AgenticCyOps: Securing Multi-Agentic AI Integration in Enterprise Cyber Operations

Shaswata Mitra; Raj Patel; Sudip Mittal; Md Rayhanur Rahman; Shahram Rahimi

cs.CRMar 10, 2026

AgenticCyOps: Securing Multi-Agentic AI Integration in Enterprise Cyber Operations

Authors: Shaswata Mitra, Raj Patel, Sudip Mittal, Md Rayhanur Rahman, Shahram Rahimi

Organizations: Department of Computer Science, The University of Alabama, Tuscaloosa, USA

Abstract

Multi-agent systems (MAS) powered by LLMs promise adaptive, reasoning-driven enterprise workflows, yet granting agents autonomous control over tools, memory, and communication introduces attack surfaces absent from deterministic pipelines. While current research largely addresses prompt-level exploits and narrow individual vectors, it lacks a holistic architectural model for enterprise-grade security. We introduce AgenticCyOps (Securing Multi-Agentic AI Integration in Enterprise Cyber Operations), a framework built on a systematic decomposition of attack surfaces across component, coordination, and protocol layers, revealing that documented vectors consistently trace back to two integration surfaces: tool orchestration and memory management. Building on this observation, we formalize these integration surfaces as primary trust boundaries and define five defensive principles: authorized interfaces, capability scoping, verified execution, memory integrity & synchronization, and access-controlled data isolation; each aligned with established compliance standards (NIST, ISO 27001, GDPR, EU AI Act). We apply the framework to a Security Operations Center (SOC) workflow, adopting the Model Context Protocol (MCP) as the structural basis, with phase-scoped agents, consensus validation loops, and per-organization memory boundaries. Coverage analysis, attack path tracing, and trust boundary assessment confirm that the design addresses the documented attack vectors with defense-in-depth, intercepts three of four representative attack chains within the first two steps, and reduces exploitable trust boundaries by a minimum of 72% compared to a flat MAS, positioning AgenticCyOps as a foundation for securing enterprise-grade integration.

Figures & tables

Figure 1. (Left) Functional architecture of an agentic AI system, illustrating interactions among AI language model, tool, and memory; (Center) Multi-agent vertical and horizontal design topologies; (Right) Agentic systems integration protocol (MCP).

Attack Vector	Tool	Memory
	Exploitation	Exploitation
Component-Level Attacks
Unauthorized access	Privilege escalation, unauthorized execution	Unauthorized retrieval
Context Contamination	API exfiltration	Privacy leakage, Data poisoning
Coordination-Level Attacks
Lateral compromise	Misuse via shared privileges	False injection via shared memory

Table 1. Attack Vector Decomposition by Exploitable Surface

Figure 2. Validated MCP Client Server Communication. In any Agent-Tool interaction, a consensus-based validator has been shown to limit attack surfaces. The Validator is an independent component designed primarily for authorization, auditing, and context-based verification and filtration.

Figure 3. Secure Memory Management Architecture. In-depth defense approach for persistent state management includes hierarchical isolation to prevent unauthorized cross-agent retrieval and write filtering via consensus, ensuring data integrity and synchronization across shared tiers.

