Referenz

Quellen

Die Bibliografie hinter Referenz, Folien, Webapp und Code — jedes Paper, jede Dokumentationsseite und jeder Essay, der das Projekt informiert. 257 Einträge in 25 Gruppen.

§1

Pattern Taxonomies and Surveys

Sources that catalogue, classify, or survey agent / multi-agent patterns. Useful background for our four-domain taxonomy (Thinking / Flow / Collaboration / System Operation).

Agent Design Pattern Catalogue: A Collection of Architectural Patterns for Foundation Model based Agents
Liu et al., Journal of Systems and Software (2024) · Peer-reviewed catalogue of 18 architectural patterns grouped by lifecycle phase (goal creation, reflection, collaboration, accountability). The most authoritative academic catalogue of agent patterns as a concept. arXiv ↗︎ Journal version (Elsevier) ↗︎
Multi-Agent Collaboration Mechanisms: A Survey of LLMs
Tran et al. (2025) · Comprehensive survey of coordination patterns; directly underpins our Collaboration domain.
A survey on LLM-based multi-agent systems: workflow, infrastructure, and challenges
Springer Vicinagearth (2024) · Three-pillar taxonomy; their workflow maps to our Flow and their infrastructure to our System Operation.
A Taxonomy of Hierarchical Multi-Agent Systems: Design Patterns, Coordination Mechanisms, and Industrial Applications
arXiv (2025) · Five-axis taxonomy (control hierarchy, information flow, role/task delegation, temporal hierarchy, communication structure) — orthogonal drill-down into the Collaboration domain.
Large Language Model Agent: A Survey on Methodology, Applications and Challenges
arXiv (2025) · Methodology-centred taxonomy organised around construction, collaboration, and evolution.
Microsoft Azure — AI Agent Orchestration Patterns
Microsoft · Vendor-published practitioner taxonomy; splits single-agent vs. multi-agent then sub-patterns.
Google Cloud — Choose a design pattern for your agentic AI system
Google · Decision-tree-style pattern guide; closer in spirit to our webapp Decision Guide than to the taxonomy itself.
Databricks — Agent system design patterns
Databricks · Sequential, parallel, supervisor, hierarchical — practitioner-grade patterns covering Flow + Collaboration.
Agent design patterns
Lance Martin / LangChain (blog, 2026) · Recent practitioner synthesis from a LangChain maintainer.
Agentic Design Patterns
Antonio Gulli (book; Google engineer; ~400 pp; 21 patterns, MCP excluded) · Practitioner catalogue — each pattern with TL;DR, use, pros/cons, examples. Largely re-frames patterns this project already catalogues across Domains 1–4; primary source for the Exploration & Discovery and Resource-Aware Optimization entries.
Mark Kashef — "Master ALL 20 Agentic AI Design Patterns"
Mark Kashef (video, 2024) · Hour-long plain-language summary of Gulli's book; secondary aid.
Top Agentic AI Frameworks
Omdena (blog, 2024) · Practitioner survey of leading agentic frameworks with use-case guidance.
Agentic AI Frameworks: Benchmark
AIMultiple (2026) · Measures end-to-end latency and token consumption for LangGraph, LangChain, AutoGen, and CrewAI across five tasks and 2,000 runs; the primary source behind the framework-performance claims in Part VII.
Agentic AI Framework Comparison
Moxo (blog, 2026) · Vendor comparison of agentic frameworks; restates AIMultiple's benchmark on latency and token usage rather than running its own.

§2

Agent Autonomy and Control Axes

Sources that frame agent systems along an autonomy axis (workflow → agent; how much the LLM decides on its own) and a control axis (centralized → distributed coordination). Underpins the 2-axis pattern map and any framing that positions systems on a spectrum.

Building Effective Agents
Anthropic (2024) · Anchors the spectrum: "A system is more agentic the more an LLM decides how the system can behave." Workflows (predefined code paths) vs. agents (LLM dynamically directing).
What is an AI agent?
LangChain blog · Proposes agent autonomy as a spectrum; explicitly draws the SAE autonomous-vehicle L0–L5 analogy.
How to think about agent frameworks
LangChain blog · Uses the autonomy axis to compare frameworks; closest external precedent for ranking systems along it on a chart.
Workflows and agents
LangChain docs · Formalises the workflow ↔ agent distinction and where Router / Tool-calling / ReAct sit on the spectrum.
A Survey of Multi-Agent Organizational Paradigms
Horling & Lesser, The Knowledge Engineering Review (2004) · Canonical pre-LLM survey of how agent collections are organized — hierarchies, holarchies (holons), coalitions, teams, congregations, societies, federations, markets, and matrix forms — with their coordination costs and trade-offs. The authoritative source for the organizational-paradigm vocabulary underneath the centralized → distributed control axis.
Multi-Agent Collaboration Mechanisms: A Survey of LLMs
Tran et al. (2025) · Explicit centralized / decentralized / hybrid taxonomy of coordination structures. Already cited in Pattern Taxonomies and Surveys.
What Is Agentic Architecture?
IBM · Practitioner-grade explanation of centralized vs. distributed agent coordination.
Single-agent and multi-agent architectures
Microsoft Dynamics 365 docs · Vendor mapping of supervisor / decentralized / hybrid models.
Centralized vs. Distributed Agent Collaboration Models
Auxiliobits (practitioner blog) · Side-by-side trade-off summary.

