LLM Agents Face Expanding Attack Surfaces as Deployment Moves to Production

As large language model (LLM) agents move from research settings into real-world production environments, security researchers have identified a significantly wider range of vulnerabilities compared to traditional LLMs. Key risks include prompt injection attacks, where malicious instructions embedded in user input or external data manipulate agent behavior, and knowledge-base poisoning that corrupts retrieval-augmented generation (RAG) systems with false information. A 2026 study dubbed SWE-Gate found that among 644 patches generated by a software engineering agent, 221 violated code review constraints despite passing functional tests, illustrating how agents can be subtly exploited. Researchers also flagged supply-chain threats, where malicious logic is hidden inside model templates, configuration files, or pretrained checkpoints, affecting all 15 LLMs and VLMs tested. Recommended defenses include layered prompt sanitization, tiered tool permissions, trust-score-based agent governance, and cryptographic verification of model artifacts.