Surface	Design Principle	Core Mechanism	Mitigated Vectors (Table 1 )	Compliance Alignment
Tools	Authorized Interface (§ 3.1.1 )	Signed manifests, registry-based discovery, admin-approved catalogs ( Narajala et al., 2025 ; Syros et al., 2025 )	Unauthorized access, Authentication bypass, Consensus manipulation	Zero Trust (NIST SP 800-207), OAuth 2.1 ( OWASP GenAI Security Project, 2025 )
	Capability Scoping (§ 3.1.2 )	Least-privilege scoping, PFI, continuous capability auditing ( Kim et al., ; Krawiecka and de Witt, 2025 )	Context contamination, Lateral compromise, Covert coordination	Least Privilege (NIST AC-6), OWASP Excessive Agency (LLM08) ( OWASP GenAI Security Project, 2025 )
	Verified Execution (§ 3.1.3 )	Action proposals and consensus validation, blockchain-anchored ledgers ( Zou et al., 2025 )	Message manipulation, Confused deputy, Hidden command execution	Non-repudiation (ISO 27001 A.10), EU AI Act Art. 12 (logging) ( The Artificial Intelligence Act, 2025 )
Memory	Integrity & Synchronization (§ 3.2.1 )	Write-boundary filtering, consensus-validated retrieval ( Wei et al., 2025 ; Xiang et al., 2024 )	Context contamination (poisoning), Conflicting intelligence injection, Session state corruption	Data Integrity (NIST SI-7), Traceability (NIST AI RMF) ( NIST, 2014 )
	Access Control with Data Isolation (§ 3.2.2 )	Hierarchical role-based memory tiers, dynamic bipartite access graphs ( Mao et al., 2025 ; Rezazadeh et al., 2025 )	Unauthorized retrieval, Lateral compromise (shared memory), Steganographic embedding	RBAC/ABAC (NIST AC-2/3), Data Minimization (GDPR Art. 5) ( Yagoubi et al., 2026 )

Table 2. Defensive Design Coverage: Mapping Security Principles to Threat Mitigation and Compliance Alignment.

Figure 4. Multi-Agentic SOAR following our AgenticCyOps Framework. This diagram illustrates a three-pillar architecture designed to automate and orchestrate SOC incident response through agentic AI. The MCP Host serves as the central orchestrator, coordinating task planning, tool selection, and agent communication across four phase-scoped MCP Servers (Monitor, Analyze, Admin, and Report), each equipped with LLM-driven reasoning loops tailored to their respective lifecycle stage. A persistent Organizational Memory layer, accessible via a dedicated Memory Management Agent, provides shared contextual state across all agents, enabling continuity and informed decision-making throughout the full incident response lifecycle.

Component-Level
Attack Vector	P1	P2	P3	P4	P5
Unauthorized access	✓				✓
Context contamination		✓		✓	$\circ$
Coordination-Level
Lateral compromise		✓	$\circ$		✓
Consensus manipulation	✓		✓	✓

Table 3. Coverage: Defensive Principles

\times

Attack Vectors

Scenario	Attack Chain	Intercept Point	AgenticCyOps Response	Residual Risk
AP-1: Tool Redirection	①Adversarial payload in alert feed $\rightarrow$ ② Monitor agent crafts malicious RPC request $\rightarrow$ ③ IAM/PAM tool executes privilege escalation $\rightarrow$ ④ Lateral movement to Admin tools	Step ②: blocked	P2 (Capability Scoping): Monitor Server’s manifest excludes IAM/PAM tools; RPC request rejected at Host. P3 (Verified Execution): Consensus loop flags out-of-phase tool invocation.	Compromised Host
AP-2: Memory Poisoning for Evidence Tampering	①Compromised Analyze agent writes falsified RCA to Local Threat Repository $\rightarrow$ ② Admin agent reads poisoned hypothesis $\rightarrow$ ③ Incorrect remediation deployed $\rightarrow$ ④ Attacker persistence maintained	Step ①: blocked	P4 (Memory Integrity): Write-boundary filtering validates RCA output against incident evidence. P5 (Data Isolation): Cross-phase writes require Memory Management Agent mediation.	Poisoned policy repository
AP-3: Confused Deputy via Forged MCP Response	①Attacker intercepts MCP Server response $\rightarrow$ ② Forged response instructs Host to invoke firewall rule deletion $\rightarrow$ ③ Admin tools execute destructive action $\rightarrow$ ④ Perimeter breach	Step ②: blocked	P1 (Authorized Interface): JSON-RPC message integrity via signed manifests detects forgery. P3 (Verified Execution): Recovery Loop consensus requires multi-agent agreement before destructive actions.	MCP protocol vulnerability
AP-4: Cross-Phase Escalation via Shared Context	①Report agent exfiltrates sensitive incident data $\rightarrow$ ② Injects weaponized indicators into ISAC/MISP feed $\rightarrow$ ③ Partner organization ingests poisoned IoCs $\rightarrow$ ④ False positive cascade across SOCs	Step ①: partially blocked	P5 (Data Isolation): Report agent reads only post-incident summaries, not raw forensic data. P2 (Capability Scoping): ISAC/MISP write restricted to approved indicator schema.	Cross-org feed validation (out of scope)

