AI agents can be attacked at six different points, from what they read to the human watching them.

This explores the six-part breakdown of attacks aimed at AI agents specifically, as opposed to plain chatbots, and what that breakdown means for defense. The corpus describes six "trap" categories, each aimed at a different operational layer of an agent: content injection, semantic manipulation, cognitive state, behavioral control, systemic, and human-in-the-loop How do adversarial traps target different layers of AI agents?. Roughly, they run from what an agent reads, to how it reasons, to what it remembers, to what it does, to how many agents are affected at once, to the human who is supposed to be supervising it.

The practical consequence is that a defense against one category does not transfer to the others, so each layer needs its own mitigation How do adversarial traps target different layers of AI agents?. A related mapping spans five levels of the agentic stack: single-agent input handling, multi-agent delegation, routing and control, behavioral containment over time, and ecosystem governance. It reaches the same conclusion: a defense at one layer can be bypassed at another How do agent security layers connect across the stack?. Another framework suggests comparing attacks along a third axis, adversary position, which is where the attacker sits relative to the system Can adversary position unify fragmented multi-agent attack models?.

The other notes show what these categories look like in practice, especially once several agents work together. Multi-agent systems split tasks and specialize roles, and that lets an attacker fragment a harmful goal into steps that each look harmless, so harm only appears when they are combined Can task decomposition hide harmful intent across agents?. A crafted prompt can also steer a planner-executor system at planning time, before workflow-inspection defenses run, raising malicious success by up to 55 percent Can prompts alone reshape multi-agent workflows without system access?. And a single compromised agent can pass persistent behavioral bias through six downstream agents using ordinary messages, with no explicit content for a filter or paraphrasing defense to catch Can one compromised agent corrupt an entire multi-agent network?. I'm inferring that these fit the trap categories, since the notes don't map them explicitly. They look like cognitive-state, behavioral-control and systemic attacks.

This also explains why filtering the model's output is not enough. A filter judges one output at one moment, while an agent's risk spreads across its memory, retrieved content, tool calls, and reach into its environment Can a model-level filter truly contain an agent with environment access?. Proposed defenses follow the same logic. One propagates semantic risk labels through the delegation graph so downstream steps inherit the original intent Can semantic labels on requests prevent malicious propagation through agent networks?. Another treats a revisable set of linked actions across agents as the unit of defense, not each execution reviewed in isolation Should defence units span multiple executions and agents?.