Securing AI Agents: Understanding the Architecture and the Risks

The security challenge is changing

Organizations are moving beyond generative AI systems that primarily produce content and answer questions. Increasingly, AI systems can retrieve information, interact with applications, determine workflows, and execute actions with varying degrees of autonomy.

These capabilities offer significant opportunities for productivity and operational efficiency. They also introduce security considerations that extend beyond the underlying language model.

A recent research paper, The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey (2026), examines this changing security landscape.

The researchers identify seven design dimensions that influence an AI agent's security exposure and seven categories of security risks associated with agentic systems.

Together, these frameworks offer a useful way to understand how agent architecture influences security risks and where organizations should focus their controls.

Part 1: Seven design dimensions that shape AI agent security

The security profile of an AI agent depends on more than the model powering it. Its information sources, permissions, memory, tools, workflows, and interaction methods all influence the potential consequences of a security failure.

The researchers identify seven dimensions that help organizations examine these characteristics.

1. Input Trust — Where does the agent obtain its information?

AI agents process information from documents, websites, emails, databases, and external services.

These sources have different levels of trust. Untrusted content can contain malicious instructions designed to influence agent behaviour.

Security implication: Organizations must distinguish trusted instructions from external information and prevent untrusted content from overriding authorized behaviour.

2. Access Sensitivity — What information can the agent access?

Agents may retrieve confidential business information, customer records, intellectual property, or other sensitive data.

The breadth and sensitivity of that access influence the potential consequences of unauthorized disclosure.

Security implication: Access should be restricted to information necessary for the agent's intended purpose, with permissions enforced through appropriate access controls.

3. Workflow — Who determines how the agent completes a task?

Some agents follow predefined processes, while others independently determine the sequence of steps needed to achieve an objective.

Greater workflow flexibility can introduce unintended deviations from established procedures.

Security implication: Required verification, authorization, and approval controls must remain enforceable regardless of the workflow selected by the agent.

4. Action — What can the agent execute?

An agent that retrieves information presents a different risk profile from one that can modify records, send communications, execute code, or initiate transactions.

As agents gain operational authority, the consequences of mistakes or manipulation increase.

Security implication: Sensitive actions require clear authorization boundaries, execution restrictions, and appropriate human oversight.

5. Memory — What information does the agent retain?

Persistent memory allows agents to use information across interactions.

However, stored information can become outdated, exposed, or deliberately manipulated, potentially affecting subsequent behaviour.

Security implication: Memory integrity, access controls, retention limits, and mechanisms for correcting compromised information become important safeguards.

6. Tool — Which systems can the agent interact with?

Tools and connectors extend agent capabilities into enterprise applications, databases, APIs, and external services.

Each integration introduces permissions, dependencies, and potential attack paths.

Security implication: Organizations should maintain visibility over connected tools, restrict their privileges, and independently authorize sensitive operations.

7. User Interface — How does the agent interact with its environment?

Agents may operate through text, browsers, graphical applications, and other interfaces.

These interaction methods can expose agents to misleading content or unexpected actions.

Security implication: Security assessments should account for how agents interpret information and execute operations across different interfaces.

What these dimensions tell us

The seven dimensions are not seven vulnerabilities.

They describe architectural characteristics that influence an agent's exposure to threats.

An agent's risk profile depends on how these characteristics interact, the business environment in which it operates, and the controls protecting it.

This distinction becomes important when examining the second part of the research: the security risks themselves.

Part 2: Seven security risks in agentic AI

The research organizes agent security risks into seven categories, covering attack entry points, unsafe behaviour, information exposure, unauthorized actions, and service disruption.

These categories help explain what can go wrong when architectural exposures are exploited or inadequately controlled.

R1. Heterogeneous Untrusted Interfaces — Expanded Attack Surface

AI agents interact with multiple external information sources, persistent memory, and third-party tools.

These interfaces create additional entry points through which attackers may introduce malicious content or manipulate the agent's operating environment.

Unlike a standalone language model, an agent may encounter threats across several connected components during a single workflow.

Why it matters: Security teams must assess the complete agent environment rather than treating the language model as the only component requiring protection.

R2. Wrong Instruction Following — Prompt Injection

Agents can encounter malicious instructions embedded in content they are legitimately processing.

When an agent follows these instructions instead of authorized user or system instructions, its behaviour may be redirected.

This is a central concern in prompt injection attacks.

Why it matters: The ability to process external information must not give that information authority over the agent's actions.

R3. Unconstrained or Unsafe Data Flow — Loss of Information Control

Agentic systems may allow information from untrusted inputs to influence responses, decisions, and subsequent tool calls.

Without sufficient restrictions, information can move across trust boundaries in unintended ways.

This can contribute to confidential data exposure, unauthorized modifications, or misuse of connected resources.

Why it matters: Organizations need controls over how information moves between data sources, agent components, and external systems.

R4. Hallucinations and Model Mistakes — Security Consequences

Language models can generate incorrect or fabricated information.

In agentic systems, these errors may influence actual operations rather than remaining confined to an inaccurate response.

The research highlights how attackers can exploit model mistakes, including through malicious software packages designed to match package names that models incorrectly suggest.

Why it matters: Organizations should validate consequential actions and external dependencies rather than relying solely on the model's generated reasoning or recommendations.

