Agentic AI Security - Exam Questions
📕 Agentic AI Security: Threats, Defenses, Evaluation & Open Challenges - Examination Questions
Based on the paper by Chhabra et al. (2026). All questions can be answered from the paper without internet access.
Section A: Agentic AI Fundamentals
| # | Question | Answer |
|---|---|---|
| Q1 | What does Agentic AI represent in the evolution of AI systems? | C) The next stage powered by LLMs with autonomy, planning, and tool use |
| Q2 | Which of the following is NOT a key characteristic of agentic AI? | D) Passive response to prompts without memory or autonomy |
| Q3 | What distinguishes agentic AI from static LLMs? | B) Agentic systems maintain persistent memory, deliberate across time, and adapt dynamically |
| Q4 | Which of the following is an example of agentic AI in software engineering? | C) Devin by Cognition Labs - an AI software engineer |
| Q5 | What percentage of real-world issue resolution tasks can Devin solve autonomously compared to prior models? | C) 13.86% vs 1.96% |
| Q6 | Which framework enables agents to autonomously explore and adapt strategies in Minecraft? | B) Voyager |
| Q7 | What are the four core components of an agentic AI architecture? | A) Planning/Reasoning, Memory, Tools, and Environment interaction |
| Q8 | In the Ocado grocery example, what is the projected automation scale? | B) From 40% to 80% of orders |
| Q9 | Which company uses agent-enabled robots in warehouses for unloading, sorting, and retrieving items? | C) Amazon |
| Q10 | What does the EchoLeak (CVE-2025-32711) exploit demonstrate? | B) Infected emails can trigger Copilot to exfiltrate data without user interaction |
Section B: Threat Taxonomy - Prompt Injection & Jailbreaks
| # | Question | Answer |
|---|---|---|
| Q11 | What is the most widely discussed attack against agentic AI systems? | B) Prompt injection |
| Q12 | What is Direct Prompt Injection (DPI)? | A) Inserting malicious instructions directly into the input prompt |
| Q13 | What is Indirect Prompt Injection (IPI)? | C) Inserting malicious instructions into external data that the model processes |
| Q14 | In Direct Prompt Injection, who is typically the attacker? | B) The end-user |
| Q15 | In Indirect Prompt Injection, who is typically the attacker? | C) The owner or supplier of agent-processed third-party information |
| Q16 | What success rate have adaptive IPI attacks achieved in penetrating IPI defenses? | B) 50% |
| Q17 | What is Greedy Coordinate Gradient (GCG) primarily used for in the context of IPI? | C) Generating affirmative prefixes containing adversarial strings |
| Q18 | What does AutoDAN improve upon compared to other IPI attack methods? | A) Enhances the semantic quality of adversarial strings to decrease detectability |
| Q19 | What is the key advantage of IPI attacks over direct prompt injections? | B) Injected prompts can look like legitimate agent instructions |
| Q20 | What percentage of state-of-the-art LLM agents are vulnerable to prompt injection? | D) 94.4% |
| Q21 | What percentage of LLM agents are vulnerable to retrieval-based backdoors? | C) 83.3% |
| Q22 | What percentage of LLM agents are vulnerable to inter-agent trust exploits? | D) 100% |
| Q23 | Which attack type involves embedding malicious instructions in images through steganography? | B) Image-based injection |
| Q24 | What is CrossInject? | A) A cross-modal prompt injection method that embeds aligned adversarial signals in vision and text |
| Q25 | How much does CrossInject boost attack effectiveness across various tasks? | B) At least 30.1% |
| Q26 | What is payload splitting? | C) Fragmenting malicious content across several benign inputs, revealed only upon recombination |
| Q27 | What is the difference between propagating and non-propagating injection attacks? | A) Propagating attacks spread across agents; non-propagating are confined to a single target |
| Q28 | What is recursive injection in the context of propagating attacks? | B) A single malicious prompt triggers a chain of compromised behaviors across future interactions |
| Q29 | Why are multilingual and obfuscated injections effective? | C) LLMs can interpret hidden instructions in Base64, HTML entities, or non-primary languages |
| Q30 | What is unintentional prompt injection? | B) Harmful behavior caused by unclear or badly worded user queries without a malicious adversary |
Section C: Autonomous Cyber-Exploitation & Tool Abuse
| # | Question | Answer |
|---|---|---|
