{"id":"https://openalex.org/W4416942889","doi":"https://doi.org/10.48550/arxiv.2511.21990","title":"A Safety and Security Framework for Real-World Agentic Systems","display_name":"A Safety and Security Framework for Real-World Agentic Systems","publication_year":2025,"publication_date":"2025-11-27","ids":{"openalex":"https://openalex.org/W4416942889","doi":"https://doi.org/10.48550/arxiv.2511.21990"},"language":null,"primary_location":{"id":"pmh:oai:arXiv.org:2511.21990","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2511.21990","pdf_url":"https://arxiv.org/pdf/2511.21990","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2511.21990","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5027156022","display_name":"Shaona Ghosh","orcid":"https://orcid.org/0000-0003-4658-5174","observed_orcids":["https://orcid.org/0000-0003-4658-5174"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ghosh, Shaona","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002030695","display_name":"Barnaby Simkin","orcid":"https://orcid.org/0009-0005-8285-3211","observed_orcids":["https://orcid.org/0009-0005-8285-3211"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Simkin, Barnaby","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035251638","display_name":"Kyriacos Shiarlis","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shiarlis, Kyriacos","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Nandi, Soumili","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nandi, Soumili","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100624303","display_name":"Dan Zhao","orcid":"https://orcid.org/0000-0002-4484-6505","observed_orcids":["https://orcid.org/0000-0002-4484-6505","https://orcid.org/0000-0002-1341-7353"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhao, Dan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Fiedler, Matthew","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fiedler, Matthew","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5086844114","display_name":"Julia Bazi\u0144ska","orcid":"https://orcid.org/0000-0003-2666-7885","observed_orcids":["https://orcid.org/0000-0003-2666-7885"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bazinska, Julia","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Pope, Nikki","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pope, Nikki","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Prabhu, Roopa","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Prabhu, Roopa","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Rohrer, Daniel","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rohrer, Daniel","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137002666","display_name":"Michael Demoret","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Demoret, Michael","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5004540207","display_name":"Bartley Richardson","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Richardson, Bartley","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9937000274658203,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9937000274658203,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.0017000000225380063,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T13295","display_name":"Safety Systems Engineering in Autonomy","score":0.0010999999940395355,"subfield":{"id":"https://openalex.org/subfields/2213","display_name":"Safety, Risk, Reliability and Quality"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/agentic-ai-systems","display_name":"agentic AI systems","score":0.8320000171661377},{"id":"https://openalex.org/keywords/ai-safety","display_name":"AI safety","score":0.734000027179718},{"id":"https://openalex.org/keywords/artificial-intelligence-security","display_name":"AI security","score":0.9480000138282776},{"id":"https://openalex.org/keywords/tool-misuse","display_name":"tool misuse","score":0.6669999957084656},{"id":"https://openalex.org/keywords/red-teaming","display_name":"red teaming","score":0.7279999852180481},{"id":"https://openalex.org/keywords/human-oversight","display_name":"human oversight","score":0.7760000228881836},{"id":"https://openalex.org/keywords/risk-reduction","display_name":"risk mitigation","score":0.8009999990463257},{"id":"https://openalex.org/keywords/enterprise-deployment","display_name":"enterprise deployment","score":0.6880000233650208}],"concepts":[{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.5055000185966492},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.5008999705314636},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4697999954223633},{"id":"https://openalex.org/C2776889888","wikidata":"https://www.wikidata.org/wiki/Q1135789","display_name":"Unintended