A new taxonomy says most AI agent security research is still testing the same few attack surfaces.
Researchers reviewed 66 studies on agentic AI security published between 2022 and 2026. They built a framework, T={S, B, P, A}, that links the system surfaces attacked, the trust boundaries crossed, the security properties violated, and the agent architectures actually tested. They also dug into 22 red-teaming studies with public artifacts and 11 security benchmarks to check how rigorous the evaluation methods really are. The pattern that emerged: empirical work clusters heavily around prompt and reasoning manipulation, memory tampering, and tool-use exploits, mostly in single-agent setups.
That concentration matters because it does not match where the industry is headed. Persistent state, human-agent interactions, multi-agent coordination, and long-horizon autonomy are exactly the features vendors are shipping, yet they get comparatively little empirical scrutiny. The researchers also flag inconsistent metrics across benchmarks and a near-absence of testing against defenses that adapt over time.
The paper closes with 13 open questions rather than answers, which is a fair summary of where agent security stands: we are still writing the test for something already in production.