§3

Conceptual Essays and Practitioner Guides

Building Effective Agents
Anthropic (2024) · Workflows vs. agents and the canonical composable patterns (prompt chaining, routing, parallelization, orchestrator-workers, evaluator-optimizer).
A Practical Guide to Building Agents
OpenAI (2024) · Pragmatic introduction to agent design choices, tools, and guardrails (PDF).
How we built our multi-agent research system
Anthropic Engineering (2025) · Production lessons on orchestrator-worker MAS, parallelism, and reliability.
Don't Build Multi-Agents
Cognition AI (2024, opinion) · Counter-position arguing single-agent loops often beat MAS; useful for the anti-pattern section.
Agentic Design Patterns, Part 1: Reflection
Andrew Ng / DeepLearning.AI (2024, blog) · Practitioner overview of the reflection / self-critique loop as a foundational agentic pattern.
Agentic Design Patterns: A System-Theoretic Framework
Dao et al. (2025) · Twelve-pattern system-theoretic framework (Integrator, Retriever, Recorder, Selector, Planner, Deliberator, Executor, Tool Use, Coordinator, Reflector, Skill Build, Controller); primary source for Part VI of the knowledge base.
Understanding the Agentic Reasoning Loop
Digital Bricks (2026, blog) · Accessible vendor-blog restatement of the four-phase reasoning loop (Think / Act / Observe / Reflect) and supporting framing for Part VI's runtime-loop preamble. Also references Microsoft Copilot Studio's "enhanced task completion" as a productized form of the loop. Higher-level than the Dao et al. framework above; useful as introductory reading.

§4

Foundational Papers — Reasoning and Thinking Patterns

Primary papers behind the Domain-1 thinking patterns.

ReAct: Synergizing Reasoning and Acting in Language Models
Yao et al. (2022) · Origin of interleaved reasoning + tool calls.
Toolformer: Language Models Can Teach Themselves to Use Tools
Schick et al. (2023) · A model learns which API to call, when, with what arguments, and how to fold the result back in; foundational source for the Function Calling pattern.
Gorilla: Large Language Model Connected with Massive APIs
Patil et al. (2023) · Selecting the right call from a large, changing catalogue of APIs; source for the Tool Registry and Capability Routing patterns.
Self-Consistency Improves Chain-of-Thought Reasoning in Language Models
Wang et al. (2022) · Sample-and-vote aggregation over CoT.
Plan-and-Solve Prompting
Wang et al. (2023) · Two-phase plan-then-execute prompting baseline.
Understanding the Planning of LLM Agents: A Survey
Huang et al. (2024) · Survey of planning approaches in LLM agents; primary reference for the Plan-and-Execute pattern.
ReWOO: Decoupling Reasoning from Observations
Xu et al. (2023) · Plans tool calls up front to cut token cost.
Reflexion: Language Agents with Verbal Reinforcement Learning
Shinn et al. (2023) · Self-critique loop for iterative improvement.
Tree of Thoughts: Deliberate Problem Solving with LLMs
Yao et al. (2023) · Search over branching reasoning paths.
Executable Code Actions Elicit Better LLM Agents (CodeAct)
Wang et al. (2024) · Code as the action interface for agents.
Chain-of-Thought Prompting Elicits Reasoning in Large Language Models
Wei et al. (2022) · Antecedent for most "thinking" patterns.
Designing LLM Chains by Adapting Techniques from Crowdsourcing Workflows
Grunde-McLaughlin et al. (2025) · Practitioner-grade reference for the Sequential Pipeline (prompt chaining) pattern.
PromptChainer: Chaining Large Language Model Prompts through Visual Programming
Wu et al. (2022) · Visual-programming approach to composing LLM prompt chains; referenced in the L2 rung.
AI Chains: Transparent and Controllable Human-AI Interaction by Chaining LLM Prompts
Wu et al. (2022) · Foundational prompt-chaining paper showing transparency and control benefits; referenced in the L2 rung.
DSPy: Compiling Declarative Language Model Calls into Self-Improving Pipelines
Khattab et al. (2023) · Automated optimization of LLM prompt pipelines; referenced in the L2 rung.
Self-Refine: Iterative Refinement with Self-Feedback
Madaan et al. (2023) · Self-critique and iterative improvement loop; primary source for the Evaluator-Optimizer and Iterative Refinement patterns.
From Decoding to Meta-Generation: Inference-time Algorithms for Large Language Models
Welleck et al. (2024) · Survey of inference-time strategies including sampling, search, and self-correction; referenced in the L2 rung.
FlowForge: Guiding the Creation of Multi-agent Workflows
Hao et al. · Workflow-design tool cited under Parallelization (Sectioning / Voting).

§5

Foundational Papers — Multi-Agent Coordination

A Universal Modular Actor Formalism for Artificial Intelligence
Hewitt, Bishop & Steiger (1973) · Introduced the Actor model of concurrent computation: independent agents that communicate solely by asynchronous message passing; foundational precursor to modern multi-agent message-based coordination.
A Blackboard Architecture for Control
Barbara Hayes-Roth (1985) · Historical root of shared-state coordination between specialists.
Improving Factuality and Reasoning via Multiagent Debate
Du et al. (2023) · Foundational paper for the Multi-Agent Debate pattern.
ChatEval: Towards Better LLM-based Evaluators through Multi-Agent Debate
Chan et al. (2023) · Debate-as-evaluation method; cited under the Multi-Agent Debate pattern.
Encouraging Divergent Thinking in Large Language Models through Multi-Agent Debate
Liang et al. (2023) · Shows that societally diverse agent personas improve debate quality; referenced in the L3 rung.
Magentic-One: A Generalist Multi-Agent System for Solving Complex Tasks
Fourney et al. / Microsoft Research (2024) · Composite orchestration with planning ledger and replanning.
GPTSwarm: Language Agents as Optimizable Graphs
Zhuge et al. (2024) · Agent coordination modelled as executable, learnable state graphs; cited under Graph-based Orchestration.
Blackboard Systems
Engelmore & Morgan (eds.) (1988) · Canonical edited volume on the Blackboard architectural pattern; primary textbook reference for shared-workspace coordination cited in the L3 rung.
The Contract Net Protocol: High-Level Communication and Control in a Distributed Problem Solver
Smith (1980) · Historical root of market-based task allocation between agents; origin of the Contract Net coordination pattern.
AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation
Wu et al. (2023) · Conversation-centric MAS framework paper.
MetaGPT: Meta Programming for a Multi-Agent Collaborative Framework
Hong et al. (2023) · Role-based crew metaphor / SOPs for agent teams.
The Anatomy of Autonomy: Why Agents are the Next AI Killer App after ChatGPT
Lilian Weng / OpenAI blog (2023) · Influential write-up of the agent loop (planning, memory, tool use).
An Introduction to MultiAgent Systems, 2nd Edition
Michael Wooldridge (Wiley, 2009) · Standard academic textbook on MAS; covers coordination, communication, and cooperation in classical (pre-LLM) terms. Author page ↗︎ Publisher ↗︎
Deep Research Agents: A Systematic Examination and Roadmap
Huang et al. (2025) · Systematic survey of deep-research-agent architectures — planning, tool use, and report synthesis; primary source for the Exploration & Discovery pattern.
Self-Optimizing Multi-Agent Systems for Deep Research
Câmara et al. / Zeta Alpha (2026) · A deep-research orchestrator-worker system that reasons over its own traces and refines its prompts with self-feedback; companion source for the Exploration & Discovery pattern.

