AI agents are being attacked four times faster than they are being defended

What happened

An AI agent is a chatbot with hands. It does not just answer. It reads your files, calls other programs, runs code and sends messages. That is useful. It is also dangerous. If someone tricks the agent, the agent does not just say something wrong. It does something wrong, with your permissions.

How much do we know about protecting these agents? A team at the New Jersey Institute of Technology in the United States went looking. They searched six research databases, screened 743 papers, and kept the 85 that studied the security of AI agents between 2023 and 2025. Then they counted.

The test

The team sorted every paper by what it studied. They also sorted the agent itself into four layers. The perception layer is what the agent reads. The brain layer is how it reasons and plans. The action layer is what it does, such as calling tools and running code. The interaction layer is how agents talk to each other.

The result

Forty-seven papers were about attacks. Twelve were about defenses. That is 3.9 attack papers for every defense paper. Two thirds of the papers studied the perception layer, mostly “prompt injection”, where hidden text in a web page or a document gives the agent secret orders. Only four papers, under five percent, studied the action layer, where the agent calls tools, writes files and runs code. Three papers looked at code injection. Two looked at escaping a sandbox. Not one paper studied robots and other agents that act in the physical world.

Why is the research so lopsided? This is because attacks on the reading layer are easy to test. You only need access to a chatbot. Testing the action layer needs a full working agent with real tools, which is expensive to set up. The authors say plainly that the research follows convenience, not risk.

Think of a house. Almost everyone is studying the front door, where the visitor talks to you. Almost nobody is checking the back door, where the visitor can walk into the kitchen and pick up the knives. Therefore, the most dangerous part of the agent is the least studied part.

What it means

Companies are giving agents real permissions right now: email accounts, bank connections, servers. The science of keeping those agents contained is two years old and thin. The authors list seven open problems, and the first three have between zero and three papers each. If you build agents, the safety work is yours to do. If you buy agents, the questions are yours to ask. GUARD THE BACK DOOR.

Business ideas from this paper

1. 1. A firewall for what agents do, not what they read

   Sit between the agent and its tools. Allow only listed actions, require a human click for the risky ones, and record everything. Sell it as a service that any company can put in front of any agent.

   Buyer Companies giving agents access to email, files, payments or servers. First test Ten letters of intent from teams already running agents in production.

2. 2. Back-door testing for agents

   Most security testers know prompt injection. Few can test tool misuse, code injection and sandbox escape, because the paper shows almost nobody has. Become the team that does.

   Buyer Banks, insurers and software companies with agents in production. First test Five paid pilots, priced like a normal penetration test.

3. 3. The missing benchmark

   The paper says defenses cannot be compared because there is no shared test. Build the test for the action layer, publish the scores, and charge vendors for a verified report.

   Buyer Agent-platform vendors who need to prove safety to customers. First test A waitlist of vendors who would pay for a verified score.

How sure can you be?

This is a preprint, not yet reviewed by other scientists. It follows a strict method for reviews, called PRISMA, and it reports its counts in full, so its claims are easy to check. It counts papers, not attacks in the real world, so it tells you where research attention is, not exactly where the risk is. That gap is the authors’ own point.

Disclosure: the author’s company, Real Biz Digital, builds infrastructure for AI agents.

Source: On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models, arXiv preprint, August 2026. arXiv:2608.10530 · arxiv.org (preprint · not yet peer reviewed).

Just Out Tech explains new research in plain language. This article was drafted with AI assistance and checked by a human against the original source.