Agentic AI Security

Overview

Applications have evolved from deterministic, role-based logic to machine-learning systems with embedded models, and now to agentic AI systems in which autonomous agents plan, invoke tools, coordinate with peers, and act with minimal human intervention. With every increase in autonomy and intelligence, however, these systems have also become more opaque.

An agentic application is assembled dynamically from components that no single party may fully enumerate: remotely served models, tools accessed through MCP, peer agents contacted over A2A, skills loaded from external repositories, and context accumulated throughout a session. The resulting supply chain bears little resemblance to the dependency tree of a conventional program—and remains largely invisible to today’s security and observability tools.

This project addresses that visibility gap. In agentic systems, security and efficiency are deeply intertwined. Verifying every dynamically loaded source of context before use improves assurance but adds latency; skipping verification is faster but unsafe. A redundant coordinating agent may still produce the correct answer while adding an unnecessary model call, token consumption, and latency to every delegation. Behavioral testing alone cannot reliably expose either problem.

We therefore begin by building the necessary measurement infrastructure: benchmarks that produce meaningful and reproducible results, static analysis that examines system architecture rather than outputs alone, and provenance records that capture the context an agent actually consumed.

Research Challenges

• Testing and Evaluation. Agentic and LLM evaluation is currently unreliable in ways that are easy to miss. Benchmarks differ in task format, prompt template, inference configuration, answer extraction, and scoring, and each of these choices moves the reported score. We audit the existing landscape, isolate the design decisions that drive variance, and construct benchmarks that measure capability rather than harness artifacts. The work runs along two tracks: domain-specific benchmarking, targeting cybersecurity knowledge and software dependency exploitability; and a domain-agnostic security and performance audit of agentic interaction itself.

• Model and Software Dependencies. Agentic applications inherit the entire fragility of the software supply chain and add model dependencies on top of it. We work on reasoning over dependency graphs to answer security questions about what a system actually pulls in, on the exploitability of known vulnerabilities in bundled dependencies, and on the failure modes introduced when code-generating agents recommend packages that do not exist.

• Context Management. In a conventional application, dependencies are largely declared before execution. In an agentic application, context arrives during execution — through prompts, AG-UI events, A2A messages, MCP tool responses, and dynamically loaded skills — and is never recorded. We are developing a Context Bill of Materials (Cx-BOM) that captures this runtime composition, making SBOM-style provenance, integrity, and vulnerability checks possible for context the way they already are for code.

Key Contributions:

• Cybersecurity Knowledge Benchmark (Sayf-Eval). A systematic audit of cybersecurity knowledge benchmarks for LLMs, spanning eleven benchmark families from MMLU-CS through RedSage-Bench, organized by a taxonomy over dataset, inference, and evaluation. A controlled harness — dataset normalization, prompt standardization, controlled inference, robust answer extraction, consistent scoring — isolates measurement choices from model capability, and surfaces recurring failure modes alongside score swings large enough to reorder model rankings. Evaluation covers proprietary, open-weight, and cybersecurity-specialized models.

• VEX-DS: Dependency Exploitability Benchmarking. A known CVE in a bundled dependency is not necessarily exploitable in the application that bundles it. The Vulnerability Exploitability eXchange (VEX) format captures this judgment — affected, not affected, fixed, under investigation — and a not affected claim requires a documented justification: the vulnerable component is absent, the vulnerable code is not reachable, it cannot be controlled by an adversary, or an inline mitigation already exists. VEX is the practical way to meet Cyber Resilience Act duties, yet producing these judgments is a reasoning task existing benchmarks do not target. VEX-DS builds one, generating cases from seeds and configuration through synthesis and mutation stages — with an optional obfuscation stage — each gated by its own verifier.

• AgentSA: Agentic Interaction Graphs. A static analysis that reconstructs an agentic application’s interaction graph from source code — no execution, no traced traffic. The pipeline parses and resolves the Agentic Apps, normalizes framework-specific constructs to a common intermediate representation, and builds a graph of nodes, edges, and sinks, enabling pre-deployment security and efficiency audits. In one case study, porting an application between agent frameworks introduced a coordinator that duplicated a role the target framework already filled internally, adding an agent hop to every delegation.