Securing Agentic AI: Threat Modeling and Fragility Analysis Across Layers

As agentic AI enters software engineering, finance, and critical infrastructure, understanding where and how badly such systems break is a prerequisite for trustworthy deployment and for emerging regulation such as the EU AI Act.

• Which perturbations at the inference or hardware layer measurably change an agent's decisions, and how can we quantify this "fragility"?
• Can a single benchmark expose cross-layer attacks (e.g., an inter-agent message that triggers an unsafe tool call) that per-layer tests miss?

A working extension of an agentic-security benchmark implementing at least one cross-layer attack scenario, together with a short report presenting reproducible measurements of agent fragility. Well-documented, runnable code and a clear experimental write-up weigh more heavily than breadth of coverage.

The Institute of IT Security at the University of Lübeck (PI Prof. Thomas Eisenbarth) studies the security of computing systems end to end, from microarchitecture and trusted execution environments up to machine-learning systems. The group pairs a strong systems-security track record (e.g., attacks on commercial TEEs and software side-channel defenses such as Cipherfix) with security-for-AI research. Recent examples include platform-triggered LLM backdoors (FloatDoor) and prompt-stealing attacks on generative models (Prompt Pirates). This dual perspective lets us analyze agentic AI as a complete system rather than as an isolated model.