Securing Agentic AI: A Comprehensive Threat Model and Mitigation Framework for Generative AI Agents

P. Lee, “Learning from Tay’s introduction,” The Official Microsoft Blog, Mar 2016, accessed: Apr. 12, 2025. [Online]. Available: https://blogs.microsoft.com/blog/2016/03/25/learning-tays-introduction/

2016

Earlier work this paper cites.

I. E. Kezron, “Securing the AI supply chain: Mitigating vulnerabilities in AI model development and deployment,” World Journal of Advanced Research and Reviews , vol. 22, no. 2, pp. 2336–2346, May 2024. [Online]. Available: https://doi.org/10.30574/wjarr.2024.22.2.1394

2024

Earlier work this paper cites.

Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li, “AGENTPOISON: Red-teaming LLM agents via poisoning memory or knowledge bases,” in Advances in Neural Information Processing Systems 37 (NeurIPS 2024) , 2024, accessed: Apr. 12, 2025. [Online]. Available: https://proceedings.neurips.cc/paper_files/paper/2024/file/eb113910e9c3f6242541c1652e30dfd6-Paper-Conference.pdf

2024

Earlier work this paper cites.

R. Shu, N. Das, M. Yuan, M. Sunkara, and Y. Zhang, “Towards effective genai multi-agent collaboration: Design and evaluation for enterprise applications,” 2024, accessed: Apr. 12, 2025. [Online]. Available: https://arxiv.org/abs/2412.05449

Original

2025

Earlier work this paper cites.

National Institute of Standards and Technology, “AI risk management framework (AI RMF 1.0),” NIST, NIST AI 100-1, Jan 2023, accessed: Apr. 12, 2025. [Online]. Available: https://www.nist.gov/itl/ai-risk-management-framework

2025

Earlier work this paper cites.

I. Domkundwar, S. M. N, I. Bhola, and R. Kochhar, “Safeguarding ai agents: Developing and analyzing safety architectures,” 2024, accessed: Apr. 12, 2025. [Online]. Available: https://arxiv.org/abs/2409.03793

Original

2025

Earlier work this paper cites.

OWASP Foundation, “OWASP top 10 for large language model applications,” https://owasp.org/www-project-top-10-for-large-language-model-applications/ , 2024, accessed: Apr. 12, 2025

2025

Earlier work this paper cites.

MITRE, “Adversarial threat landscape for artificial-intelligence systems (ATLAS),” https://atlas.mitre.org/ , 2023, accessed: Apr. 12, 2025

2025

Cited alongside, same era.

Cloud Security Alliance, “Agentic AI threat modeling framework: MAESTRO,” CSA Blog. https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro , Feb 2025, accessed: Apr. 12, 2025

2025

Cited alongside, same era.

W. Wang, H. Wang, S. Chen, Z. Lin, Z. Wang, L. Li, B. Niu, X. Li, Y. Fei, P. Zhou, L. Yao, X. Jiang, and K.-Y. Lam, “The emerged security and privacy of LLM agent: A survey with case studies,” 2024, accessed: Apr. 12, 2025. [Online]. Available: https://arxiv.org/abs/2407.19354

Original

2025

Cited alongside, same era.

OWASP Foundation, “Agentic threats and mitigation,” https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/ , 2025, accessed: Apr. 12, 2025

2025

Cited alongside, same era.

E. G. Junior, S. Clinton, C. Hughes, V. S. Narajala, and T. Holmes, “LLM and GenAI data security best practices,” Feb. 2025. [Online]. Available: https://www.researchgate.net/publication/391204648_LLM_and_GenAI_Data_Security_Best_Practices

2025

Closest in time.

MITRE, “MITRE ATT&CK® framework for machine learning,” https://attack.mitre.org/ , 2023, accessed: Apr. 12, 2025

2025

Closest in time.

Embrace The Red, “GitHub Copilot Chat: From prompt injection to data exfiltration,” Blog Post. https://embracethered.com/blog/posts/2024/github-copilot-chat-prompt-injection-data-exfiltration/ , Jun 2024, accessed: Apr. 12, 2025

2025

Closest in time.

LangChain Documentation, “Agents,” https://python.langchain.com/docs/modules/agents/ , 2024, accessed: Apr. 12, 2025

2025

Closest in time.

Significant Gravitas, “AutoGPT,” GitHub Repository. https://github.com/Significant-Gravitas/AutoGPT , 2024, accessed: Apr. 12, 2025