Trustworthy Agentic AI for Security and Privacy: A Short Survey

Agentic AI is moving from copilots that suggest to agents that act. In a Security Operations Center (SOC), an agent may isolate a host. In a negotiation, an agent may commit to a price. Once an agent can act, three questions matter more than raw accuracy. Is the action safe and grounded in the real environment? Does private data stay where it belongs? What does the system actually disclose while it runs? This short survey groups recent work around these three questions. It draws on two of my recent IEEE papers and on related work from the security and privacy research community. The Agent Trust Stack Figure 1. Four layers of trust for agentic AI, mapped to the works covered in this survey. Threats on the right cut across every layer. The stack has four layers. Reason generates options. Validate checks them against real constraints. Protect keeps sensitive values out of reach. Audit verifies what the running system actually exposed. 1. Grounding Agent Actions in Security Operations SOC teams face a constant flood of alerts. Chhetri et al. study human-AI teaming as a way to reduce alert fatigue [8]. LLM copilots help with summaries, but they leave decisions to analysts. They can also suggest attack paths that do not exist in the real network. AgentSOC [1] addresses this with a layered Sense–Reason–Act loop. A Narrative Counterfactual Engine uses an LLM to propose several attack hypotheses, each mapped to MITRE ATT&CK [10]. A Structural Simulation Engine checks each hypothesis against the identity and privilege graph. Infeasible paths are discarded. A Risk Scoring and Evaluation Module ranks responses by containment value minus business impact. High-impact playbooks are routed to an analyst. Execution starts in dry-run mode with rollback paths. A proof of concept on LANL authentication data ran the full loop in about 506 ms. The LLM step took roughly 95% of that time. The core design idea is simple. The LLM proposes, and deterministic checks decide what survives. This builds on the reason-and-act pattern popularized by ReAct [4]. The difference is a structural validation step that sits between reasoning and action. 2. Keeping Private Constraints Local in Negotiation Negotiation agents hold sensitive values such as a budget ceiling or a reservation price. Cloud-hosted agents send those values to a server. Device-native negotiation agents [2] keep constraints on user hardware. Each offer carries a Groth16 zk-SNARK proof [9] showing it lies within a private range, without revealing the range. A Paillier-based pre-check tests whether buyer and seller ranges overlap before bargaining starts. A 500M-parameter distilled world model plans on the device. Merkle-tree audit trails record every decision, and a simulation critic rejects unsafe actions before execution. Across insurance and B2B procurement scenarios, the system reported an 87% average success rate and a 2.4× latency reduction against a cloud-only baseline. Cryptographic data exposure dropped by 94%. User trust scores rose 27% when decision trails were available. AirGapAgent [7] takes a related path for conversational agents. A separate minimizer decides which user data a task needs, and the conversational model sees only that subset. Under a single-query context hijacking attack, a Gemini Ultra agent's data protection fell from 94% to 45%. AirGapAgent held at 97%. Both designs share one principle. The safest secret is the one the model never sees. 3. Measuring What Actually Leaks Protocol guarantees describe intended data flows. Running systems also leak through internal channels. AgentLeak [3] instruments seven communication channels in multi-agent LLM systems. These include final outputs, inter-agent messages, tool inputs and outputs, shared memory, logs, and artifacts. Across 1,000 scenarios and 4,979 validated traces on five LLMs, inter-agent messages leaked in 68.8% of traces, compared with 27.2% for final outputs. Audits that checked only final answers missed 41.7% of violations. This finding applies to both systems above. AgentSOC's knowledge store and logs, and the negotiation agent's tool hub and audit trails, are exactly the kind of internal channels AgentLeak measures. The negotiation paper names a related gap itself. Zero-knowledge proofs hide values, but timing and concession patterns can still hint at how close an offer is to a limit [2]. Leakage is not the only internal