R5. Private Data Leakage — Confidentiality Risks

Agents may handle sensitive information from user conversations, persistent memory, credentials, and connected applications.

Attackers may exploit weaknesses in agent behaviour or connected components to extract this information.

Data leakage can occur through manipulated outputs, unauthorized communications, or interactions with attacker-controlled resources.

Why it matters: Confidentiality controls must extend across the agent's entire workflow, including retrieval, memory, tool execution, and external communication.

R6. Unintended Actions and Data Corruption — Integrity Risks

Agents may perform unintended or unauthorized actions that modify information, systems, or business processes.

These risks include inappropriate transactions, unauthorized code execution, file modifications, and corruption of stored information.

Manipulated agent memory can also affect the integrity of future decisions.

Why it matters: Organizations need independent authorization checks, restrictions on high-impact actions, and mechanisms to detect and recover from unauthorized changes.

R7. Resource Drain and Denial of Service — Availability Risks

Agentic systems consume computing resources, API capacity, and external services while completing tasks.

Attackers may exploit agent autonomy to trigger excessive requests, repeated execution loops, or unnecessary resource consumption.

The resulting consequences can include service disruption, degraded performance, and significant operational costs.

Why it matters: Resource limits, execution boundaries, monitoring, and interruption mechanisms are essential for maintaining availability and controlling costs.

Part 3: Connecting agent design to security risk

The real value of these two frameworks emerges when they are considered together.

The seven design dimensions describe how an agent is built and operates. The seven risk categories describe the security failures and attack opportunities that can arise within that architecture.

The relationship is not necessarily one-to-one. A single design characteristic can contribute to multiple risks, while a single attack may exploit several components.

The following table illustrates some of the connections.

These relationships help organizations move beyond general statements about AI security.

They provide a starting point for identifying relevant threat scenarios, assessing the consequences of compromised agent behaviour, and selecting controls that address those exposures.

Part 4: What organizations should do differently

The research reinforces the importance of assessing AI agents as interconnected systems rather than isolated models.

For organizations deploying agentic AI, five priorities deserve attention.

1. Understand the agent's architecture

Document the agent's business purpose, information sources, connected applications, memory capabilities, permissions, and executable actions.

This establishes a foundation for identifying where security exposure exists.

2. Establish enforceable authorization boundaries

Agents should operate with the minimum permissions necessary to perform their intended functions.

Sensitive operations should require authorization that cannot be bypassed merely because the agent generates a different execution plan.

3. Protect information across the workflow

Organizations should evaluate how sensitive information moves between the agent, memory, connected tools, and external services.

Controls should address both unauthorized access and unintended disclosure.

4. Test how agents behave under attack

Security testing should examine prompt injection, manipulated tool responses, unauthorized action attempts, memory poisoning, and resource exhaustion.

Testing should verify not only whether the agent attempts an unsafe action, but whether independent controls prevent that action from succeeding.

5. Maintain visibility over agent execution

Monitoring should capture relevant tool calls, authorization decisions, security events, and resulting actions.

This information supports incident investigation, control validation, and ongoing assurance.

Part 5: From understanding risk to demonstrating control

The seven design dimensions and seven security risks provide a structured foundation for agent security assessments.

However, identifying a risk does not demonstrate that an organization is adequately protected.

A complete assessment must also establish which controls are required, how those controls operate, and what evidence demonstrates their effectiveness.

This is particularly important for agents capable of accessing sensitive information or executing consequential business actions.

Organizations should be able to answer three questions:

• Do we understand what our AI agents can access and execute?
• Have we implemented controls proportionate to the risks?
• Can we demonstrate that those controls prevent or detect unauthorized behaviour?

These questions connect AI security architecture to practical governance, testing, and assurance.

Research limitations

The underlying paper is a survey that organizes existing agent security research into a common framework.

Its contribution is the systematic classification of agent architectures, attack vectors, risks, and defenses.

It does not establish that every agent will experience all seven risks, nor does it provide a validated numerical risk-scoring model.

The relevance and severity of each risk depend on the agent's implementation, permissions, operating environment, and available controls.

Organizations should therefore use the taxonomy to guide risk identification and security assessment, supported by testing appropriate to their specific deployments.

Conclusion

As organizations adopt agentic AI, security must evolve beyond evaluating model outputs.

The architecture of an AI agent determines what it can access, how it processes information, and which actions it can execute. Those capabilities influence the threats it may encounter and the consequences of a security failure.

The seven design dimensions help organizations understand their exposure. The seven security risks provide a framework for examining what can go wrong.

Together, they offer a practical foundation for more informed security assessments, stronger control design, and ongoing assurance.

Securing agentic AI ultimately requires more than trusting the model. It requires confidence in the entire system—and evidence that its actions remain within authorized boundaries.

Research and further reading

Primary research

Kim, J., Liu, X., Wang, Z., Qiu, S., Li, B., Guo, W., & Song, D. (2026). The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey. Accepted to USENIX Security 2026.

https://arxiv.org/abs/2603.11088

About this article

This article interprets the research for business, technology, and risk leaders. The control recommendations and mapping between design dimensions and risk categories are Strategic Outlook Advisory's practical synthesis, not a separate empirically validated framework from the researchers.

Strategic Outlook Advisory — Securing Intelligence: Research-informed perspectives on AI security, governance, and assurance.