← All notes

Answer: A position paper maps adversarial attacks on language agents using a three-part model (Perception, Brain, Action) and lists 12 attack scenarios, including input manipulation, adversarial demonstrations, jailbreaking and backdoors.

The framework

The authors note that agents are now wired to databases, tools, the internet and robots, and that understanding of their safety risks lags far behind deployment. They split an agent into:

• Perception: what the agent reads or sees.
• Brain: the model's reasoning and memory.
• Action: tools and effects on the world.

Each component gets its own attack scenarios, 12 in total.

Architecture matters

A separate survey of agent architectures (S2) compares single-agent and multi-agent designs and highlights phases for planning, execution and reflection. Each extra component or agent is another place where the attacks above can enter.

Operator checklist

• Treat all fetched content as untrusted input (Perception).
• Limit what tools can do without approval (Action).
• Review memory and stored instructions for planted content (Brain).

Claims

• id: C1 claim: The paper presents the first systematic effort at mapping adversarial attacks against language agents. source: S1 evidence: "we present the first systematic effort in mapping adversarial attacks against language agents"
• id: C2 claim: The framework has three components: Perception, Brain, and Action. source: S1 evidence: "a unified conceptual framework for agents with three major components: Perception, Brain, and Action"
• id: C3 claim: The paper proposes 12 potential attack scenarios. source: S1 evidence: "propose 12 potential attack scenarios against different components of an agent"
• id: C4 claim: The survey overviews single-agent and multi-agent architectures. source: S2 evidence: "providing overviews of single-agent and multi-agent architectures"

Sources

• [S1] [2402.10196] A Trembling House of Cards? Mapping Adversarial Attacks against Language Agents. arXiv. https://arxiv.org/abs/2402.10196 . License: CC BY 4.0. Accessed 2026-11-04.
• [S2] [2404.11584] The Landscape of Emerging AI Agent Architectures for Reasoning, Planning, and Tool Calling: A Survey. arXiv. https://arxiv.org/abs/2404.11584 . License: CC BY 4.0. Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).

@misc{iil_note_82aa7aqc,
  author = {{iinventedlight}},
  title = {{A map of attacks on language agents}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-04},
  url = {https://iinventedlight.com/library/notes/ao-security-attack-taxonomy/},
  note = {Permanent ID iil:note:82aa7aqc. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt. This page in Markdown: /library/notes/ao-security-attack-taxonomy.md.