Agentic AI Security

Overview:

Applications have moved from deterministic, role-based logic, through ML-powered systems with models embedded in the application, to agentic AI applications in which autonomous agents plan, invoke tools, coordinate with one another, and act with minimal human intervention. Each step up in autonomy and intelligence has also been a step up in opacity. An agentic application is assembled at runtime from parts nobody fully enumerates: models served remotely, tools reached over MCP, peer agents contacted over A2A, skills loaded from external repositories, and context accumulated across a session. The result is a supply chain that looks nothing like the dependency tree of a conventional program — and that today’s tooling cannot see.

This project treats that gap as the central problem. Security and efficiency in agentic systems are not separable concerns: verifying every dynamically loaded context source before use adds latency; skipping verification is faster and unsafe. A redundant coordinating agent produces correct answers while adding an LLM call, tokens, and latency to every delegation. Behavioral testing catches neither. We therefore build the measurement infrastructure first — benchmarks whose numbers mean something, static analysis that reads the architecture rather than the output, and provenance records for the context an agent actually consumed.

Research Challenges

• Testing and Evaluation. Agentic and LLM evaluation is currently unreliable in ways that are easy to miss. Benchmarks differ in task format, prompt template, inference configuration, answer extraction, and scoring, and each of these choices moves the reported score. We audit the existing landscape, isolate the design decisions that drive variance, and construct benchmarks that measure capability rather than harness artifacts. The work runs along two tracks: domain-specific benchmarking, targeting cybersecurity knowledge and software dependency exploitability; and a domain-agnostic security and performance audit of agentic interaction itself.
• Model and Software Dependencies. Agentic applications inherit the entire fragility of the software supply chain and add model dependencies on top of it. We work on reasoning over dependency graphs to answer security questions about what a system actually pulls in, on the exploitability of known vulnerabilities in bundled dependencies, and on the failure modes introduced when code-generating agents recommend packages that do not exist.
• Context Management. In a conventional application, dependencies are largely declared before execution. In an agentic application, context arrives during execution — through prompts, AG-UI events, A2A messages, MCP tool responses, and dynamically loaded skills — and is never recorded. We are developing a Context Bill of Materials (Cx-BOM) that captures this runtime composition, making SBOM-style provenance, integrity, and vulnerability checks possible for context the way they already are for code.

Key Contributions:

• Cybersecurity Knowledge Benchmark (Sayf-Eval). A systematic audit of cybersecurity knowledge benchmarks for LLMs, spanning eleven benchmark families from MMLU-CS through RedSage-Bench, organized by a taxonomy over dataset, inference, and evaluation. A controlled harness — dataset normalization, prompt standardization, controlled inference, robust answer extraction, consistent scoring — isolates measurement choices from model capability, and surfaces recurring failure modes alongside score swings large enough to reorder model rankings. Evaluation covers proprietary, open-weight, and cybersecurity-specialized models.
• VEX-DS: Dependency Exploitability Benchmarking. A known CVE in a bundled dependency is not necessarily exploitable in the application that bundles it. The Vulnerability Exploitability eXchange (VEX) format captures this judgment — affected, not affected, fixed, under investigation — and a not affected claim requires a documented justification: the vulnerable component is absent, the vulnerable code is not reachable, it cannot be controlled by an adversary, or an inline mitigation already exists. VEX is the practical way to meet Cyber Resilience Act duties, yet producing these judgments is a reasoning task existing benchmarks do not target. VEX-DS builds one, generating cases from seeds and configuration through synthesis and mutation stages — with an optional obfuscation stage — each gated by its own verifier.
• AgentSA: Agentic Interaction Graphs. A static analysis that reconstructs an agentic application’s interaction graph from source code — no execution, no traced traffic. The pipeline parses and resolves the Agentic Apps, normalizes framework-specific constructs to a common intermediate representation, and builds a graph of nodes, edges, and sinks, enabling pre-deployment security and efficiency audits. In one case study, porting an application between agent frameworks introduced a coordinator that duplicated a role the target framework already filled internally, adding an agent hop to every delegation.