§6

Retrieval, Memory, and Evaluation

Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (RAG)
Lewis et al. (2020) · Origin of RAG as a memory pattern.
Agentic Retrieval-Augmented Generation: A Survey on Agentic RAG
Singh et al. (2025) · Survey of RAG where the agent decides whether, when, and how to retrieve, reformulates queries, and grades results. Primary source for the Agentic RAG pattern (Tool Integration).
Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflection
Asai et al. (2023) · Trains a model to decide when to retrieve and to self-critique retrieved passages; close relative of Agentic RAG.
Corrective Retrieval Augmented Generation (CRAG)
Yan et al. (2024) · Adds a lightweight retrieval evaluator that scores evidence and triggers correction (re-retrieval, web fallback); cited as an Agentic RAG variant.
From Local to Global: A Graph RAG Approach to Query-Focused Summarization (GraphRAG)
Edge et al. / Microsoft (2024) · Builds a hierarchical knowledge graph for multi-hop, corpus-spanning questions; cited as an Agentic RAG variant.
RAPTOR: Recursive Abstractive Processing for Tree-Organized Retrieval
Sarthi et al. (2024) · Recursively clusters and summarises chunks into a multi-level retrieval tree; cited as an Agentic RAG variant.
Beyond Vector Search: 5 Next-Gen RAG Retrieval Strategies
Machine Learning Mastery (2026, practitioner guide) · Survey of GraphRAG, Agentic RAG, Self-RAG, CRAG, and RAPTOR; source for the Agentic RAG named-variants note.
7 Steps to Mastering Memory in Agentic AI Systems
Machine Learning Mastery (2026, practitioner guide) · The RAG-vs-agent-memory distinction (read-only/content vs read-write/user) and storage-technology selection; source for the Memory Architecture preamble and storage-selection note.
MemGPT: Towards LLMs as Operating Systems
Packer et al. (2023) · Hierarchical memory for long-running agents; primary source for the Virtual Context Management pattern.
Cognitive Architectures for Language Agents (CoALA)
Sumers et al. (2023) · Formalises agent memory as short-term working memory plus long-term episodic, semantic, and procedural stores; the taxonomy underlying the Memory Architecture subdomain.
Generative Agents: Interactive Simulacra of Human Behavior
Park et al. (2023) · Natural-language memory stream retrieved by a recency + importance + relevance score, with reflection; primary source for the Episodic Memory pattern.
Voyager: An Open-Ended Embodied Agent with Large Language Models
Wang et al. (2023) · An ever-growing skill library of executable code stored and retrieved for reuse; primary source for the Skill Build (procedural memory) pattern.
Agent memory framework landscape (2026)
Machine Learning Mastery (2026, practitioner survey) · Practitioner survey of dedicated memory layers: Letta (the MemGPT lineage), Mem0, Zep, Cognee (knowledge-graph memory), plus the LangChain and LlamaIndex memory modules. Source for the concrete-framework mentions in the Memory Architecture subdomain.
Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena
Zheng et al. (2023) · Reference paper for LLM-as-Judge evaluation; documents position and verbosity bias in model judges.
G-Eval: NLG Evaluation using GPT-4 with Better Human Alignment
Liu et al. (2023) · Chain-of-thought + form-filling judging paradigm; also documents the judge's bias toward LLM-generated text.
LLM Evaluators Recognize and Favor Their Own Generations
Panickssery et al. (2024) · Self-preference bias: an LLM judge scores its own outputs higher than humans do, correlated with self-recognition.
Ragas — Evaluation framework for LLM applications
Ragas · Reference-free RAG/agent metrics (faithfulness, context precision/recall, answer relevancy).
DeepEval — LLM evaluation framework
Confident AI · Pytest-native, CI/CD-oriented evaluation with a broad metric library spanning RAG and agents.

§7

Framework Documentation — LangGraph

LangGraph — Low-level concepts (State, Nodes, Edges, Conditional Edges)
LangChain AI · Canonical vocabulary for state-driven agent graphs.
LangGraph — Human-in-the-Loop (interrupt / resume / Command)
LangChain AI · First-class halt points and resumability.
LangGraph — Persistence & Checkpointing
LangChain AI · Shared state across nodes and runs.
LangGraph — Multi-agent supervisor
LangChain AI · Canonical supervisor pattern implementation.
LangGraph — Hierarchical agent teams
LangChain AI · Reference for the Hierarchical Supervisor pattern.
LangGraph — Swarm / handoffs
LangChain AI · Decentralized handoff coordination.
LangGraph — Recursion limit
LangChain AI · Bounds for unbounded loops.
LangGraph — PostgresSaver checkpointer
LangChain AI · Production-grade checkpointer; replaces SqliteSaver under concurrency.
LangChain — Frameworks, runtimes, and harnesses
LangChain AI · Three-layer stack model (Framework / Runtime / Harness) for categorizing agent tooling. Vendor-origin and explicitly exploratory — the companion blog post concedes the categories are fuzzy; the project frames it as a contested lens (see KB Part III). Primary source for the stack-layer concept used in Block 4 and Cross-Cutting View 3.
Agent Frameworks, Runtimes, and Harnesses, oh my!
LangChain blog (Harrison Chase) · The companion post that introduces the split and openly admits "there is still murkiness and overlap." Cited as evidence the taxonomy is exploratory, not settled.
The AI Agent Stack in 2026
The Nuanced Perspective (A. Reganti) · Counter-grouping that classifies CrewAI, AutoGen, Google ADK and the OpenAI Agents SDK as runtimes, using a bipartite runtime/harness split. Cited as evidence the framework↔runtime boundary is contested.
LangGraph — GitHub repository
LangChain AI · Source code and issue tracker.
LangGraph: Building Stateful, Multi-Actor Applications with LLMs
LangChain AI (blog, 2024) · Original launch post introducing LangGraph's stateful graph model; referenced in the L4 rung.

