Aug 2026· International Conference on Cyber Security And Protection Of Digital Services· Vol 10, pp. 6· 0 citations
TL;DR
This paper proposes a five-layer defence-in-depth framework encompassing input validation, identity and least privilege, runtime sandboxing, human-in-the-loop governance, and continuous behavioural monitoring, and identifies sandboxing and least-privilege enforcement as the highest return on investment controls.
Abstract
The rapid enterprise adoption of agentic artificial intelligence (AI) has introduced a category of security risk that existing cyber security frameworks were not designed to address. With 78 per cent of Fortune 500 companies projected to deploy agentic AI by 2026 and the global market expected to reach US$89.6bn, the attack surface created by these autonomous workflows demands urgent attention from security practitioners. This paper examines the distinct threat model presented by agentic AI, drawing on recent high-profile incidents, including the weaponisation of a large language model in a state-sponsored espionage campaign affecting 30 organisations and the compromise of an open-source agent framework exposing 30,000 Internet-facing instances, to illustrate the consequences of inadequate controls. Grounded in the Open Worldwide Application Security Project’s Top 10 for Agentic Applications (2026) and the National Institute of Standards and Technology’s ongoing agentic AI security initiative, the paper proposes a five-layer defence-in-depth framework encompassing input validation, identity and least privilege, runtime sandboxing, human-in-the-loop governance, and continuous behavioural monitoring. It identifies sandboxing and least-privilege enforcement as the highest return on investment controls, provides a prioritised implementation roadmap, and discusses the emerging paradigm of cryptographic workflow authentication. The analysis concludes that organisations treating agentic AI security as an extension of traditional application security will find themselves critically exposed and that a purpose-built security architecture is now a business imperative. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
In today’s evolving digital landscape, a new kind of AI has emerged: agentic artificial intelligence (AI) systems. These are not just tools but intelligent entities that act on their own, make decisions, and carry out tasks proactively. Once placed inside containerised cloud environments such as Kubernetes, however, these powerful agents open the door to a whole new category of security concerns. They often interact on the fly with application programming interfaces, data channels, and other AI agents, sometimes all at once, and not always in predictable ways. Recognising the risks, this paper introduces a formal framework designed to capture and analyse these unique vulnerabilities. Going beyond theory, the study offers a full threat taxonomy focused on agent behaviours, uses temporal logic to trace how agents and environments interact over time, and introduces a practical measure called the Agentic Vulnerability Exposure Metric (AVEM). To put this model to the test, researchers ran simulated cyberattacks on a Kubernetes-based orchestration system that was managing large language model (LLM)-powered agents. The results were eye-opening: AVEM was able to expose security holes such as weak isolation between agents, overlooked permissions, and routes for privilege escalation that had gone undetected before. To test the practicality of the model, real-world attack scenarios are simulated on a Kubernetes-managed AI platform utilising LLM agents. The findings reveal that AVEM effectively uncovers weaknesses such as poorly defined isolation boundaries, unexpected capabilities, and opportunities for privilege escalation between agents. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
Advait Patel, Vaishnavi Gudur, Charit Upadhyay et al.· International Conference on...· 0 citations
Industry 5.0 places autonomous agents inside its human–agent collaborative loop, resting its human-centricity pillar on an assumption of trustworthy collaboration that has not been examined critically. Agentic artificial intelligence has moved from research demonstration to industrial deployment within months, introducing a threat class this setting has not yet addressed. This article bridges three literatures developed in isolation, Industry 5.0 cybersecurity, agentic AI security, and Industry 5.0’s own foundational scholarship, proposing a six-category threat taxonomy and a paired forensic readiness framework, formalised as a five-level maturity model and grounded in real 2024–2026 incidents rather than hypothetical scenarios. Both contributions are evaluated through two complementary methods. An exploratory elicitation exercise, modelled on Delphi methodology and using six independent large language models as blind panellists across two rounds, converges on a specific structural critique that is incorporated into the taxonomy’s final design. A retrospective coding exercise then applies that taxonomy to fourteen publicly documented incidents, finding that half require multi-category classification and that two categories remain unexercised in the current public record, evidence that physically embodied industrial deployment has outpaced the documented incident base rather than a gap in the taxonomy itself. This urgency is reinforced by emerging EU and UK regulation imposing 24- and 72-h incident reporting obligations that, on current evidence, most industrial organisations are not positioned to meet. The article closes with a research agenda addressing liability, evidentiary standards, and the readiness-sustainability trade-off.
Maurice E. Dawson, Ahmed Ben Ayed, Samson Quaye· Information· 0 citations
Aim/Purpose: The primary objective is to address the structural operational cost crisis in modern SOCs by designing and formally specifying a three-layer agentic AI framework that integrates semantic alert triage, adaptive reinforcement-learning response, and episodic knowledge synthesis into a unified architecture.
Background: Modern SOCs are experiencing an acute operational crisis. Exponential growth in alert volume, high false-positive rates (>40%), and chronic analyst attrition have created a perfect storm. Existing rule-based SIEM and single-agent SOAR approaches only achieve 20–55% alert automation and fail to address the full operational lifecycle.
Methodology: The framework evaluation is based on a structured comparison with seven benchmark systems across four dimensions (threat coverage breadth, integration completeness, cost quantification, and adversarial safeguards), each rated on a five-level ordinal scale using replicable criteria.