Table 4. Attack Path Analysis: Representative Chains With and Without AgenticCyOps

Boundary Type	Flat	AgenticCyOps	Red.
Agent $\rightarrow$ Tool	64	16	75%
Agent $\rightarrow$ Memory	48	16	67%
Agent $\leftrightarrow$ Agent	12	4	67%
Tool Resp. $\rightarrow$ Agent	64	16	75%
Ext. Feed $\rightarrow$ Memory	12	4	67%
Total	200	56	72%

Table 5. Boundary Analysis: Flat MAS vs. AgenticCyOps

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Reference	Contribution	Scope / Limitation	AgenticCyOps Takeaway	Maps To
Component-Level Attack Surface (§ 2.1 )
Greshake et al. ( Greshake et al., 2023 )	Indirect prompt injection via retrieved external data; validated on Bing Chat and GitHub Copilot.	Single-agent pipeline; no multi-agent propagation.	Blurs data/instruction boundaries, enabling tool redirection and credential exfiltration; motivates write-boundary filtering.	Table 1 : Context contamination
Perez et al. ( Perez et al., 2022 )	Automated red-teaming to elicit harmful LLM outputs via adversarial prompts.	Model-level robustness only; no integration architecture.	Cognitive manipulation scoped out; integration-layer defenses address downstream effects.	Model-level scope exclusion (§ 2.1 )
Carlini et al. ( Carlini et al., 2021 )	Training data extraction from LLMs via targeted querying.	Single-model privacy risk; no shared memory across agents.	Motivates memory isolation to prevent cross-agent data leakage.	P5: Access-Controlled Isolation
Fang et al. ( Fang et al., 2024 )	LLM agents autonomously hacking websites via SQLi and XSS; GPT-4 achieves 73.3% success rate.	Offensive study; no defenses or multi-agent tool misuse.	Autonomous offensive tool invocation motivates capability scoping and least-privilege enforcement.	P2: Capability Scoping
Coordination-Level Attack Surface (§ 2.2 )

Appendix

Table 6. Literature Foundation: Attack Surface Identification, Defensive Mechanisms, and CyberOps Domain

#	Agent	Tool	Status	Mechanism
A1 (Monitor) $\rightarrow$ Tools [4 assigned: T1–T4]
1	A1-Monitor	T1-UEBA Model	$\times$	P1+P3: Signed manifest, Validation Loop
2	A1-Monitor	T2-IDS/IPS/CMDB	$\times$	P1+P3: Signed manifest, Validation Loop
3	A1-Monitor	T3-EDR/NDR Sensor	$\times$	P1+P3: Signed manifest, Validation Loop
4	A1-Monitor	T4-ITSM/Ticketing	$\times$	P1+P3: Signed manifest, Validation Loop
5	A1-Monitor	T5-Sandbox	✓	P2: Not in Monitor manifest

Appendix

Table 11

#	Agent	Memory Store	Status	Mechanism
A1 (Monitor) $\rightarrow$ Memory
65	A1-Monitor	M1-Threat Repository	$\times$	P4+P5: MMA-mediated, write filtering
66	A1-Monitor	M2-Asset Inventory	✓	P5: Outside Monitor scope
67	A1-Monitor	M3-Policy Store	✓	P5: Outside Monitor scope
68	A1-Monitor	M4-SIEM Data Lake	$\times$	P4+P5: MMA-mediated, write filtering
69	A1-Monitor	M5-Code Repository	✓	P5: Outside Monitor scope

Appendix

Table 12

#	Source	Destination	Status	Mechanism
113	A1-Monitor	A2-Analyze	$\times$	Host-mediated, P1+P3
114	A2-Analyze	A1-Monitor	✓	No reverse handoff
115	A1-Monitor	A3-Admin	✓	Non-adjacent phase
116	A3-Admin	A1-Monitor	✓	Non-adjacent phase
117	A1-Monitor	A4-Report	✓	Non-adjacent phase
118	A4-Report	A1-Monitor	$\times$	Host-mediated feedback loop