§8

Framework Documentation — AutoGen / AG2

AutoGen — GroupChat / message-passing design pattern
Microsoft · Conversation-first coordination model.
AutoGen documentation home
Microsoft · Framework concepts, agents, and orchestration.
AG2 (community fork of AutoGen)
AG2 maintainers · Active community fork referenced in framework comparison.
AG2 — GitHub repository
AG2 maintainers · Source code and issue tracker.

§9

Framework Documentation — CrewAI

CrewAI — Flows (state, listeners, routers)
CrewAI · Flow-based analogue to the graph vocabulary.
CrewAI — Crews and roles
CrewAI · Role-based "crew" abstraction.
CrewAI — GitHub repository
CrewAI · Source code and issue tracker.

§10

Framework Documentation — Google ADK

Google ADK — Workflow agents (Sequential / Parallel / Loop)
Google · Composable workflow primitives.
Google ADK — Overview
Google · Apache 2.0 agent dev kit, Gemini-first but model-agnostic.
Google ADK — GitHub repository
Google · Source code and issue tracker.

§11

Framework Documentation — AWS Strands

AWS Strands Agents — Introducing post
AWS Open Source Blog (2025) · Model-driven loop, three-line agent example.
Strands Agents documentation
AWS · Concepts, model-driven loop, AWS integrations.
Strands Agents — GitHub repository
AWS · Source code and issue tracker.

§12

Framework Documentation — OpenAI Agents SDK / Swarm

OpenAI Agents SDK
OpenAI · Successor to the experimental Swarm framework; handoff primitives.
OpenAI Agents SDK — GitHub repository
OpenAI · Source code and issue tracker.
OpenAI Swarm (experimental, archived)
OpenAI · Original handoff-based swarm reference implementation.

§13

Framework Documentation — Pydantic AI

Pydantic AI — Documentation home
Pydantic / Samuel Colvin · Concepts, agents, RunContext dependency injection, structured output, and Logfire integration.
Pydantic AI — GitHub repository
Pydantic · Source code and issue tracker.
Pydantic AI — Harness overview
Pydantic · The optional capability library ("the batteries for your agent"): context management, guardrails, filesystem, code execution, multi-agent orchestration, shipped as a separate package whose capabilities graduate into core once stable. Cited in Part III (contested-lens note) and Part VII as evidence the "harness" label is overloaded.

§14

Framework Documentation — LlamaIndex

LlamaIndex — Documentation home
LlamaIndex · Data connectors, indexing, query engines, and agent workflows; hub for the LlamaHub connector ecosystem.
LlamaIndex — GitHub repository
LlamaIndex · Source code and issue tracker.

§15

Framework Documentation — Semantic Kernel / Microsoft Agent Framework

Semantic Kernel — Documentation home
Microsoft · Skills (plugins), planners, multi-language SDK (C#/Python/Java), and Azure-aligned governance.
Microsoft Agent Framework — Overview
Microsoft · Unified successor to Semantic Kernel and AutoGen; converging roadmap for enterprise agentic systems.
Semantic Kernel — GitHub repository
Microsoft · Source code and issue tracker.

§16

Framework Documentation — LangChain4j

LangChain4j — Documentation home
LangChain4j maintainers · Java/Kotlin LLM abstractions (AiServices, chains, tools, RAG), Spring Boot and Quarkus integrations, and MCP module.
LangChain4j — GitHub repository
LangChain4j maintainers · Source code and issue tracker.

§17

Protocols — Tool Use and Inter-Agent Communication

Model Context Protocol (MCP) — Specification
Anthropic / MCP working group · Open standard for agent ↔ tool integration.
Function calling — OpenAI docs
OpenAI · Reference for the tool-calling primitive shared across providers.
A2A Protocol — Announcing the Agent2Agent Protocol
Google (2025) · Open standard for agent ↔ agent communication.
A2A Protocol — Specification
A2A maintainers · Agent card, message exchange, framework neutrality.
Was ist das Agent2Agent-(A2A-)Protokoll?
Caballar & Stryker / IBM Think (2025) · German-language IBM Think explainer covering both MCP and A2A; cited under MCP in the Tool Integration subdomain.
ACP (Agent Communication Protocol) — merged into A2A
IBM / BeeAI · The former REST-native agent-to-agent messaging specification has merged into A2A under the Linux Foundation; the welcome page carries the notice and migration guide.
AGNTCY (Agent Connect) — Project home
AGNTCY collective (Cisco) · Directories, identity, and discovery for cross-organization agent cooperation.
ANP (Agent Network Protocol) — Project home
open source · Decentralized agent identity and discovery on W3C DIDs.
AG-UI — Documentation
CopilotKit · Event-streamed protocol standardizing agent-to-front-end communication.
AP2 — Protocol home
Google · 60+ partners · Agent-initiated payments using signed user mandates, built on A2A.
Agentic Commerce — Project home
OpenAI · Stripe · Standardized programmatic checkout for agent-driven purchases.
x402 — Coinbase Developer Platform
Coinbase · Revives HTTP 402 for per-call stablecoin payments between agents and APIs.
MCP — Model Context Protocol Specification
Model Context Protocol project · The protocol specification itself; cited from T16 for the consent and transport rules an abuse bypasses.

