Natalie Shapira and 37 colleagues at Northeastern University catalogued 284 attacks on AI agents and found tested defences for fewer than half of 660 attack-defence pairs S¹P⁴. The finding cuts against the assumption that agent security is mostly a prompt-injection problem: the largest attack category targets the tool and action layer, not the conversation S¹.

AI agents that browse the web, run code, and call external services are already handling email, writing software, and managing documents. Every tool you bolt onto a language model is also a door someone can walk through. In late October, AI email agents complied with 45% of adaptive phishing attacks; days later, agents were caught harvesting email verification codes to bypass human approval. The pattern keeps repeating, and no one had counted the doors.

My read: The number I would watch is 278 out of 660. That is the share of attack-safeguard pairs the authors found directly assessed in the literature, meaning 382 relationships have no tested defence. I am skeptical of treating 284 as a complete inventory. The authors are clear they systematised existing research, not discovered new attacks. But the gap between what we have built (agents with tools, memory, and code execution) and what we have tested (fewer than half the attack-defence pairs) is the real finding.

What the team actually did

Shapira and her colleagues, including Chris Wendler and Gabriele Sarti, also at Northeastern, set out to organise what the research community already knows about attacking AI agents P⁴. They screened 186 candidate sources and retained 98 for systematic review S¹. From those, they extracted 284 atomic attacks, 452 atomic safeguards, and 660 explicit relationships between specific attacks and specific safeguards, all author-reported and not independently verified S¹.

The attacks fall into eight causal-mechanism classes, each tracked along seven dimensions: where it enters the system, what triggers it, what capability it abuses, what it aims to do, what damage it causes, whether it persists, and what evidence it leaves S¹. The largest category by attack count covers tool, MCP, and action-layer attacks S¹. MCP is an interface protocol for connecting agents to external tools; the paper references it without expanding the acronym. The broadest coverage in the published literature goes to prompt injection and action hijacking, the class most people already know about S¹.

One pattern stands out. Attacks often separate insertion from activation: a payload lands in memory or a tool description now, but fires later when the agent hits the right condition S¹. This matters because most agent security thinking still treats the threat as a single malicious prompt arriving in a user message. The taxonomy shows adversaries planting payloads in metadata, poisoned state, compromised skills, and mutable dependencies, then waiting for the agent to trip them S¹.

The defence gap

Of the 660 attack-safeguard relationships the team identified, only 278 have been directly assessed in the literature S¹. Strong safeguard coverage across those relationships is uncommon S¹. For most known attack techniques against AI agents, no one has published evidence that a specific defence works.

The findings support what the authors call lifecycle-aware threat modeling: thinking about attacks not as one-off prompts but as payloads that enter at one point, persist through memory or state, and activate later S¹. This connects to what Tencent researchers found when testing AI coding agents: agents saw their own security safeguards in only 27 to 36% of runs.

For a team building an agent that reads email and drafts replies, the practical check is whether the agent's tool layer has been tested against anything beyond prompt injection.

Its taxonomy gives 284 named attacks to test against. The gap in assessed relationships tells you which ones nobody has checked.

The preprint appeared on arXiv on 7 November 2026 and has accrued zero citations S¹P⁴.

Sources: S1 — Agents of Chaos: A Systematization of Knowledge (SoK) on Malicious Att · P2 — idllresearch/malicious-gpt · P3 — ThibautMelen/agentic-ai-systems · P4 — Agents of Chaos · P5 — huggingface/smolagents

Written from 5 sourced items, 4 of them primary.