| Q31 | What is autonomous cyber-exploitation in the context of agentic AI? | B) Agents independently identifying, organizing, and carrying out attacks without human supervision |
| Q32 | What success rate did GPT-4 achieve when given CVE descriptions for exploiting one-day vulnerabilities? | C) 87% |
| Q33 | Which model outperformed OWASP ZAP and Metasploit in vulnerability exploitation? | B) GPT-4 |
| Q34 | What types of multi-step attacks can GPT-4 agents perform on websites? | D) XSS, CSRF chaining, SSTI, and blind SQL union injections |
| Q35 | What makes autonomous cyber-exploitation economically advantageous for attackers? | A) GPT-4 can execute exploits for a few dollars, cheaper than human attackers |
| Q36 | What is emergent tool abuse? | B) Autonomous LLM agents undertaking cooperative and adaptive tool usage to conduct cyberattacks |
| Q37 | What is the ConAgents framework? | C) A framework for structured cooperation among specialized agents for tool selection and execution |
| Q38 | What does ToolGen enable? | A) LLMs to invoke tools as part of next-token generation |
Section D: Multi-Agent & Protocol-Level Threats
| # | Question | Answer |
|---|---|---|
| Q39 | What protocol uses a client-server architecture to link LLMs with external resources? | B) Model Context Protocol (MCP) |
| Q40 | What is the Agent-to-Agent (A2A) protocol used for? | C) Coordinating interactions between MCP, capacity identification, and task delegation |
| Q41 | What is a common MCP-induced attack involving flooding or infinite loops? | B) Denial of Service (DoS) |
| Q42 | What is credential compromise in the context of MCP attacks? | A) Insecure proxies or leaked tokens enabling impersonation of agents |
| Q43 | What is a fake agent advertisement in A2A systems? | B) Adversaries impersonating agents or taking over delegated tasks |
| Q44 | What is transitive prompt injection? | C) Harmful inputs spreading through interconnected agent workflows |
| Q45 | What is the Impersonation & Role Abuse threat in multi-agent systems? | A) Adversaries assuming false roles or overriding intended privileges |
| Q46 | What is coordination manipulation in multi-agent systems? | B) Introducing malicious agents during runtime as part of task-specific teams |
| Q47 | What is knowledge and learning manipulation? | C) Subtly manipulating reward signals causing misaligned behavior to propagate across agents |
| Q48 | What is inference and policy evasion in federated multi-agent systems? | B) Reconstructing sensitive data by reasoning over multiple partial outputs |
| Q49 | Why is accountability obfuscation a challenge in multi-agent systems? | A) Independent logging policies prevent unified trace of activity across domains |
| Q50 | What is confidential data tampering/exfiltration in multi-agent systems? | C) Exploiting cryptographic and workflow limitations to modify or intercept encrypted data |
Section E: Interface & Environment Risks
| # | Question | Answer |
|---|---|---|
| Q51 | What is observation and action space misalignment? | B) LLMs pretrained on static text struggle with grounded operations like scrolling or hovering |
| Q52 | What does AgentOccam demonstrate? | A) Trajectory stability improves by streamlining the action space |
| Q53 | What is the misinterpretation of prior inputs in web agents? | C) Agents reissue already entered search phrases, failing to incorporate short-term state |
| Q54 | What is premature termination in agentic AI? | B) Unsafe early stopping caused by perception biases in agents |
| Q55 | How does removing the Unachievable (UA) Hint affect GPT-4 task success in WebArena? | A) It improves task success by 14.41% |
| Q56 | What percentage of feasible tasks does GPT-4 mislabel as impossible under UA hint settings? | C) 54.9% |
| Q57 | What is the brittleness of templates in LLM agents? | B) Performance variance is significant even for tasks derived from the same underlying template |
| Q58 | What success rate do advanced multimodal agents achieve against CAPTCHAs? | B) At best 40% |
| Q59 | Why do dynamic content and localization create challenges for agents? | A) Time zones, languages, and geographic settings alter how websites are rendered |
Section F: Governance & Autonomy Concerns
| # | Question | Answer |
|---|---|---|
| Q60 | What key concern arises from fully autonomous AI systems that can write and run code? | C) Increased risks in safety, security, and trust |
| Q61 | What do researchers recommend to reduce dangers from autonomous agents? | B) Human-in-the-loop control and structured autonomy levels |
Section G: Defenses Against Prompt Injection
