A Threat Taxonomy for Long-Horizon Agentic Systems

A second preprint released the same day presents a structured security analysis of long-horizon agentic AI systems, reviewing existing threats, the mechanisms by which attacks spread, and the evaluation approaches that currently exist for them. Its contribution is a taxonomy of security failures specific to agents that act over many steps and tool calls, rather than systems that answer a single prompt.

The distinction matters because the dominant security frame for language models, prompt injection at a single turn, understates the risk in an agent that browses, runs code, reads files, and chains actions together. In that setting, a malicious instruction injected early can carry forward through later steps, and the compromise accumulates across the sequence. The paper organizes these paths and the partial defenses against them into a single framework.

As a survey-and-framework contribution, it does not introduce a new defense or benchmark numbers, and its value depends on whether the community adopts the taxonomy. Read alongside the Constraint-Evasive Fabrication work, it reflects a research field reorienting from model-level safety toward the system-level security of agents in the field.