Your AI Stack Is a Nine-Story Attack Surface and You’ve Secured Floor One

You plugged in a RAG pipeline, wired it to your CRM, gave it a tool to send emails, and called it an AI assistant. Congratulations — you just created eight distinct vulnerability stages and your security vendor is still writing blog posts about jailbreaks. The researchers calling this out are not being dramatic. You are.

What happened

Researchers Natanzi and Tang systematized the academic literature on large language model security through what they call a “lifecycle and application-stack lens” — meaning they refused to treat the model in isolation and instead mapped vulnerabilities across eight discrete stages: data collection, pretraining, post-training alignment, model packaging and supply chain, retrieval and memory, prompting and inference, tool/agent execution, and deployment/maintenance. This is not a list of attack names; it is a map of where trust boundaries actually fail. The core finding is structural: risks do not arise from model weights alone but from how data, prompts, outputs, tools, memories, and user authority interact across the full stack. They specifically call out how untrusted data becomes executable instruction — the mechanism behind prompt injection vs. jailbreak attacks — and how delegated authority in agentic workflows amplifies model errors into organizational-scale consequences. They map vulnerabilities to eight security objectives: confidentiality, integrity, availability, safety, privacy, fairness, accountability, and agency-control. The closing research agenda names seven unsolved problems, including tool-call containment and provenance-aware retrieval — neither of which has a production-ready solution today.

Cold read

This is a survey paper, not an empirical study — no new attacks were demonstrated, no defenses were benchmarked, and no failure rates were measured. The eight-stage taxonomy is analytically useful but was constructed by the authors; its completeness and boundaries are asserted, not validated against a ground-truth corpus of real incidents. The paper draws from existing literature, which means its conclusions are bounded by what researchers have already published — the most dangerous real-world exploits are almost certainly undisclosed. The research agenda items (compositional security, long-horizon agent evaluation, realistic red teaming) are described as open problems precisely because nobody has solved them, which means citing this paper as evidence that solutions are coming is backwards reasoning. Survey papers of this kind get cited heavily in vendor marketing within weeks of release; the gap between “we systematized the problem space” and “here is what to do about it” is exactly where snake oil enters the room.

What it means for you

• Signal maturity: 3/5 — Taxonomy is solid; actionable defenses are not
• Who gets hurt: Enterprise SaaS founders who bolted agentic AI capabilities onto existing products without rethinking authorization models — your tool-calling layer is the most exposed and least audited part of your stack
• What breaks if this is true: Any startup whose moat depends on a retrieval-augmented generation pipeline touching private customer data faces a liability event the moment a supply-chain or prompt-injection attack exfiltrates that data through a tool call
• Why it might not land: The attack surface described requires a sophisticated, targeted adversary — most startups face opportunistic threats, and the probability-weighted risk for a 20-person company is far lower than the paper’s comprehensive framing implies
• Watch for: A publicly disclosed incident involving an enterprise AI agent exfiltrating data across organizational boundaries via multi-agent orchestration — that is the trigger that will force procurement-level security requirements onto every vendor in this space

Forecast as of 2026-07-01

By Q2 2027, at least two publicly confirmed enterprise security incidents will be attributed specifically to the tool/agent execution stage (stage 7 in this taxonomy) — not to model weights or prompt injection at the UI layer — forcing at least one major cloud provider to ship mandatory tool-call sandboxing as a default, not an option.

Source: A Lifecycle and Application-Stack Survey of Large Language Model Vulnerabilities: Attacks, Risks, Defenses, and Open Problems — Seyed Bagher Hashemi Natanzi, Bo Tang. https://arxiv.org/abs/2606.31639v1