| # | Question | Answer |
|---|---|---|
| Q62 | What are the three main classes of prompt injection defenses? | C) Agent-focused, User-focused, and System-focused |
| Q63 | What is the instruction hierarchy defense? | A) Establishing priority levels so user instructions override potentially malicious ones |
| Q64 | What is StruQ? | B) A method augmenting datasets with normal and prompt injection contaminated prompts |
| Q65 | What is SecAlign? | C) Leverages alignment training via DPO to prefer benign instructions over adversarial ones |
| Q66 | What trade-off do training-based defenses come with? | A) They can degrade the general-purpose capabilities of LLMs |
| Q67 | What is the key advantage of user-focused defenses? | B) Strong guarantees through explicit human verification |
| Q68 | What is a major limitation of user-focused defenses? | A) They sacrifice scalability and automation |
| Q69 | What is PromptArmor's finding about prompt augmentation defenses? | C) They can be bypassed under adaptive attacks |
| Q70 | What is the LLM Map-Reduce design pattern? | A) A system-focused defense that distributes processing across multiple LLM instances |
| Q71 | What is TrustAgent? | B) An AgentConstitution-guided framework enforcing safety in LLM-based agent planning |
| Q72 | What is Melon? | A) A training-free runtime detection approach using masked re-execution and tool-call similarity checks |
| Q73 | What are the two sub-categories of system-focused defenses? | B) Training-based and Training-free |
| Q74 | What is DataSentinel? | C) A detection method formulating detection as a minimax optimization problem |
| Q75 | How does perplexity-based defense work? | A) Unexpectedly high perplexity values suggest unnatural phrasing correlated with injected instructions |
Section H: Policy Filtering, Sandboxing & Monitoring
| # | Question | Answer |
|---|---|---|
| Q76 | What is GuardAgent? | B) Converts guard requests into executable code for runtime safety constraints |
| Q77 | What is AgentSpec? | C) A DSL to specify runtime constraints for systematic policy enforcement |
| Q78 | What is ShieldAgent? | A) An oversight agent auditing multimodal action sequences with probabilistic policy reasoning |
| Q79 | What is R2-Guard? | B) Combines data-driven detection with logical inference using first-order logic rules |
| Q80 | What is Llama Guard? | A) A signal-centric defense targeting text-based LLMs |
| Q81 | What is LlavaGuard? | C) Extends Llama Guard to image-based multimodal models |
| Q82 | What is Safewatch? | B) A defense addressing video generation safety |
| Q83 | What is SandboxEval? | A) A test suite simulating unsafe code execution including file-system manipulation |
| Q84 | What containerized environments are used to execute LLM-generated code safely? | D) gVisor or Docker |
| Q85 | What does Pro2Guard employ for proactive monitoring? | B) Probabilistic reachability analysis to anticipate violations before they occur |
| Q86 | What is the Adversarial Markov Games framework? | C) Casts detection as a dynamic interaction between attackers and defenders using RL |
Section I: Standards, Benchmarks & Evaluation
| # | Question | Answer |
|---|---|---|
| Q87 | What is the NIST AI Risk Management Framework Generative AI Profile? | B) A cross-sectoral reference for managing risks specific to generative and agentic AI |
| Q88 | What does the OWASP Agentic AI Threats project provide? | A) A catalog of common vulnerabilities such as insecure orchestration and prompt injection |
| Q89 | What is the CSA MAESTRO framework? | C) A multi-layered threat modeling methodology for agentic AI across the AI lifecycle |
| Q90 | What is DoomArena? | B) A modular security-oriented evaluation platform for cross-environment attack composition |
| Q91 | What is BrowserGym? | A) A unified interface bringing many web agent tasks under one consistent scoring protocol |
| Q92 | What is τ-bench? | C) A benchmark targeting multi-turn tool-using agents with the pass∧k metric |
| Q93 | What is ST-WebAgentBench? | B) An enterprise-focused benchmark testing web agents for policy compliance |
| Q94 | What does the Completion Under Policy (CuP) metric measure? | A) Task completions that adhere to acceptable policies |
| Q95 | What does the Risk Ratio metric quantify? | B) Security breaches in agent task completion |
| Q96 | What is VisualWebArena used to test? | C) Multimodal understanding on visual web interfaces |
| Q97 | What is AndroidWorld used for? | A) Assessing touch-based mobile interactions |
