{"id":"https://openalex.org/W7128522356","doi":"https://doi.org/10.1016/j.ins.2026.123231","title":"Bridging AI and software security: A comparative vulnerability assessment of LLM agent deployment paradigms","display_name":"Bridging AI and software security: A comparative vulnerability assessment of LLM agent deployment paradigms","publication_year":2026,"publication_date":"2026-02-11","ids":{"openalex":"https://openalex.org/W7128522356","doi":"https://doi.org/10.1016/j.ins.2026.123231"},"language":"en","primary_location":{"id":"doi:10.1016/j.ins.2026.123231","doi":"https://doi.org/10.1016/j.ins.2026.123231","is_oa":false,"landing_page_url":"https://doi.org/10.1016/j.ins.2026.123231","pdf_url":null,"source":{"id":"https://openalex.org/S192650101","display_name":"Information Sciences","issn_l":"0020-0255","issn":["0020-0255","1872-6291"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","ccf-b","cwts-core","dongbi-b","fnege-4","jufo-3","ki-jl-1","norway-2","poland-200","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Information Sciences","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.36227/techrxiv.175339471.17113065/v1","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5119060418","display_name":"Tarek Gasmi","orcid":"https://orcid.org/0009-0005-8457-438X","observed_orcids":["https://orcid.org/0009-0005-8457-438X"]},"institutions":[{"id":"https://openalex.org/I83259278","display_name":"Manouba University","ror":"https://ror.org/0503ejf32","country_code":"TN","type":"education","lineage":["https://openalex.org/I83259278"]}],"countries":["TN"],"is_corresponding":false,"raw_author_name":"Tarek Gasmi","raw_affiliation_strings":["University of Manouba, Manouba, Tunisia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Manouba, Manouba, Tunisia","institution_ids":["https://openalex.org/I83259278"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045754914","display_name":"Ramzi Guesmi","orcid":"https://orcid.org/0000-0001-8759-0151","observed_orcids":["https://orcid.org/0000-0001-8759-0151"]},"institutions":[{"id":"https://openalex.org/I142899784","display_name":"University of Sfax","ror":"https://ror.org/04d4sd432","country_code":"TN","type":"education","lineage":["https://openalex.org/I142899784"]},{"id":"https://openalex.org/I54316950","display_name":"University of Jendouba","ror":"https://ror.org/000g0zm60","country_code":"TN","type":"education","lineage":["https://openalex.org/I54316950"]}],"countries":["TN"],"is_corresponding":true,"raw_author_name":"Ramzi Guesmi","raw_affiliation_strings":["LETI Laboratory, University of Sfax, Sfax, Tunisia","University of Jendouba, Jendouba, Tunisia"],"raw_orcid":"https://orcid.org/0000-0001-8759-0151","affiliations":[{"raw_affiliation_string":"LETI Laboratory, University of Sfax, Sfax, Tunisia","institution_ids":["https://openalex.org/I142899784"]},{"raw_affiliation_string":"University of Jendouba, Jendouba, Tunisia","institution_ids":["https://openalex.org/I54316950"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023152436","display_name":"Jihen Bennaceur","orcid":"https://orcid.org/0000-0001-8584-5253","observed_orcids":["https://orcid.org/0000-0001-8584-5253"]},"institutions":[{"id":"https://openalex.org/I4405273500","display_name":"South Mediterranean University","ror":"https://ror.org/05x7s6790","country_code":"TN","type":"education","lineage":["https://openalex.org/I4405273500"]}],"countries":["TN"],"is_corresponding":false,"raw_author_name":"Jihene Bennaceur","raw_affiliation_strings":["South Mediterranean University, Tunis, Tunisia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"South Mediterranean University, Tunis, Tunisia","institution_ids":["https://openalex.org/I4405273500"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5119060419","display_name":"Ines Belhadj","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ines Belhadj","raw_affiliation_strings":["DataDoIt, Tunis, Tunisia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"DataDoIt, Tunis, Tunisia","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5045754914"],"corresponding_institution_ids":["https://openalex.org/I142899784","https://openalex.org/I54316950"],"apc_list":{"value":3200,"currency":"USD","value_usd":3200},"apc_paid":null,"fwci":29.8272,"has_fulltext":true,"cited_by_count":24,"citation_normalized_percentile":{"value":0.99639856,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":100},"biblio":{"volume":"740","issue":null,"first_page":"123231","last_page":"123231"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9945999979972839,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9945999979972839,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.003000000026077032,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0008999999845400453,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/llm-agent-security","display_name":"LLM