Agents of Chaos: A Systematization of Knowledge (SoK) on Malicious Attacks on Agentic AI Systems

Summary

This systematic review screens 186 candidate sources and retains 98, identifying 284 atomic attacks and 452 atomic safeguards against agentic AI systems that extend LLMs with tools, memory, retrieval, and multi-agent coordination. Tool, MCP, and action-layer attacks make up the largest share of atomic attacks, while the prompt-injection and action-hijacking class has the broadest paper coverage. Only 278 of 660 attack-safeguard relationships are directly assessed, so safeguard coverage remains uneven.

Mitigation

The paper states that its findings support lifecycle-aware threat modeling, agent evaluation, tool governance, and defense-in-depth security for agentic AI systems.

Topics

• AI agents

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• LowHelp defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validationSimilar attack · AWS Security Blog
• InfoSuppression Is Not Erasure: Mechanistic Analysis and Reactivation Boundaries of Subspace Projection for LoRA Backdoor DefenseSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading