From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows

Abstract

Autonomous AI agents powered by large language models (LLMs) with structured function-calling interfaces have greatly expanded capabilities for real-time data retrieval, computation, and multi-step orchestration. However, the rapid growth of plugins, connectors, and inter-agent protocols has outpaced security practices, leading to brittle integrations — plugin APIs and protocol adapters that rely on ad-hoc authentication, inconsistent schemas, and weak validation — making them vulnerable to failures and exploitation. This survey introduces a unified end-to-end threat model for LLM-agent ecosystems, spanning host-to-tool and agent-to-agent communications, and catalogs over thirty attack techniques across Input Manipulation, Model Compromise, System and Privacy Attacks, and Protocol Vulnerabilities. For each category, we provide a formal mathematical formulation of the underlying threat model, defining attacker capabilities, objectives, and affected layers to enable systematic analysis. Representative examples include Prompt-to-SQL (P2SQL) injections and the Toxic Agent Flow exploit in GitHub’s MCP server. For each category, we assess feasibility, review defenses, and outline mitigation strategies such as dynamic trust management, cryptographic provenance tracking, and sandboxed agentic interfaces. The framework was validated through expert review and cross-mapping with real-world incidents and public vulnerability repositories (e.g., CVE, NIST NVD) to ensure practical relevance. Compared to prior surveys, this work provides the first integrated taxonomy bridging input-level exploits and protocol-layer vulnerabilities in LLM-agent ecosystems while introducing formal system definitions for each threat class. Ultimately, it offers actionable insights for securing next-generation AI agents through layered defense and continuous verification. Our work provides a comprehensive reference to guide the design of secure and resilient LLM-agent workflows.