Every few months a research field produces a paper that isn't a new result so much as a new map — a survey that steps back, reads everything, and tells you what the whole territory actually looks like. For AI agent security, that paper arrived in 2026: a Systematization of Knowledge (SoK) that digests 247 papers published between 2023 and 2026.
If you only read one thing to get oriented in this space, I'd argue it should be this. Its central claim is deceptively simple, and I keep coming back to it:
Once a language model is wired into a loop that plans, calls tools, keeps memory, and acts on the outside world, security stops being about unsafe text and becomes a software-and-systems problem.
That sentence quietly reframes the entire field. For years the dominant mental model of "AI safety" was about outputs — will the model say something harmful? The SoK argues that framing is a category error the moment you deploy an agent. The interesting failures aren't in what the model says; they're in how untrusted information becomes a control decision, how that decision meets delegated authority, and how persistent state changes the security properties of the whole system over time.
The lifecycle, not the incident
The most useful contribution of the survey is that it stops cataloguing attacks in isolation and instead maps them onto the agentic lifecycle — eight phases where things can go wrong:
- input handling
- planning
- decision-making
- tool execution
- output generation
- memory & state
- monitoring
- multi-agent coordination
This matters because it changes the question you ask. Instead of "is this output safe?" you ask "at which phase did untrusted input acquire the authority to cause harm?" A prompt injection isn't a single event; it's a chain that starts in input handling, survives planning, and cashes out at tool execution. Threat-modeling the lifecycle shows you where a boundary could have stopped it.
The finding that should worry defenders
Here's the part that I think deserves the most attention. The survey looked at the defenses the field has produced — guardrails, privilege controls, isolation, provenance tracking — and found that individually, they mostly work. The problem is composition: they "do not cleanly add up." Each defense assumes a different trust model, and when you stack them, the assumptions don't line up into a coherent whole. You can bolt together four reasonable defenses and still leave a seam an attacker walks through.
This is a genuinely important insight, and it's the kind of thing only a survey can surface, because you can't see it from inside any single paper. Every individual defense looks fine. The gap is in the spaces between them.
We're also measuring the wrong things
The second uncomfortable finding is about benchmarks. Most agent-security evaluations measure single-turn, bounded success rates — did the attack work, yes or no, in one shot. But real agents run for a long time, carry state across sessions, and coordinate with other agents.
The under-measured risks
The survey argues we're systematically under-measuring exactly the risks that matter most in deployment: long-horizon behavior, stateful memory corruption, and multi-agent propagation. And almost nobody jointly measures safety alongside utility, latency, and cost — which is how you end up with "secure" designs no one actually ships because they're too slow or too useless.
Where the field should go
The survey lands on four pillars for building agents that are secure by construction rather than by patching:
// Explicit trust boundaries
Know where trusted authority ends and untrusted input begins — and enforce it structurally.
// Principled least privilege
Scope authority per-action, not per-agent. Don't hand one agent everything it can touch.
// Provenance-tracked state
Know where every piece of memory came from, so poisoned state can't launder into trusted context.
// Deployment-realistic evaluation
Measure long-horizon, stateful, multi-agent behavior — and safety alongside utility, latency, and cost.
None of those are surprising if you come from systems security — and that's exactly the point. The message of 247 papers, distilled, is that agent security is a systems-engineering discipline that happens to have a language model at its core, and the sooner the field treats it that way, the faster it'll make real progress.
What I like about survey papers like this one is that they're a cheap way to buy perspective. Reading one SoK won't make you a researcher, but it will inoculate you against the two most common mistakes in this space: thinking the model is the whole problem, and thinking a single clever defense is the whole solution.
Sources: Toward Secure LLM Agents — a 247-paper SoK; A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents (arXiv 2604.23338); Data Agents Under Attack (arXiv 2606.08661).