An Empirical Evaluation of Attack and Defense Dynamics in Enterprise Agentic LLM Pipelines

Agentic large language model (LLM) systems in enterprise backends combine planning with retrieval, code execution, and API access, which widens their attack surface beyond that of single-turn LLM integrations. Threat taxonomies and layered defense architectures for such agents have multiplied, but controlled evidence of how specific attack classes fare against a layered defense in an enterprise-style pipeline remains limited. This study evaluates four attack classes (indirect prompt injection, goal hijacking, cascade exploitation through error recovery, and tool description poisoning) against a purpose-built pipeline using the open-weight gpt-oss-20b planning model, under an undefended baseline and a four-layer defense: input screening, per-step goal-consistency verification, output validation, and human-in-the-loop gating. Across 740 trials, baseline attack success rates were far below published benchmark figures: 7.5% for indirect injection and for goal hijacking, 25.0% for tool description poisoning, and 0% for cascade exploitation. The layered defense eliminated every success (0/80 per class; p = .028 for both injection classes, p < .001 for tool poisoning) but at a utility cost that varied by class, from 0.98 for goal hijacking to 0.68 for tool poisoning. Cascade exploitation could not be mounted in 72% of trials because tasks finished within one to three tool calls, refuting it as a material threat to short-chain agents. Two further findings bear on deployment: goal-verifier thresholds produced near-threshold false positives that made utility unstable between runs, and an approval flag exposed in the tool schema let the agent approve its own write calls in all 12 successful injection attacks.

Contents of this record

This record contains the paper (PDF) and the full trial dataset behind every statistic and figure in it: 740 trial records collected between 14 September and 2 October 2026 (trials_checkpoint.jsonl), the first-collection records used for the pooled utility figures (trials_checkpoint.jsonl.pre-scorer-fix.bak), a flat CSV version, the runner's summary, and the full run log. README_data.md describes every file and field and explains how to reproduce the paper's statistics.

All corpora, payloads and tasks are synthetic. Attacker hosts are subdomains of example.com and never resolve; no payload was delivered to any real system.

The code is available at https://github.com/patrickikhidero/agentic-llm-security and archived at https://doi.org/10.5281/zenodo.23717855.