Contribution: The paper makes four contributions: (1) a formal algorithmic specification of a three-layer agentic AI architecture including three pseudocode procedures and a PPO state-action-reward formalism; (2) a quantitative operational cost projection framework explicitly distinguishing designed targets from measured performance, with a maximum designed workload reduction of 86%; (3) a systematic four-dimensional comparative analysis against seven benchmark frameworks demonstrating that CyberAgent is the only framework achieving full architectural completeness (integrating all three of semantic triage, adaptive RL response, and episodic knowledge synthesis simultaneously), an architectural claim requiring empirical confirmation; and (4) dual adversarial safeguards (prompt injection mitigation and reasoning consistency verification) absent from all seven benchmark frameworks.
Findings: CyberAgent is a theoretical design-science artefact that has neither been implemented nor empirically evaluated. All quantitative projections are designed to achieve targets grounded in prior work, not verified outcomes: an alert automation rate of 85–90%, an analyst workload reduction of 56–86% (design target 86% under the product-rule independence assumption), an MTTR reduction of 65–75%, and a false-positive reduction of 60–70%. These projections require empirical validation using CybORG and the DARPA OpTC dataset, with this as the primary future work priority.
Recommendations for Practitioners: The PTL’s Chain-of-Thought (CoT) reasoning traces provide human-readable decision narratives that enhance transparency and may support auditability workflows relevant to GDPR Article 33, HIPAA, PCI-DSS, and SOX. However, CoT traces do not automatically satisfy regulatory auditability or compliance requirements; they are one architectural input to a broader compliance process. Formal legal and compliance assessment by qualified professionals is required before deployment in regulated environments. Practitioners should treat CoT output as decision-support documentation, not as regulatory certification.
Recommendation for Researchers: Future work should also develop federated DRL training protocols to ensure policy convergence under data-scarce conditions and rigorously test the adversarial robustness of the PTL’s consistency-checking mechanism against novel prompt-injection strategies.
Impact on Society: If empirically validated, CyberAgent could make enterprise-grade cyber defence more accessible to mid-market organisations that cannot afford 24/7 SOC analyst staffing, by substantially reducing the alert-triage workload. All such impact claims are conditional on validation results.
Future Research: Priority directions include: (1) empirical implementation and red-team validation across diverse enterprise environments; (2) federated DRL training to address the data sharing constraints that limit policy learning in regulated sectors; (3) extension of the KSL to support cross-organizational threat intelligence sharing; and (4) longitudinal studies measuring analyst skill development and human-AI trust calibration under progressively increasing levels of CyberAgent autonomy.
S. Meeampol, Narongsak Sukma· Interdisciplinary Journal of...· 0 citations
The rapid development of Large Language Models (LLMs) and Artificial Intelligent (AI) powered autonomous agents has fundamentally changed the existing forms of software governance. In spite of the rigorous standards of transparency and account ability required according to the international frameworks such as the European Union's AI Act, there is a considerable gap between theory and reality. The present study discusses the inherent drawbacks of currently utilized platforms for LLM evaluation, machine learning workflow, and application performance monitoring in general. It has been shown that current disjointed solutions fail to protect unbound state space agentic architecture from serious threats such as alignment drift, SaaS security concerns, and unauthorized deployment of shadow AI systems. Moreover, a solution is proposed for overcoming the discussed challenges in form of a coherent multi-level AI governance stack Traccia built on the top of OpenTelemetry infrastructure platform. Traccia resolves the last mile for AI Alignment by adding the telemetry data, passive semantic guardrail assessment, and execution lineage into a hashed trace ledger. Traccia automatically creates compliance evidence packages by appending tamper-resistant fingerprints and SHA-256 content hash, that map to regulatory requirements (Articles 12, 14, 19, 26(6), and 50 of the EU AI Act) without invading any data privacy. By performing this evaluation in a methodical manner, a solid machine-readable base has been created for enterprise-wide management of autonomous AI systems.
This paper organizes the area into a structured taxonomy along five axes: the de-tection capability targeted, the analysis paradigm employed, the agent archi-tecture, the degree of autonomy, and the evaluation methodology.
Andi Xia· Poster Volume 0008 The 2026...· 0 citations
Security Operations Centers (SOCs) rely on Level 1 analysts to triage increasing alert volumes amid alert fatigue and tool fragmentation. LLM-based multi-agent systems using the Model Context Protocol (MCP) are being adopted to automate these tasks, but their autonomy and tool access expose them to attacks such as tool poisoning, indirect prompt injection, and confused deputy exploitation. To address this gap, this work proposes a security framework for MCP-based multi-agent SOC pipelines, implemented as a middleware layer comprising a tool registration validator and five execution layers: access control, rate limiting, input validation, output validation, and audit logging. The framework is applied to a triage-enrichment-response pipeline connected to a Wazuh SIEM through a custom MCP server. Of the 35 attack vectors considered in a threat model derived from different threat taxonomies, including OWASP, MITRE ATLAS, and ATFAA, 29 are addressable at the middleware level and are covered by the framework’s controls. These controls are then validated experimentally using a purpose-built malicious MCP server and targeted test-harness injections, organized into six test suites that together exercise the covered vectors across 600 executions. Every attack instance in the evaluated threat model was blocked, none bypassed the framework, and no legitimate call in the evaluated set was incorrectly rejected; obfuscated variants, however, evade the lexical content-inspection controls, delimiting the scope of this result. A full-pipeline demonstration confirms that the framework preserves benign operational outputs. These results indicate that systematic middleware controls can secure MCP-based agentic SOC deployments without modifying the underlying agents or MCP servers.
R. Simões, Xavier Larriva-Novo, Carmen Sánchez-Zas et al.· Applied Sciences· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