§18

Production and Operations

MapReduce: Simplified Data Processing on Large Clusters
Dean & Ghemawat (2004) · Foundational distributed-processing model underlying parallelization patterns; referenced in the L2 and L4 rungs.
Time, Clocks, and the Ordering of Events in a Distributed System
Lamport (1978) · Established logical clocks and causal ordering as the formal basis for reasoning about event sequences in distributed systems; referenced in the L4 rung on runtime coordination and trace stitching.
Sagas
Garcia-Molina & Salem (1987) · Long-lived transaction pattern for distributed systems; foundational reference for durable execution and compensation chains in agentic runtimes.
Dapper, a Large-Scale Distributed Systems Tracing Infrastructure
Sigelman et al. / Google (2010) · Foundational distributed-tracing architecture underlying modern agent observability stacks; referenced in the L4 rung.
LangSmith — Tracing for LLM applications
LangChain AI · Distributed tracing and token cost tracking.
OpenTelemetry — GenAI semantic conventions
OpenTelemetry · Cross-vendor observability for LLM / agent calls; standard gen_ai.* span attributes.
Arize Phoenix — Open-source AI observability & evaluation
Arize AI · OpenTelemetry/OpenInference tracing paired with LLM-based evaluations over the captured traces.
LangGraph — Durable execution & resumability
LangChain AI · Checkpoint-based recovery for long-running runs.
Actor Model of Computation: Scalable Robust Information Systems
Hewitt (2010) · Actors as the universal primitives of concurrent computation — private state, message passing, no shared memory; foundational source for the Actor Model pattern.
Enterprise Integration Patterns
Hohpe & Woolf (2003) · The canonical catalogue of messaging patterns (publish-subscribe channel, event-driven consumer, choreography); source for the Event-driven Choreography and Pub/Sub Agent Mesh patterns.