Appendix

Table 13

#	Tool	Agent	Status	Mechanism
Monitor-Phase Tools (T1–T4) $\rightarrow$ Agents [4 tools]
125	T1-UEBA Model	A1-Monitor	$\times$	P1+P3: Signed response, Validation Loop
126	T1-UEBA Model	A2-Analyze	✓	P2: Response blocked at Host
127	T1-UEBA Model	A3-Admin	✓	P2: Response blocked at Host
128	T1-UEBA Model	A4-Report	✓	P2: Response blocked at Host
129	T2-IDS/IPS/CMDB	A1-Monitor	$\times$	P1+P3: Signed response, Validation Loop

Appendix

Table 14

#	External Feed	Memory Store	Status	Mechanism
189	E1-Vendor Advisories	M7-CTI Knowledge Base	$\times$	P4+P5: MMA write filtering
190	E2-ISAC Feeds	M7-CTI Knowledge Base	✓	P5: Consolidated via E1 path
191	E3-MISP Community	M1-Threat Repository	$\times$	P4+P5: MMA write filtering
192	E4-CVE/NVD	M1-Threat Repository	✓	P5: Consolidated via E3 path
193	E5-OSINT Sources	M7-CTI Knowledge Base	✓	P5: Consolidated via E1 path
194	E6-Regulatory Updates	M9-Compliance Map	$\times$	P4+P5: MMA write filtering

Appendix

Table 15

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework
Apr 25, 2026Kexin ChuAI Agent Security LLM Agent Security
School of Computing, University of Connecticut
MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems
Oct 20, 2026Mohammad Kachuee, Phu Mon Htut, Sheng Li +5AI Agent Security LLM Agent Safety
Oracle AI
Trustworthy Agentic AI: A Comprehensive Cybersecurity and Systems Survey on Threat Landscapes, Defense Architectures, and Open Challenges
Sep 12, 2026Seyedakbar MostafaviAI Agent Security AI Agent Safety
Department of Computer Engineering, Yazd University, Yazd 89195-741, Iran

Apr 25, 2026J/K move · Enter open · S save

A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework

Kexin Chu

School of Computing, University of Connecticut

AI Agent Security LLM Agent Security AI Agent Security Benchmarks Multi-Agent System Security

Open paper AskPDF arXiv

Agentic AI systems introduce a security surface that is qualitatively different from that of stateless LLMs. They persist memory, invoke external tools, coordinate with peer agents, and operate across sessions, allowing attacks to emerge not only at the prompt interface but also through architectural state, delegated authority, and long-horizon interactions. Existing security taxonomies, however, primarily organize threats by attack type, such as prompt injection or jailbreaking, and therefore obscure where in the agentic stack a threat arises and over what timescale it manifests. We propose the Layered Attack Surface Model (\lasm), a structural taxonomy for agentic AI security. \lasm decomposes the agentic stack into seven layers -- Foundation, Cognitive, Memory, Tool Execution, Multi-Agent Coordination, Ecosystem, and Governance -- and augments them with a four-class temporality axis covering instantaneous, session-persistent, cross-session cumulative, and sub-session-stack threats. We use this 7

\times

4 framework to analyze 116 papers from 2021--2026. The resulting map reveals that the upper layers of the agentic stack remain sharply under-explored, especially for long-horizon and stack-propagating threats; multiple documented attack regions have no corresponding defenses; and current benchmarks provide no coverage for cross-session or sub-session-stack failure modes. We further derive a cross-layer defense taxonomy, defense recipes for canonical attack classes, and a dependency DAG that separates near-term engineering gaps from fundamental research challenges. We release the per-paper coding, robustness scripts, and a reference Agent Bill of Materials schema to support reproducible analysis.

Abstract

AI Agent Security

Explore similar work

A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework

MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems

Trustworthy Agentic AI: A Comprehensive Cybersecurity and Systems Survey on Threat Landscapes, Defense Architectures, and Open Challenges