threat. Greshake et al. showed that instructions hidden in retrieved data can hijack LLM-integrated applications [5]. AgentDojo [6] turns this into a dynamic benchmark with 97 tasks and 629 security test cases for tool-using agents. For a SOC agent that reads attacker-controlled logs, indirect prompt injection is a direct risk. Comparison at a Glance Work Domain Main control Evaluation AgentSOC [1] Security operations LLM hypotheses, graph feasibility, risk scoring Proof of concept on LANL data, ~506 ms loop Device-native agents [2] Insurance and B2B negotiation On-device execution, ZK proofs, audit trails 150 trials per scenario, 3 device tiers AirGapAgent [7] Conversational agents Contextual data minimization Context hijacking on Gemini, GPT, Mistral AgentLeak [3] Multi-agent LLM systems Seven-channel leakage auditing 1,000 scenarios, 4,979 traces, 5 LLMs AgentDojo [6] Tool-using agents Prompt injection benchmark 97 tasks, 629 security test cases Greshake et al. [5] LLM-integrated apps Indirect injection threat taxonomy Attacks on real deployed systems How the Pieces Fit A trustworthy agent needs all four layers. Reasoning without validation produces hallucinated actions. Validation without data protection still exposes secrets. Protection without auditing assumes the protocol is the whole system, and AgentLeak shows how often that assumption fails. A practical pattern emerges from this body of work. Let the LLM generate options, not final decisions. Validate options against hard structure such as graphs, policies, or cryptographic constraints. Keep sensitive values local or minimized. Audit every internal channel, not only the final output. Open Challenges Behavioral leakage. Timing and concession patterns need defenses such as differential privacy for timing and randomized concession schedules. Channel-level audits for SOC agents. AgentSOC-style systems should be tested with AgentLeak-style instrumentation of messages, logs, and knowledge stores. Injection-resistant security agents. SOC agents read untrusted logs by design. Benchmarks like AgentDojo could be extended to security-operations tasks. Multi-party settings. Current negotiation work is bilateral. Multi-party negotiation and multi-agent SOC teams raise new coordination and leakage risks. Real deployment data. Most results come from controlled datasets. Production telemetry and live user studies are still limited. Conclusion Agentic AI for security and privacy works best as a layered system. LLMs propose. Structure validates. Cryptography and locality protect. Channel-level audits verify. Recent work covers each layer well, but few systems cover all four at once. That gap is where the next round of research should focus. Which layer would you test first in your own agent stack? References [1] J. Roy and S. K. Singh, "AgentSOC: A Multi-Layer Agentic AI Framework for Security Operations Automation," in Proc. 2026 IEEE 5th Int. Conf. AI in Cybersecurity (ICAIC), 2026, pp. 1–7. doi: 10.1109/ICAIC67076.2026.11395783 [2] J. Roy and S. Kumar Singh, "Device-Native Autonomous Agents for Privacy-Preserving Negotiations," in Proc. SoutheastCon 2026, 2026, pp. 1–8. doi: 10.1109/SoutheastCon63549.2026.11476181 [3] F. El Yagoubi, G. Badu-Marfo, and R. Al Mallah, "AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems," IEEE Access, vol. 14, pp. 94960–94978, 2026. doi: 10.1109/ACCESS.2026.3704541 [4] S. Yao et al., "ReAct: Synergizing Reasoning and Acting in Language Models," in Proc. ICLR, 2023. arXiv:2210.03629 [5] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection," in Proc. 16th ACM Workshop on Artificial Intelligence and Security (AISec), 2023, pp. 79–90. doi: 10.1145/3605764.3623985 [6] E. Debenedetti, J. Zhang, M. Balunović, L. Beurer-Kellner, M. Fischer, and F. Tramèr, "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents," in Proc. NeurIPS Datasets and Benchmarks Track, 2024. arXiv:2406.13352 [7] E. Bagdasarian et al., "AirGapAgent: Protecting Privacy-Conscious Conversational Agents," in Proc. ACM CCS, 2024. arXiv:2405.05175 [8] M. B. Chhetri, A. V. Uzunov, B. Vo, S. Nepal, and R. Kowalczyk, "Towards Human-AI Teaming to Mitigate Alert Fatigue in Security Operations Centres," ACM Trans. Internet Technology, vol. 24, no. 3, pp. 1–32, 2024. [9] J. Groth, "On the Size of Pairing-Based Non-Interactive Arguments," in Proc. EUROCRYPT, Springer, 2016, pp. 305–326. [10] MITRE Corporation, "MITRE ATT&CK," https://attack.mitre.org