§19

Security and Threat Models

OWASP Top 10 for LLM Applications 2026
OWASP GenAI Security Project (v1.0, August 2026) · Canonical catalog of application-level LLM security risks, ranked by community vote (75%) weighted against 6,639 classified real incidents (25%); draws the boundary to the Agentic Top 10 at the point where the model becomes an actor. Supersedes the 2025 edition (eight entries renumbered; System Prompt Leakage re-scoped as Hidden Context Exposure). Underpins Part IX §7 (Cascading Security Vulnerabilities) and Part XII.
Agentic AI — Threats and Mitigations
OWASP GenAI Security Project (v1.1; v1.0 February 2025) · Publication of the OWASP Agentic Security Initiative; applies threat-modeling methodology to catalogue 17 emerging threats (T1–T17) of autonomous, LLM-driven agentic systems and their mitigations, and sources the Agentic AI Patterns vocabulary mapped in Part XII. v1.1 promotes two to first-class threats: T16 Insecure Inter-Agent Protocol Abuse and T17 Supply Chain Compromise.
Multi-Agentic System Threat Modeling Guide
OWASP GenAI Security Project (v1.0, 2025) · Builds on Agentic AI — Threats and Mitigations, applying its threat taxonomy to real-world multi-agent systems and the expanded vulnerability surface of agent-to-agent collaboration.
Agentic AI Threat Modeling Framework: MAESTRO
Cloud Security Alliance (2025) · Introduces MAESTRO (Multi-Agent Environment, Security, Threat, Risk, and Outcome), a seven-layer-plus-cross-layer framework for threat-modeling agentic AI by architectural layer rather than attack technique; source for the KB's MAESTRO section (Part XII): the architectural lens, the framework comparison, the six-step workflow, and the cross-layer threat taxonomy.
OWASP Top 10 for Agentic Applications for 2026
OWASP GenAI Security Project — Agentic Security Initiative (December 2025) · A prioritised consolidation (ASI01–ASI10) of the agentic threat corpus, ranking the ten highest-impact categories with architectural blueprints and code samples; mapped to the KB's T1–T17 catalogue in Part XII § Control & Certification Standards. Not a new taxonomy — a ranked view of the same threats.
OWASP Agentic Skills Top 10 (AST10)
OWASP Agentic Skills Top 10 project (Incubator, v1.0 in public review, 2026) · Catalogs the ten most critical risks of agent skills — the packaged instruction files and scripts (SKILL.md, skill.json, manifest.json) an agent loads to run a workflow with its tools: malicious skills, supply chain compromise, over-privileged skills, insecure metadata, untrusted external instructions, weak isolation, update drift, poor scanning, missing governance, and cross-platform reuse. Source for Part XII § OWASP Agentic Skills Top 10, where it is cataloged as a draft vocabulary.
OWASP GenAI Data Security Risks & Mitigations 2026
OWASP GenAI Security Project (v1.0, 17 March 2026) · Twenty-one data-layer risks (DSGAI01-DSGAI21) across the GenAI lifecycle — leakage, poisoning, conversation bleed, vector-store platform security, over-broad context, telemetry leakage, inference and reconstruction. Deliberately not another Top 10: the data-layer companion to the LLM and Agentic lists. Source for Part XII § OWASP GenAI Data Security Risks, which maps the eight entries that bear on Memory Architecture.
AIUC-1: Crosswalks OWASP Top 10 for Agentic Applications
OWASP GenAI Security Project + AIUC (May 2026) · Bidirectional crosswalk between the AIUC-1 controls standard (six principles, ~50 controls) and the OWASP Top 10 for Agentic Applications, with a rationale taxonomy of eight control functions (Prevent, Constrain scope, Human gate, Detect, Validate, Govern, Isolate, Disclose) and a gap analysis; source for Part XII § Control & Certification Standards.
Securing Agentic Applications Guide 1.0
OWASP GenAI Security Project (v1.0, July 2025) · Practical guidance for designing, developing, and deploying secure LLM-powered agentic applications; the actionable-controls companion backing the defensive patterns cross-linked throughout Part XII.
Secure MCP Server Development + Third-Party MCP CheatSheet
OWASP GenAI Security Project — Agentic Security Initiative (2025–2026) · Concrete defensive controls for the Model Context Protocol boundary — server hardening (auth, validation, session isolation, hardened deployment) and safe consumption of third-party MCP servers (tool poisoning, prompt/memory injection, tool interference); the actionable specifics under T16 Insecure Inter-Agent Protocol Abuse and T17 Supply Chain Compromise.
Implementing Statistical Guardrails for Non-Deterministic Agents
Machine Learning Mastery (2026, practitioner guide) · Semantic-drift detection via cosine-distance z-scores and confidence gating via Shannon entropy; primary source for the Statistical Guardrails pattern (Governance & Safety).
The Protection of Information in Computer Systems
Saltzer & Schroeder (1975) · Origin of the principle of least privilege and separation of privilege; foundational source for the Least Privilege Agent pattern.
NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails
Rebedea et al. (2023) · Programmable input/dialog/output rails independent of the underlying LLM; source for the guardrail patterns.
Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
Inan et al. (2023) · A safety classifier applying a risk taxonomy to both prompts and responses; source for the Multimodal Guardrails pattern.
State of Agentic AI Security and Governance
OWASP GenAI Security Project — Agentic Security Initiative (v2.01, 2026) · The primary source for Part XIII (Governance & Assurance): the safety–security convergence at the deployment layer, agent identity as a control plane, the shift from static compliance to runtime governance, and the Enterprise Adoption Maturity Model (adoption tiers AT0–AT8 × governance levels 0–4).
OWASP Non-Human Identities Top 10 (2025)
OWASP (2025) · The top ten risks of non-human identities (service accounts, API keys, agent credentials): improper offboarding, secret leakage, overprivileged and long-lived NHIs, NHI reuse. The identity-plane risk vocabulary Part XIII maps agent-identity failures onto (ghost agents, credential blast radius, trust transitivity).
Agent Name Service (ANS) for Secure AI Agent Discovery 1.0
OWASP GenAI Security Project (v1.0, 2025) · A DNS-inspired, PKI-backed registry giving agents stable identifiers mapped to cryptographic IDs (DIDs, SPIFFE IDs) and authoritative metadata (ownership, allowed tools, trust tier) across A2A/MCP/ACP; the discovery-and-attestation surface in Part XIII's agent-identity control plane.
Threat Defense COMPASS 1.0