agent security","score":0.7699999809265137},{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.777999997138977},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"vulnerability assessment","score":0.7929999828338623},{"id":"https://openalex.org/keywords/function-calling","display_name":"function calling","score":0.6430000066757202},{"id":"https://openalex.org/keywords/model-context-protocol","display_name":"Model Context Protocol","score":0.8510000109672546},{"id":"https://openalex.org/keywords/prompt-injection","display_name":"prompt injection","score":0.9810000061988831},{"id":"https://openalex.org/keywords/denial-of-service-attacks","display_name":"denial-of-service attacks","score":0.949999988079071},{"id":"https://openalex.org/keywords/attack-success-rate","display_name":"attack success rate","score":0.7329999804496765},{"id":"https://openalex.org/keywords/threat-classification","display_name":"threat classification","score":0.6840000152587891},{"id":"https://openalex.org/keywords/secure-deployment","display_name":"secure deployment","score":0.421999990940094},{"id":"https://openalex.org/keywords/software-vulnerabilities","display_name":"software vulnerabilities","score":0.6669999957084656}],"concepts":[{"id":"https://openalex.org/C174348530","wikidata":"https://www.wikidata.org/wiki/Q188635","display_name":"Bridging (networking)","level":2,"score":0.8385000228881836},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.7803999781608582},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7565000057220459},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.682200014591217},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6445000171661377},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5254999995231628},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4828000068664551},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.48170000314712524},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.47769999504089355},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.44110000133514404},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.4359999895095825},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.4316999912261963},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.41119998693466187},{"id":"https://openalex.org/C2779304628","wikidata":"https://www.wikidata.org/wiki/Q3503480","display_name":"Face (sociological concept)","level":2,"score":0.36079999804496765},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3560999929904938},{"id":"https://openalex.org/C35869016","wikidata":"https://www.wikidata.org/wiki/Q846636","display_name":"Software architecture","level":3,"score":0.35190001130104065},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.33250001072883606},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3244999945163727},{"id":"https://openalex.org/C5894958","wikidata":"https://www.wikidata.org/wiki/Q2297769","display_name":"Software agent","level":2,"score":0.2971999943256378},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.26840001344680786},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.25760000944137573},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.2540000081062317}],"mesh":[],"locations_count":6,"locations":[{"id":"doi:10.1016/j.ins.2026.123231","doi":"https://doi.org/10.1016/j.ins.2026.123231","is_oa":false,"landing_page_url":"https://doi.org/10.1016/j.ins.2026.123231","pdf_url":null,"source":{"id":"https://openalex.org/S192650101","display_name":"Information Sciences","issn_l":"0020-0255","issn":["0020-0255","1872-6291"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","ccf-b","cwts-core","dongbi-b","fnege-4","jufo-3","ki-jl-1","norway-2","poland-200","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Information Sciences","raw_type":"journal-article"},{"id":"doi:10.36227/techrxiv.175339471.17113065/v1","doi":"https://doi.org/10.36227/techrxiv.175339471.17113065/v1","is_oa":true,"landing_page_url":"https://doi.org/10.36227/techrxiv.175339471.17113065/v1","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"},{"id":"pmh:oai:arXiv.org:2507.06323","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2507.06323","pdf_url":"https://arxiv.org/pdf/2507.06323","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2507.06323","doi":"https://doi.org/10.48550/arxiv.2507.06323","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2507.06323","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.48366/r1596657","doi":"https://doi.org/10.48366/r1596657","is_oa":true,"landing_page_url":"https://doi.org/10.48366/r1596657","pdf_url":null,"source":{"id":"https://openalex.org/S7407053386","display_name":"Open Research Knowledge Graph (ORKG)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I2802635041","host_organization_name":"Technische Informationsbibliothek (TIB)","host_organization_lineage":["https://openalex.org/I2802635041"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},{"id":"doi:10.48366/r1596894","doi":"https://doi.org/10.48366/r1596894","is_oa":true,"landing_page_url":"https://doi.org/10.48366/r1596894","pdf_url":null,"source":{"id":"https://openalex.org/S7407053386","display_name":"Open Research Knowledge Graph (ORKG)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I2802635041","host_organization_name":"Technische Informationsbibliothek (TIB)","host_organization_lineage":["https://openalex.org/I2802635041"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"}],"best_oa_location":{"id":"doi:10.36227/techrxiv.175339471.17113065/v1","doi":"https://doi.org/10.36227/techrxiv.175339471.17113065/v1","is_oa":true,"landing_page_url":"https://doi.org/10.36227/techrxiv.175339471.17113065/v1","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7128522356.pdf","grobid_xml":"https://content.openalex.org/works/W7128522356.grobid-xml"},"referenced_works_count":31,"referenced_works":["https://openalex.org/W2089216878","https://openalex.org/W2918664583","https://openalex.org/W4387457408","https://openalex.org/W4387838992","https://openalex.org/W4389519254","https://openalex.org/W4389713766","https://openalex.org/W4392678053","https://openalex.org/W4393065402","https://openalex.org/W4402670146","https://openalex.org/W4402953801","https://openalex.org/W4404341072","https://openalex.org/W4406800520","https://openalex.org/W4407236106","https://openalex.org/W4407759460","https://openalex.org/W4408749928","https://openalex.org/W4409970336","https://openalex.org/W4410394431","https://openalex.org/W4412030659","https://openalex.org/W4415003002","https://openalex.org/W4415030290","https://openalex.org/W4415031180","https://openalex.org/W4415081859","https://openalex.org/W4415407012","https://openalex.org/W4415478691","https://openalex.org/W4415757988","https://openalex.org/W4416540657","https://openalex.org/W4417307818","https://openalex.org/W7129030749","https://openalex.org/W7133223293","https://openalex.org/W7133236347","https://openalex.org/W7134899623"],"related_works":["https://openalex.org/W4416525422","https://openalex.org/W7084096780","https://openalex.org/W7160556498","https://openalex.org/W7101597944","https://openalex.org/W7160522594","https://openalex.org/W7220901696","https://openalex.org/W7106214723","https://openalex.org/W4416148501","https://openalex.org/W4417315191","https://openalex.org/W7164162217"],"abstract_inverted_index":{"Large":[0],"Language":[1],"Model":[2,33],"(LLM)":[3],"agents":[4],"face":[5],"security":[6,136],"vulnerabilities":[7,68],"spanning":[8],"AI-specific":[9,62],"and":[10,32,57,66,138],"traditional":[11],"software":[12,67],"domains,":[13],"yet":[14],"current":[15],"research":[16],"addresses":[17],"these":[18],"separately.":[19],"This":[20,127],"study":[21],"bridges":[22],"this":[23],"gap":[24],"through":[25],"comparative":[26],"evaluation":[27],"of":[28],"Function":[29,72],"Calling":[30,73],"architecture":[31],"Context":[34],"Protocol":[35],"(MCP)":[36],"deployment":[37],"paradigms":[38],"using":[39],"a":[40],"unified":[41],"threat":[42,116,125],"classification":[43],"framework.":[44],"We":[45],"tested":[46],"3250":[47],"attack":[48,77],"scenarios":[49],"across":[50],"seven":[51],"language":[52],"models,":[53],"evaluating":[54],"simple,":[55],"composed,":[56],"chained":[58,101],"attacks":[59,102],"targeting":[60],"both":[61],"threats":[63],"(prompt":[64],"injection)":[65],"(JSON":[69],"injection,":[70],"denial-of-service).":[71],"showed":[74],"higher":[75,112],"overall":[76],"success":[78,105],"rates":[79],"(73.5%":[80],"vs":[81],"62.6%":[82],"for":[83,132,142],"MCP),":[84],"with":[85,100],"greater":[86],"system-centric":[87],"vulnerability,":[88],"while":[89],"MCP":[90],"exhibited":[91],"increased":[92],"LLM-centric":[93],"exposure.":[94],"Attack":[95],"complexity":[96],"dramatically":[97],"amplified":[98],"effectiveness,":[99],"achieving":[103],"91\u201396%":[104],"rates.":[106],"Counterintuitively,":[107],"advanced":[108],"reasoning":[109],"models":[110],"demonstrated":[111],"exploitability":[113],"despite":[114],"better":[115],"detection.":[117],"Results":[118],"demonstrate":[119],"that":[120],"architectural":[121],"choices":[122],"fundamentally":[123],"reshape":[124],"landscapes.":[126],"work":[128],"establishes":[129],"methodological":[130],"foundations":[131],"cross-domain":[133],"LLM":[134],"agent":[135],"assessment":[137],"provides":[139],"evidence-based":[140],"guidance":[141],"secure":[143],"deployment.":[144]},"counts_by_year":[{"year":2026,"cited_by_count":21},{"year":2025,"cited_by_count":3}],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-02-11T00:00:00"}