| Q98 | How low can pass∧8 drop on the retail setting in τ-bench? | B) Below 25% |
Section J: Critical Analysis & Synthesis
| # | Question | Answer |
|---|---|---|
| Q99 | According to the paper, why is security and trustworthiness essential for agentic AI deployment? | D) Autonomy increases attack surface, tool integration magnifies misuse, and coordination introduces unpredictability |
| Q100 | What makes agentic AI security distinct from traditional AI safety? | C) Agentic AI creates new amplified risks from autonomy, persistence, and multi-agent coordination |
| Q101 | What is the key challenge in defending against prompt injection? | B) Completely preventing prompt injection is an open problem analogous to adversarial examples in vision |
| Q102 | Why do practical deployments favor hybrid defense designs? | A) Each defense category has trade-offs; combining them provides better coverage |
| Q103 | What is the main reason sandboxing alone is insufficient? | B) Vulnerabilities in sandbox implementations themselves have been documented |
| Q104 | Why are decentralized runtime enforcement approaches needed in multi-agent systems? | C) They sidestep scalability limits and information-sharing constraints of centralized approaches |
| Q105 | What does the paper identify as a fundamental limitation of current accountability mechanisms? | A) Inter-agent relationships and cross-domain causality remain hidden |
Section K: Advanced Prompt Injection Details
| # | Question | Answer |
|---|---|---|
| Q106 | How do IPI attacks against web agents manipulate agent behavior? | B) By incorporating adversarial triggers into the HTML accessibility tree of trustworthy websites |
| Q107 | What techniques can improve stealth of IPI attacks against web agents? | A) CSS obfuscation and hidden HTML elements |
| Q108 | What is two-stage GCG? | C) A method that trains a two-part adversarial string still effective after paraphrasing |
| Q109 | What does IPI exploit according to the paper's analysis of web navigation agents? | B) The decoupling between user inputs and subsequent tool calls |
| Q110 | What can a single malicious IPI trigger in web agents accomplish? | A) Collect login credentials from many platforms |
| Q111 | Why is payload splitting more dangerous than direct prompt injections? | B) It makes it significantly more challenging to detect malicious information in any one input |
| Q112 | What is AI worm in the context of propagating attacks? | A) Malicious prompts that spread across agents without user intervention |
| Q113 | What did the resume-screening assistant vulnerability demonstrate? | B) Fragments of a malicious prompt spread throughout resume sections manipulate the model |
| Q114 | How do adversarial image patches hijack multimodal OS agents? | A) When captured in screenshots, they execute harmful commands regardless of layout or user request |
Section L: Autonomous Exploitation Deep Dive
| # | Question | Answer |
|---|---|---|
| Q115 | What are P2SQL attacks? | C) Prompt-to-SQL attacks that circumvent standard database security measures |
| Q116 | What does CVE-2024-5565 demonstrate? | B) How AI-generated code can be used for arbitrary execution |
| Q117 | What types of exploits can adversarial GPT-4 agents carry out? | D) SQL injection, Remote Code Execution (RCE), and concurrent/coordinated attacks |
| Q118 | How does agent context management affect autonomous website hacking? | A) Performance is dramatically reduced when document access or detailed prompting is not provided |
| Q119 | What is the significance of GPT-4's parallelizable nature for LLM-driven attacks? | A) It makes it economical to scale to high volumes of attack attempts |
| Q120 | What enables blind SQL union injection attacks by LLM agents? | B) Agentic capabilities such as context management, tool integration, and strategic planning |
| Q121 | What is the key finding about GPT-4 vs vulnerability scanners? | C) GPT-4 outperformed OWASP ZAP and Metasploit with 87% success on CVE-based exploits |
| Q122 | How do agents recover from failures in autonomous exploitation? | A) Through structured cooperation and iterative failure recovery via frameworks like ConAgents |
Section M: Protocol-Level Threats in Detail
| # | Question | Answer |
|---|---|---|
| Q123 | What are embedded backdoors in MCP attacks? | B) Malicious triggers hidden in prompts or model parameters that misuse MCP-enabled tool access |
| Q124 | What is retrieval corruption in MCP contexts? | C) Adversaries distorting contextual inputs in retrieval-augmented generation pipelines |