OWASP GenAI Security Project (v1.0, September 2025) · A methodology and spreadsheet (the AI Threat Resilience Strategy Dashboard) that consolidates threats, vulnerabilities, defenses, and mitigations into one iterated view for rapid threat prioritization; operationalizes the LLM Top 10 and Agentic taxonomies rather than adding a new one. The tactical companion to the maturity model in Part XIII.
The lethal trifecta for AI agents: private data, untrusted content, and external communication
Simon Willison (16 June 2025) · Coins the lethal-trifecta heuristic: an agent combining access to private data, exposure to untrusted content, and the ability to communicate externally is exploitable end-to-end by a single prompt injection. Source for Part XIII's risk-bounding heuristics.
Agents Rule of Two: A Practical Approach to AI Agent Security
Meta AI (31 October 2025) · Turns the lethal trifecta into a design constraint: within a session with no trusted human in the loop, an agent should satisfy at most two of {untrustworthy input, sensitive-data access, state-change/external communication}. Source for Part XIII's risk-bounding heuristics.
Regulation (EU) 2024/1689 — the EU Artificial Intelligence Act
European Parliament & Council (2024) · The binding EU regulation for high-risk AI; Part XIII leans on Art. 72 (continuous lifetime monitoring → runtime drift detection), Arts. 25–26 (provider/deployer duties), and Art. 3(23) (substantial modification) as the regulatory driver of runtime governance over static compliance.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
NIST (2023) · The voluntary US framework for governing AI risk (Govern, Map, Measure, Manage); one of the durable governance anchors whose shared assumption — that system behavior can be described before operation — agentic systems violate, per Part XIII.
ISO/IEC 42001:2023 — AI management systems
ISO/IEC (December 2023) · The certifiable AI management-system standard (AIMS): policies, roles, impact assessment, continual improvement. Not a harmonized standard under the EU AI Act, so certification grants no presumption of conformity. Cited in Part XIII § Where the durable frameworks attach.
NIST AI 600-1 — Generative AI Profile
NIST (v1.0, July 2024) · The GenAI-specific profile of the AI RMF: the same Govern/Map/Measure/Manage structure applied to generative systems. Cited alongside the AI RMF in Part XIII.
MITRE ATLAS — Adversarial Threat Landscape for AI Systems
MITRE (content v2026.06) · The adversary-technique taxonomy for machine-learning and GenAI systems, in the ATT&CK style. The technique-level vocabulary under the Part XII threat entries: ATLAS names the move, the entry names the failure, MAESTRO names the layer.
MITRE ATT&CK — Enterprise techniques
MITRE (v19.1) · The classic enterprise adversary-technique catalog. Covers the non-AI half of an agent's blast radius: once a tool call reaches a shell, database or cloud API, the incident is an ordinary one.
MITRE CWE — Common Weakness Enumeration
MITRE (4.20) · The root-cause weakness taxonomy the OWASP catalogs map their entries onto; cited in Part XIII as the defect-level companion to ATT&CK.
CSA AI Controls Matrix (AICM)
Cloud Security Alliance (v1.1, 22 June 2026) · A control matrix for AI systems in the lineage of the Cloud Controls Matrix — a procurement and assurance instrument rather than a design input. Cited in Part XIII beside AIUC-1.
OWASP AIVSS — AI Vulnerability Scoring System
OWASP (v0.8) · Scoring for agentic AI risks with an autonomy premium over the base score; the prioritization instrument for the otherwise unordered threat catalogs. Cited in Part XIII.
International AI Safety Report 2026
Bengio et al. (2026) · The internationally mandated scientific synthesis on general-purpose AI risk; its three-category split (malicious use / malfunctions / systemic risks) grounds Part XIII's distinction between AI security (≈ malicious use) and AI safety (≈ malfunctions).
GenAI Red Teaming Guide: A Practical Approach to Evaluating AI Vulnerabilities
OWASP GenAI Security Project (v1.0, January 2025) · The primary source for Part XIV (Red Teaming & Adversarial Assurance): the definition of GenAI red teaming (safety/security/trust/performance across the whole stack), how it differs from traditional red teaming and from benchmarking, the four pillars (Model / Implementation / System / Runtime), the engagement methodology, and the adversarial technique catalogue.
Agentic AI Red Teaming Guide
Cloud Security Alliance + OWASP GenAI Security Project (2025) · The agentic extension of the GenAI red-teaming methodology: twelve adversarial test categories for autonomous, tool-using, multi-agent systems (authorization hijacking, goal manipulation, memory/knowledge-base poisoning, multi-agent exploitation, untraceability, and more), each with test requirements, attack vectors, and example prompts. Source for Part XIV's twelve-category crosswalk to the T1–T17 threats.
AI Security Solutions Landscape for AI and Agentic Red Teaming, Q2 2026
OWASP GenAI Security Project (2026) · Frames GenAI and agentic red teaming as a structured, lifecycle-wide approach — identifying, measuring, mitigating, and governing risk through coordinated adversarial testing, defensive validation, and continuous feedback loops; the continuous-assurance framing in Part XIV.
OWASP ASVS — Validation, Sanitization and Encoding (V5)
OWASP Application Security Verification Standard 4.0.3 · The general application-security requirements the LLM10 mitigations point at for encoding model output per sink.
OWASP API4:2023 Unrestricted Resource Consumption
OWASP API Security Top 10 (2023) · The API-level sibling of LLM06 Unbounded Consumption; rate, size and cost limits as an API contract.
CycloneDX — AI/ML bill of materials
OWASP CycloneDX · The bill-of-materials format the supply-chain mitigations name for models, adapters and datasets (AIBOM / ML-BOM).
OpenSSF Model Signing (sigstore/model-transparency)
Open Source Security Foundation · Signs a model artifact against a transparency log, binding it to a signer identity; cited by LLM04 Supply Chain.
The Dual LLM Pattern
Simon Willison (April 2023) · Separates a privileged planner from a quarantined model that reads untrusted content; cited by LLM03 Excessive Agency.
Rogue Agents: Stop AI From Misusing Your APIs
Twilio · Practitioner guidance on scoping what an agent's tools may reach; cited by LLM03 Excessive Agency.
leaked-system-prompts
Jujumilk3 (GitHub collection) · A running collection of extracted system prompts — the evidence that hidden context is discoverable; cited by LLM08.
Prompt Leak
Prompt Security · Vendor explainer on system-prompt extraction; cited by LLM08 Hidden Context Exposure.