consequences","level":2,"score":0.4300000071525574},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.4235000014305115},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4065999984741211},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.3910999894142151},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.3779999911785126},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.37700000405311584},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.3467000126838684},{"id":"https://openalex.org/C83163435","wikidata":"https://www.wikidata.org/wiki/Q3954104","display_name":"Security management","level":2,"score":0.3082999885082245},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.29809999465942383},{"id":"https://openalex.org/C2164484","wikidata":"https://www.wikidata.org/wiki/Q5170150","display_name":"Core (optical fiber)","level":2,"score":0.2922999858856201},{"id":"https://openalex.org/C43091099","wikidata":"https://www.wikidata.org/wiki/Q1067788","display_name":"Through-the-lens metering","level":3,"score":0.2904999852180481},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.26649999618530273},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.25929999351501465},{"id":"https://openalex.org/C164403151","wikidata":"https://www.wikidata.org/wiki/Q7336280","display_name":"Risk management framework","level":4,"score":0.2572999894618988},{"id":"https://openalex.org/C98184364","wikidata":"https://www.wikidata.org/wiki/Q1780131","display_name":"Argument (complex analysis)","level":2,"score":0.25119999051094055}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2511.21990","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2511.21990","pdf_url":"https://arxiv.org/pdf/2511.21990","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2511.21990","doi":"https://doi.org/10.48550/arxiv.2511.21990","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2511.21990","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2511.21990","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2511.21990","pdf_url":"https://arxiv.org/pdf/2511.21990","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"This":[0,223],"paper":[1],"introduces":[2],"a":[3,51,79,137,198],"dynamic":[4,37,138],"and":[5,20,43,70,76,110,124,141,155,167,180,215,252],"actionable":[6],"framework":[7,143,195],"for":[8,67],"securing":[9],"agentic":[10,58,71,88,103,116,139,147,183,205,221,229,257,264],"AI":[11,153],"systems":[12],"in":[13,73,87,162,218,263],"enterprise":[14],"deployment.":[15],"We":[16,49,169,192,236],"contend":[17],"that":[18,106,144,231],"safety":[19,75,86,109,140,179,214],"security":[21,77,111,142,181,216],"are":[22,232],"not":[23],"merely":[24],"fixed":[25],"attributes":[26],"of":[27,54,56,63,85,133,173,178,182,202,247,255],"individual":[28],"models":[29,72,154],"but":[30],"also":[31,237],"emergent":[32],"properties":[33],"arising":[34],"from":[35,241],"the":[36,61,83,131,174,194,239,256],"interactions":[38],"among":[39,128],"models,":[40],"orchestrators,":[41],"tools,":[42],"data":[44],"within":[45],"their":[46],"operating":[47],"environments.":[48],"propose":[50],"new":[52],"way":[53],"identification":[55],"novel":[57,228],"risks":[59,230],"through":[60,82,187,197],"lens":[62,84],"user":[64],"safety.":[65,265],"Although,":[66],"traditional":[68,108],"LLMs":[69],"isolation,":[74],"has":[78],"clear":[80],"separation,":[81],"systems,":[89],"they":[90],"appear":[91],"to":[92,160,259],"be":[93],"connected.":[94],"Building":[95],"on":[96],"this":[97],"foundation,":[98],"we":[99],"define":[100],"an":[101],"operational":[102],"risk":[104,148,164,185,224],"taxonomy":[105],"unifies":[107],"concerns":[112],"with":[113,157],"novel,":[114],"uniquely":[115],"risks,":[117],"including":[118],"tool":[119],"misuse,":[120],"cascading":[121],"action":[122],"chains,":[123],"unintended":[125],"control":[126],"amplification":[127],"others.":[129],"At":[130],"core":[132],"our":[134,242],"approach":[135],"is":[136],"operationalizes":[145],"contextual":[146,163],"management":[149],"by":[150],"using":[151],"auxiliary":[152],"agents,":[156],"human":[158],"oversight,":[159],"assist":[161],"discovery,":[165],"evaluation,":[166],"mitigation.":[168],"further":[170],"address":[171],"one":[172],"most":[175],"challenging":[176],"aspects":[177],"systems:":[184],"discovery":[186,225],"sandboxed,":[188],"AI-driven":[189],"red":[190],"teaming.":[191],"demonstrate":[193],"effectiveness":[196],"detailed":[199],"case":[200,243],"study":[201],"NVIDIA":[203],"flagship":[204],"research":[206,262],"assistant,":[207],"AI-Q":[208],"Research":[209],"Assistant,":[210],"showcasing":[211],"practical,":[212],"end-to-end":[213],"evaluations":[217],"complex,":[219],"enterprise-grade":[220],"workflows.":[222],"phase":[226],"finds":[227],"then":[233],"contextually":[234],"mitigated.":[235],"release":[238],"dataset":[240],"study,":[244],"containing":[245],"traces":[246],"over":[248],"10,000":[249],"realistic":[250],"attack":[251],"defense":[253],"executions":[254],"workflow":[258],"help":[260],"advance":[261]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-09-29T14:09:16.559479","created_date":"2025-12-03T00:00:00"}