Vulnerabilities in Autonomous Execution: A Survey of Security Threats and Defenses in LLM-driven Multi-Agent Systems

Large language models (LLMs) are no longer confined to producing text. Equipped with tools and composed into multi-agent systems, they now act on the world with limited human oversight. This shift from generation to autonomous execution transforms the security landscape.

While prompt injection against a chatbot yields, at worst, an embarrassing sentence, the same injection against a tool-using agent can result in an exfiltrated database, a fraudulent transaction, or a poisoned message propagating to peer agents. The vulnerability class is not new, but the blast radius is.This article surveys the security of LLM-driven agentic and multi-agent systems from 2023 through early 2026. We contribute a threat taxonomy classifying attacks by entry point, propagation path, and target asset.

Using this, we organize four threat families—indirect prompt injection, malicious tool use, inter-agent infection, and memory poisoning—consolidating 44 attack papers into a unified comparison. We review the defensive landscape across five categories (detection, structural separation, execution isolation, information-flow control, and alignment-side hardening) and map defenses to threats to expose coverage gaps.Two findings recur. First, no purely prompt-level defense withstands adaptive attackers; effective security requires constraining what the system around the model is permitted to do, rather than relying on model robustness.

Second, multi-agent propagation—the mechanism making agentic compromise qualitatively worse than single-model compromise—is the least defended part of the stack, with almost no deployed frameworks enforcing trust boundaries between cooperating agents. We conclude with a research agenda and a minimal security-reporting standard for agent frameworks.