AI agents are not an app bolted onto old infrastructure. They are a new trust topology, where untrusted text, non-human identities, and autonomous action collapse the boundaries classic security kept apart. This is the end-to-end map of where they get attacked, what defends them, and what still has no answer.
A single request crosses eleven layers and seven trust boundaries. Click any layer to see the surfaces it exposes, the validated incidents that hit it, the controls that help, and where coverage runs out.
Every risk is mapped to the layers it touches, the OWASP LLM and Agentic threat IDs, a validated real-world example, and an honest call on how well it is solved. Filter, then click a card for the full entry.
The analytical core: each risk against its strongest controls and an explicit gap status. Four risks are open problems no product solves; most of the rest are under-served by shipping tools.
Most agentic risk is contained, not prevented. These cross-cutting moves neutralize the damaging half of nearly every attack even when detection fails.
The taxonomy is built on documented, primary-source-verified events, not hypotheticals. Browse the full incident index; each links to its source and the risks it demonstrates.
Part 1 builds the shared map and tours the attack surface. Part 2 catalogs all 31 risks, surveys the solution market, and prescribes an end-to-end control architecture. Each part opens with an executive bottom line and drops into practitioner depth.
An honest account of the method, sources, scope, and limitations behind the model.
By Danny Livshits. This is independent security research. Two of the author's open-source research tools are referenced where relevant and disclosed as such, not as products: a2a-audit (an A2A agent-card posture auditor) and Agent Guard (open prompt-injection detection models). Their inclusion is disclosed, and they are rated on the same honest scale as every other control.
Attack vectors were enumerated across thirteen domains, then every candidate incident was adversarially verified against its primary source (CVE record, vendor advisory, or original disclosure) before entering the dataset. Findings were clustered into a canonical taxonomy mapped to an eleven-layer reference architecture grounded in Google SAIF, CSA MAESTRO, and the OWASP Agentic Security Initiative. Two further passes expanded the taxonomy to 50: an adversarial review surfaced eleven cross-cutting risks, and a code-security pass closed the build-time and operational gaps (AI-generated insecure code, secure development lifecycle, patch and vulnerability management, runtime drift detection, and decommissioning) so the framework now runs end-to-end from how an agent is built to how it is retired.
Risks are mapped to the OWASP Top 10 for LLM Applications 2025, the OWASP Agentic threat taxonomy, MITRE ATLAS, CSA MAESTRO, and NIST AI RMF. Every incident in the index carries a primary-source link; the live dataset is open in data.json and the source is MIT-licensed on GitHub.
This is a security-and-controls view of enterprise AI agents. It does not cover model bias, content safety, or AI ethics except where they create a security consequence. Several load-bearing examples (Morris II, Sleeper Agents, agentic misalignment) are controlled research demonstrations, labeled as such, not in-the-wild incidents. Coverage and gap calls reflect the public market as of the date below and will drift; verify every control against your own environment.
Livshits, Danny. Securing the Agentic Enterprise: An End-to-End View of AI Agent Risk. 2026. https://dannyliv.github.io/e2e-Agentic-Risks/
June 2026. The taxonomy, mapping, and incident index are versioned with the repository; the most current state is always the live site and data.json.