---
source: https://iinventedlight.com/library/notes/ao-security-attack-taxonomy.md
title: "A map of attacks on language agents"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source_license: "CC BY 4.0; restated in our own words"
attribution: "Summary by iinventedlight (AI-assisted). Sources: arXiv, [2402.10196] A Trembling House of Cards? Mapping Adversarial Attacks against Language Agents, CC BY 4.0; arXiv, [2404.11584] The Landscape of Emerging AI Agent Architectures for Reasoning, Planning, and Tool Calling: A Survey, CC BY 4.0."
author: "iinventedlight (synthesis of cited sources); text drafted with AI assistance"
date: 2026-11-04
status: published
checked_on: 2026-11-04
as_of: 2026-11-04
confidence: medium
untested: "No experiment was run; only the fetched arXiv abstract pages were read, so results are as reported by the authors."
category: agent-operations
topic_area: "agent-ops: security"
tags: ['agent-operations', 'security', 'prompt-injection']
sources:
  - id: S1
    title: "[2402.10196] A Trembling House of Cards? Mapping Adversarial Attacks against Language Agents"
    publisher: arXiv
    url: https://arxiv.org/abs/2402.10196
    accessed: 2026-11-04
    license: "CC BY 4.0"
  - id: S2
    title: "[2404.11584] The Landscape of Emerging AI Agent Architectures for Reasoning, Planning, and Tool Calling: A Survey"
    publisher: arXiv
    url: https://arxiv.org/abs/2404.11584
    accessed: 2026-11-04
    license: "CC BY 4.0"
---
# A map of attacks on language agents

**Answer:** A position paper maps adversarial attacks on language agents using a three-part model (Perception, Brain, Action) and lists 12 attack scenarios, including input manipulation, adversarial demonstrations, jailbreaking and backdoors.

## The framework

The authors note that agents are now wired to databases, tools, the internet and robots, and that understanding of their safety risks lags far behind deployment. They split an agent into:

- **Perception:** what the agent reads or sees.
- **Brain:** the model's reasoning and memory.
- **Action:** tools and effects on the world.

Each component gets its own attack scenarios, 12 in total.

## Architecture matters

A separate survey of agent architectures (S2) compares single-agent and multi-agent designs and highlights phases for planning, execution and reflection. Each extra component or agent is another place where the attacks above can enter.

## Operator checklist

- Treat all fetched content as untrusted input (Perception).
- Limit what tools can do without approval (Action).
- Review memory and stored instructions for planted content (Brain).

## Claims
- id: C1
  claim: The paper presents the first systematic effort at mapping adversarial attacks against language agents.
  source: S1
  evidence: "we present the first systematic effort in mapping adversarial attacks against language agents"
- id: C2
  claim: The framework has three components: Perception, Brain, and Action.
  source: S1
  evidence: "a unified conceptual framework for agents with three major components: Perception, Brain, and Action"
- id: C3
  claim: The paper proposes 12 potential attack scenarios.
  source: S1
  evidence: "propose 12 potential attack scenarios against different components of an agent"
- id: C4
  claim: The survey overviews single-agent and multi-agent architectures.
  source: S2
  evidence: "providing overviews of single-agent and multi-agent architectures"

## Sources
- [S1] [2402.10196] A Trembling House of Cards? Mapping Adversarial Attacks against Language Agents. arXiv. https://arxiv.org/abs/2402.10196 . License: CC BY 4.0. Accessed 2026-11-04.
- [S2] [2404.11584] The Landscape of Emerging AI Agent Architectures for Reasoning, Planning, and Tool Calling: A Survey. arXiv. https://arxiv.org/abs/2404.11584 . License: CC BY 4.0. Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).