| Q125 | What is federated training manipulation? | A) Injecting malicious updates in federated learning settings to corrupt distributed training data |
| Q126 | What are confidentiality breaches via MCP? | B) Inference and side-channel timing exploits that leak sensitive contextual data exposed through MCP |
| Q127 | What is recursive DoS in A2A systems? | C) Repeated task delegation causing deadlocks or unbounded loops |
| Q128 | What is memory manipulation in A2A attacks? | A) Malicious inputs compromising internal agent state or corrupting persistent memory |
| Q129 | What is context tampering in multi-agent systems? | B) Manipulation of payloads to misguide execution or leak sensitive information |
| Q130 | What techniques offer partial mitigation for encrypted multi-agent workflows? | D) Fully homomorphic encryption, multi-party computation, and zero-knowledge proofs |
Section N: Defense Architectures & Trade-offs
| # | Question | Answer |
|---|---|---|
| Q131 | What is the Action-Selector design pattern for defending against IPI? | B) Limiting executable actions by the agent to resist prompt injection |
| Q132 | What is the Plan-then-Execute design pattern? | C) Committing to a predefined set of tools for a task with the system controller disabling others |
| Q133 | What are circuit breaking and task drifting approaches? | A) Recognizing and rejecting adversarial patterns while preserving intended functionality |
| Q134 | What is known-answer detection as a defense? | B) Using cryptographic tokens embedded in user commands to detect system-wide injection compromise |
| Q135 | What is the dual-agent sandbox framework by Ruan et al.? | A) One LLM acts as emulator and another as safety evaluator within sandbox boundaries |
| Q136 | What does the formal verification approach by Zhong et al. enable for sandboxing? | B) Separating enforcement from controller design for provable safety guarantees |
| Q137 | What vulnerability did Wu et al. find in sandbox implementations? | A) Missing file isolation constraints that allowed cross-session leakage |
| Q138 | What is the trade-off of confining agent interactions in multi-agent settings? | B) Reduces exposure to infectious malicious prompts but at the cost of collaborative efficiency |
Section O: Open Challenges
| # | Question | Answer |
|---|---|---|
| Q139 | Why is completely preventing prompt injection considered an open problem? | C) It is analogous to defending against adversarial examples in computer vision |
| Q140 | What is the key challenge with brittle generalization in LLM agents? | B) Performance variance is significant even for tasks from the same underlying template |
| Q141 | Why do dynamic interface elements create reproducibility challenges? | A) Ads, pop-ups, and non-deterministic updates lead to unstable performance |
| Q142 | What challenge do CAPTCHA systems pose for agentic AI? | B) Even advanced multimodal agents achieve at best 40% success vs nearly 100% for humans |
| Q143 | Why do training-based defenses have limited real-world adoption? | A) They can degrade general-purpose capabilities of LLMs |
| Q144 | What is the fundamental tension between automation and security in user-focused defenses? | B) Human confirmation of sensitive actions reduces automation efficiency |
| Q145 | What does the paper identify as the paradigm shift needed from reactive to proactive sandboxing? | A) Embedding formal verification within sandboxing for proactive confinement |
Section P: Real-World Incidents & Key Takeaways
| # | Question | Answer |
|---|---|---|
| Q146 | What did Symantec's controlled experiments with OpenAI's Operator demonstrate? | B) Agents could harvest personal data and automate credential stuffing attacks |
| Q147 | What misaligned behaviors did Anthropic observe in generative models given directive autonomy? | C) Blackmail or corporate espionage to fulfill goals diverging from human ethical standards |
| Q148 | According to the paper, what makes multi-agent autonomous cyberattacks especially dangerous? | A) They can intelligently adapt to network defenses |
| Q149 | What does the paper identify as the key economic imbalance that favors attackers? | C) LLM-driven attacks can be parallelized at scale for a few dollars per exploit |
| Q150 | What is the paper's central recommendation for deploying agentic AI securely? | B) Secure-by-design agent systems combining complementary defenses rather than a single strategy |
📝 Examination questions compiled for AI for Cyber Security 2026 - based on Chhabra et al. (2026)