Securing Agentic AI: Threat Modelling and Fragility Analysis Across Layers

As agentic AI becomes part of software engineering, finance and critical infrastructure, understanding where and to what extent such systems fail is a prerequisite for their reliable deployment and for emerging regulations such as the EU AI Act.

• Which perturbations at the inference or hardware layer measurably alter an agent’s decisions, and how can we quantify this “fragility”?
• Can a single benchmark reveal cross-layer attacks (e.g., an inter-agent message that triggers an unsafe tool call) that per-layer tests fail to detect?

A working extension of an agentic-security benchmark that implements at least one cross-layer attack scenario, together with a short report presenting reproducible measurements of agent fragility. Well-documented, runnable code and a clear experimental write-up are given greater weight than the breadth of coverage.

The Institute of IT Security at the University of Lübeck (Principal Investigator: Prof. Thomas Eisenbarth) studies the security of computing systems from end to end, ranging from microarchitecture and trusted execution environments to machine-learning systems. The group combines a strong track record in systems security (e.g., attacks on commercial TEEs and software side-channel defences such as Cipherfix) with research into security for AI. Recent examples include platform-triggered LLM backdoors (FloatDoor) and prompt-stealing attacks on generative models (Prompt Pirates). This dual perspective enables us to analyse agentic AI as a complete system rather than as an isolated model.