, and Dawn Song. 2026. Progent: Securing AI Agents with Privilege Control. arXiv:2504.11703 [cs.CR] https://arxiv.org/abs/2504.11703 [42] Haochun Tang, Yuliang Yan, Jiahua Lu, Huaxiao Liu, and Enyan Dai. 2026. Route to Rome Attack: Directing LLM Routers to Expensive Models via Adversarial Suffix Optimization. arXiv:2604.15022 [cs.CR] https://arxiv.org/abs/2604.15022 [43] The Linux Foundation. 2025. Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF). Press release, 9 December 2025. https://www.linuxfoundation.org/press/linux-foundation-announces-theformation-of-the-agentic-ai-foundation [44] The Linux Foundation. 2025. Linux Foundation Launches the Agent2Agent Protocol Project to Enable Secure, Intelligent Communication Between AI Agents. Press release, 23 June 2025. https://www.linuxfoundation.org/press/linuxfoundation-launches-the-agent2agent-protocol-project-to-enable-secureintelligent-communication-between-ai-agents [45] The Linux Foundation. 2026. A2A Protocol Surpasses 150 Organizations, Lands in Major Cloud Platforms, and Sees Enterprise Production Use in First Year. Linux Foundation press release. https://www.linuxfoundation.org/press/a2a-
Lotfi, Shanto, et al.
protocol-surpasses-150-organizations-lands-in-major-cloud-platforms-andsees-enterprise-production-use-in-first-year [46] Haoyu Wang, Christopher M. Poskitt, and Jun Sun. 2026. AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents. In Proceedings of the 48th IEEE/ACM International Conference on Software Engineering (ICSE). arXiv:2503.18666 [47] Haoyu Wang, Christopher M. Poskitt, Jiali Wei, and Jun Sun. 2025. ProbGuard: Probabilistic Runtime Monitoring for LLM Agent Safety. arXiv:2508.00500 doi:10. 48550/arXiv.2508.00500 [48] Zihan Wang, Rui Zhang, Yu Liu, Wenshu Fan, Wenbo Jiang, Qingchuan Zhao, Hongwei Li, and Guowen Xu. 2025. MPMA: Preference Manipulation Attack Against Model Context Protocol. arXiv:2505.11154 [cs.CR] https://arxiv.org/abs/ 2505.11154 [49] Zhiyuan Xu, Joseph Gardiner, Sana Belguith, and Lichao Wu. 2026. RouteHijack: Routing-Aware Attack on Mixture-of-Experts LLMs. arXiv:2605.02946 [cs.CR] https://arxiv.org/abs/2605.02946 [50] Itay Yona, Ilia Shumailov, Jamie Hayes, and Nicholas Carlini. 2024. Stealing User Prompts from Mixture of Experts. arXiv:2410.22884 [cs.CR] https://arxiv.org/ abs/2410.22884 [51] Wenhui Zhang, Huiyu Xu, Zhibo Wang, Zhichao Li, Zeqing He, Xuelin Wei, and Kui Ren. 2026. RerouteGuard: Understanding and Mitigating Adversarial Risks for LLM Routing. arXiv:2601.21380 [cs.CR] https://arxiv.org/abs/2601.21380 [52] Jiayi Zhou, Yang Sheng, Hantao Lou, Yaodong Yang, and Jie Fu. 2026. FormalJudge: A Neuro-Symbolic Paradigm for Agentic Oversight. arXiv:2602.11136 doi:10. 48550/arXiv.2602.11136 [53] Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2025. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models. In 34th USENIX Security Symposium (USENIX Security 25). 3827–3844. doi:10.48550/arXiv.2402.07867