The BaseResearcharXiv
Agents of Chaos: A Systematization of Knowledge (SoK) on Malicious Attacks on Agentic AI Systems
A team from Vietnamese universities and Jiffy Labs reviews 98 sources on malicious attacks on AI agents, coding 284 distinct attacks and 452 safeguards into eight classes. They report that defences are unevenly assessed: only 278 of 660 attack-safeguard links were directly tested.
Why it matters
The same thing, for different readers.
What it means for you
A review of the research finds many ways to attack AI agents that use tools and memory, and that few of the defences have been properly tested.
For lawmakers
The authors point to tool governance and defence-in-depth as needs, and note that evidence for how well safeguards work is thin.
For researchers
The review offers a taxonomy of eight attack classes and shows tool, MCP and action-layer attacks make up the largest share, with uneven evidence on defences.
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“Safeguard coverage remains uneven: only 278 of 660 relationships are directly assessed, and strong coverage is uncommon.”
“Our analysis shows that tool, MCP, and action-layer attacks account for the largest share of atomic attacks, while the prompt-injection and action-hijacking class has the broadest paper coverage.”
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- A systematic review: 186 candidate sources screened, 98 retained (papers, preprints, advisories, repository disclosures, incident reports), independently coded with resolver adjudication.
- What it found
- The authors identified 284 atomic attacks in eight causal-mechanism classes, 452 atomic safeguards and 660 explicit attack-safeguard relationships, of which only 278 were directly assessed.
- What it does not show
- A review of what others reported, bounded by the sources found and by how the authors coded them.
- Status
- A preprint: not yet peer reviewed
The record
- Questions
- How is AI used in attacks, defence and war? · Are AI companies putting stronger safeguards into practice?
- People
- Thanh M. Truong-Le (Wrote it, University of Information Technology, Vietnam) · Duc-Ly Vu (Wrote it, Thu Dau Mot University)
- What we read
- We could read only part of the source.
- Found by
- The Radar, run of November 8, 2026, via
arxiv-ai-safety-query(tier 1: the source’s own channel or an official record) - Cite this
- arXiv, “Agents of Chaos: A Systematization of Knowledge (SoK) on Malicious Attacks on Agentic AI Systems”, November 7, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/arxiv-2026-11-07-agents-of-chaos-attacks-sok