Systematic Review of 85 Agentic-LLM Security Papers: Attack Work Outpaces Defense 3.9:1 and Action-Layer Risk Gets Only 4.7% of Attention

arXiv 2608.10530·high signalXBlueskyLinkedInCopy link

A PRISMA 2020 review across six databases screened 743 records and retained 85 papers from 2023–2025 on agentic LLM security. Perception-layer vulnerabilities (prompt injection, jailbreaking, adversarial perturbation) dominate at 66% of papers, while action-layer vulnerabilities (tool misuse, code injection, sandbox escape) appear in just 4.7%, code-execution security in 3.5%, and tool-augmented agents in 12% — a distribution the authors argue is badly misaligned with real deployed risk. They contribute a four-layer taxonomy mapping 13 vulnerability types and identify seven open problems centered on containment, arguing insecurity stems from architectural coupling where weak isolation lets flaws propagate across layers.