A new academic survey lays out everything that can go wrong when AI agents get memory, tools, and autonomy, and proposes a checklist for catching failures before they ship.
The paper reviews agentic AI trustworthiness across five areas: safety and robustness, alignment and human oversight, transparency, privacy, and regulatory compliance. It catalogs failure modes including indirect prompt injection, where malicious instructions hidden in a webpage or email get read and obeyed by the agent, along with backdoor triggers, goal misgeneralization, memory contamination, and data leaking across sessions. The authors also weigh mitigations like instruction hierarchies, isolating untrusted context, and constrained tool use, and they flag which ones have real evidence behind them versus which are still just proposals. The centerpiece is TADL, a six-phase lifecycle spanning specification, design, training, evaluation, deployment, and monitoring, meant to give teams concrete decision points before deploying an agent.
The taxonomy itself will look familiar to anyone tracking prompt injection research over the past two years. What is more useful is the paper's blunt accounting of how much of the current mitigation toolkit is unproven rather than battle-tested, at a moment when companies are plugging LLMs directly into email, databases, and code execution.
The catch: TADL has not been tested on an actual production agent. A framework for building trustworthy agents that nobody has yet trusted with one is a reasonable place to start, but it is still just a start.