Four-Dimension Agent Security Map: 32 Threat Classes and 13 Open Questions

In September 2026, researchers at Sungkyunkwan University and CSIRO reviewed 66 agent security papers from 2022 to 2026 and proposed a four-dimension threat map with 32 classes and 13 open questions. They then examined 22 red-team studies with public experimental materials and 11 agent security benchmarks.

Study scope

In September 2026, researchers from Sungkyunkwan University and Australia's Commonwealth Scientific and Industrial Research Organisation (CSIRO) surveyed 66 agent security papers published from 2022 through 2026. They proposed a four-dimension threat taxonomy. They then reviewed 22 red-team studies that published experimental materials and 11 representative agent security benchmarks. The questions they set were which agent risks exist, which of those risks have been tested, and how mature current security evaluation is.

Paper: https://arxiv.org/pdf/2609.23894

The result is a map with 4 dimensions, 32 threat classes, and 13 open questions.

From model security to system security

A typical large language model follows input, model, then output. An agent maintains goals and state, reasons and plans, reads long-term memory, calls external tools, and continues from tool results. The security chain becomes goal, reasoning, memory, planning, tools, environment, new state, then reasoning again.

The paper frames the core questions as where an attack enters, which component it affects, which trust boundary it crosses, and what consequence it produces.

Four-dimension model

The paper writes an agent threat as T = ⟨S, B, P, A⟩.

• S, Surface: what the attack affects
• B, Boundary: where the attack enters or spreads
• P, Property: what security property is broken
• A, Architecture: on which class of agent system the risk was experimentally verified

The four dimensions are combinable labels, not attack stages. The paper states that the notation does not encode time order or causality.

Surface

Surfaces include goals and state; reasoning and planning, including direct and indirect prompt injection, policy bypass, reasoning-path interference, and resource-consuming replanning; memory and knowledge, including persistence across sessions and spread through shared memory; actions and tools, including tool-description poisoning, tool-return manipulation, cross-tool composition, and permission abuse; plus infrastructure, supply chain, and governance and oversight.

Boundary

Boundaries treated in the paper are Human-Agent, Agent-Agent, Agent-Tool or Service, Agent-Environment, and extensions to infrastructure, supply chain, and governance interfaces. Indirect prompt injection is described as low-trust data crossing a boundary and being treated as higher-trust instructions. The paper states that identity, source, authorization, and provenance become more important for agents.

Property

Beyond confidentiality, integrity, and availability, the paper lists agent-specific properties: goal integrity; state and knowledge integrity; action and authorization integrity; interaction and trust integrity; oversight and accountability; plus confidentiality, availability, and physical safety for embodied systems, for eight properties in total. Action and authorization integrity covers sequences in which each step is individually allowed but the combined trajectory A to B to C was never authorized. The paper says evaluation should check the full execution trajectory against the original authorization and goal, not only a single tool call.

Architecture

Architecture records where experiments were run, not where an attack can only occur. Types include hierarchical systems with a coordinator and downstream agents; pipeline systems A to B to C; horizontal collaboration with discussion, voting, or cross-checks, where identity, consensus, collusion, and Byzantine behavior matter; and dynamic-graph systems whose membership, roles, and communications change at runtime.

32 threat classes

The 32 classes are grouped for reading, not as an extra axis.

Fifteen functional threats: goal manipulation, reward or specification manipulation, strategic misalignment, instruction hijacking, safety-policy bypass, reasoning and planning interference, reasoning resource consumption, policy leakage, memory and knowledge poisoning, persistent state manipulation, contextual data leakage, tool-inventory poisoning, tool-execution exploitation, cross-tool exploitation, and privilege escalation.

Eleven interaction and trust-boundary threats: human-agent trust manipulation, human-approval bypass, agent identity and communication attacks, cross-agent risk propagation, consensus and Byzantine manipulation, agent collusion, tool or service impersonation, tool metadata and return-value manipulation, credential and authorization abuse, environment manipulation, and cyber-physical attacks.

Six systemic and operational threats: resource and availability attacks, isolation and credential compromise, component and dependency compromise, install and update manipulation, oversight degradation, and governance evasion.

Experimental coverage

Of 66 papers used to build the map, 22 red-team studies met a stricter bar: a concrete attack on an agent; a description of attacker, target, process, and results; and at least one of code, attack prompts, a dataset, or evaluation scripts. The authors also reviewed 11 benchmarks.

Sixteen of the 22 studies target a single agent; six involve multi-agent systems. Seven report defense experiments. Ten of 11 benchmarks mainly target single-agent systems. Existing work concentrates on prompt and reasoning, memory poisoning, and tool-related attacks. Coverage is thinner for cross-session persistence, Human-Agent security, complex multi-agent collaboration, systemic risk, and long-horizon execution. The authors note that this distribution reflects the selected public studies, not a claim that other work does not exist.

Attack success rate

The paper states that Attack Success Rate (ASR) is not comparable across papers. Some count attacker-desired text as success, some require a wrong tool choice, some require sensitive-data leakage, and some require an external state change. It proposes three result levels: Model Compromise, where generated content changes; Agent Compromise, where goals, state, plans, or pending actions change; and System Impact, where a verifiable unauthorized, harmful, or persistent external state change occurs.

Trajectories as the evaluation unit

The paper argues that reproducible agent security tests should record model version and parameters, tool versions, permissions, initial memory, environment state, multi-agent topology, and the full execution trajectory. The sample unit shifts from one input and one output to initial state, a sequence of observations, reasoning, memory, and actions, then final system state.

13 open questions

The paper closes with 13 open questions. The first three concern how to measure evidence maturity across attack models, architectures, and environments; how to make Model Compromise, Agent Compromise, and System Impact comparable; and whether a finding on one topology transfers to another.

OQ4 through OQ7 address long-running operation: distinguishing legitimate goal adjustment from induced Goal Drift; detecting unauthorized trajectories before irreversible results; restoring poisoned long-term memory while keeping useful learned state; and detecting agents that misbehave only under hidden triggers or that recognize they are under test.

OQ8 through OQ10 focus on multi-agent and Human-Agent settings. The paper states that multi-agent security is not the same as running a single-agent benchmark ten times. Remaining items in the source are truncated.