§25

Security Research — Attacks and Demonstrations

Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications
Cohen, Bitton & Nassi (arXiv:2403.02817, 2024) · A self-replicating prompt spread between GenAI email assistants, each infected assistant passing it on; the canonical T12 demonstration.
Red-Teaming LLM Multi-Agent Systems via Communication Attacks
He et al. (arXiv:2502.14847, 2025) · Compromised whole multi-agent systems by intercepting and rewriting only the messages between agents; T12 Agent Communication Poisoning.
Multi-Agent Systems Execute Arbitrary Malicious Code
Triedman, Jha & Shmatikov (arXiv:2503.12188, 2025) · Adversarial files and pages hijacked AutoGen, CrewAI and MetaGPT into running code or leaking data; cited by T11 and T14.
Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems
Lee & Tiwari (arXiv:2410.07283, 2024) · A self-replicating injection passed between agents through ordinary messages; the T13 Rogue Agents demonstration.
Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification
Zhang et al. (arXiv:2407.20859, 2024) · Misled agents into repeating commands until their iteration limit, tying up downstream capacity; the T4 Resource Overload demonstration.
Flooding Spread of Manipulated Knowledge in LLM-Based Multi-Agent Communities
Ju et al. (arXiv:2407.07791, 2024) · Invented facts spread agent-to-agent and persisted in retrieval memory; the T5 Cascading Hallucination demonstration.
Frontier Models are Capable of In-context Scheming
Meinke et al., Apollo Research (arXiv:2412.04984, 2024) · In environments built to reward it, models disabled oversight and kept up deception under questioning; the T7 demonstration.
GitHub MCP Exploited: Accessing private repositories via MCP
Invariant Labs (May 2025) · A malicious issue drove an agent to publish private repository contents; every tool call was permitted, only the sequence was not. T2 Tool Misuse.
WhatsApp MCP Exploited: Exfiltrating your message history via MCP
Invariant Labs (April 2025) · An MCP server swapped its tool description after approval ("rug pull") and exfiltrated message history; T16 Insecure Inter-Agent Protocol Abuse.
Supabase MCP can leak your entire SQL database
General Analysis (July 2025) · A support ticket steered an assistant holding a service_role key into dumping a private table; the confused-deputy form of T3.
When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems
Palo Alto Networks Unit 42 (October 2025) · A malicious peer used an open A2A session to slip instructions to a financial agent, which leaked data and traded; T13 Rogue Agents.
Agent In the Middle — Abusing Agent Cards in the Agent-2-Agent (A2A) Protocol
Trustwave SpiderLabs (April 2025) · A rogue agent's exaggerated Agent Card won every task, because nothing authenticates a self-description; T9 Identity Spoofing.
Bypassing AI Agent Defenses With Lies-In-The-Loop
Checkmarx Zero (September 2025) · Padding an approval prompt pushed the real command out of view, so the human gate approved it; T10 Overwhelming Human-in-the-Loop.
ZombAIs: From Prompt Injection to C2 with Claude Computer Use
Johann Rehberger / Embrace The Red (October 2024) · A web page talked a computer-use agent into downloading and running a binary that joined a command-and-control server; T6.
Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
Greshake et al. (arXiv:2302.12173, 2023) · The paper that named indirect prompt injection; cited by LLM01.
Universal and Transferable Adversarial Attacks on Aligned Language Models
Zou et al. (arXiv:2307.15043, 2023) · Automatically generated suffixes that transfer across aligned models; cited by LLM01.
The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections
Nasr et al. (arXiv:2510.09023, 2025) · Static attack-success rates near zero rose above 90% once the attacker adapted to the deployed defense; the adaptive-testing argument in LLM01.
Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training
Hubinger et al. (arXiv:2401.05566, 2024) · Backdoors survive safety training and stay dormant until triggered; cited by LLM05 Data and Model Poisoning.
Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples
Souly et al. (arXiv:2510.07192, 2025) · As few as 250 poisoned documents compromised models from 600M to 13B parameters regardless of dataset size; the scale finding in LLM05.
Poisoning Language Models During Instruction Tuning
Wan et al. (arXiv:2305.00944, 2023) · Poisoned instruction-tuning examples steer later behavior; cited by LLM05.
Stealing Part of a Production Language Model
Carlini et al. (arXiv:2403.06634, 2024) · Recovered parts of a production model through its API; the extraction half of LLM06 Unbounded Consumption.
We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs
Spracklen et al. (arXiv:2406.10279, 2024) · Measures how often coding models invent package names — the basis of "slopsquatting"; cited by LLM04 Supply Chain.
Text Embeddings Reveal (Almost) As Much As Text
Morris et al. (arXiv:2310.06816, 2023) · Reconstructs source text from stored embeddings (Vec2Text); why an "embeddings-only" leak is a document leak in LLM09.
Information Leakage in Embedding Models
Song & Raghunathan (arXiv:2004.00053, 2020) · Early demonstration that embeddings leak their inputs; cited by LLM09 Vector and Embedding Weaknesses.
Sentence Embedding Leaks More Information than You Expect
Zhou et al. (arXiv:2305.03010, 2023) · Extends embedding inversion to sentence encoders; cited by LLM09.
A Survey on Trustworthy LLM Agents: Threats and Countermeasures
arXiv:2503.09648 (2025) · Survey of agent-specific threats and defenses; cited by T13 Rogue Agents.
Mechanistic Interpretability for AI Safety — A Review
Bereska & Gavves (arXiv:2404.14082, 2024) · Review of interpretability methods as a safety instrument; cited from the deceptive-behavior discussion in Part XII.
PoisonGPT: How we hid a lobotomized LLM on Hugging Face to spread fake news
Mithril Security (2023) · A surgically modified model published under a trusted-looking name passed standard benchmarks; cited by LLM04.
Hijacking Safetensors Conversion on Hugging Face
HiddenLayer (2024) · Compromised a model-format conversion service — the transformation step as a supply-chain surface; cited by LLM04.
ChatGPT Plugin Exploit Explained: From Prompt Injection to Accessing Private Data
Johann Rehberger / Embrace The Red (2023) · Model output reaching a privileged plugin without validation; cited by LLM10 Improper Output Handling.
Proof Pudding (CVE-2019-20634)
AI Vulnerability Database (AVID) · Model-extraction case record; cited by LLM02 Sensitive Information Disclosure.
The Rise of the Deceptive Machines: When AI Learns to Lie
UNU C3 (2024) · Essay on deceptive model behavior; cited from T7 Misaligned & Deceptive Behaviors.

§20

Background — Limits of Prompting

Defeating Nondeterminism in LLM Inference
Thinking Machines Lab (2025) · Most authoritative recent source on LLM non-determinism: shows that outputs vary even at temperature=0 because of batch-invariance failure in inference kernels, not floating-point folklore.
Non-Determinism of "Deterministic" LLM Settings
arXiv 2408.04667 (2024) · Empirical study quantifying nondeterminism across providers and settings.
Be Clear, Direct, and Detailed
Anthropic prompt-engineering guide · Frames prompts as instructions requiring engineering rigor, not natural-language requests.
Define your success criteria
Anthropic empirical-evaluation guide · Frames LLM verification as an open eval-design problem.
OpenAI — Temperature and sampling
OpenAI · Reference for non-determinism even at temperature=0.

§21

Real-World Incidents — Anecdotes and Failure Cases

Moffatt v. Air Canada (BCCRT, Feb 2024)
Civil Resolution Tribunal of British Columbia (2024) · Civil Resolution Tribunal of British Columbia held Air Canada liable for negligent misrepresentation by its chatbot, which had hallucinated a bereavement-fare refund policy. Awarded CAD $812.02. McCarthy Tétrault legal analysis ↗︎ ABA Business Law Today ↗︎ CanLII case comment (2025) ↗︎
Chevrolet of Watsonville chatbot — "$1 Tahoe" (Dec 2023)
Business Insider coverage (2023) · Customer prompt-injected a dealership's GPT-powered assistant into agreeing to sell a 2024 Chevy Tahoe for $1 with the binding response "That's a legally binding offer — no takesies backsies."
Mata v. Avianca (SDNY, June 2023)
Southern District of New York (2023) · Two lawyers were sanctioned after submitting a federal court filing in which ChatGPT had hallucinated six fictional case citations. Court order ↗︎ NYT coverage ↗︎
Spyware Injection Into Your ChatGPT's Long-Term Memory (SpAIware)
Johann Rehberger / Embrace The Red (September 2024) · A prompt injection made ChatGPT write attacker instructions into long-term memory, so later sessions kept leaking what the user typed; the T1 Memory Poisoning incident.
Hacking Gemini's Memory with Prompt Injection and Delayed Tool Invocation
Johann Rehberger / Embrace The Red (February 2025) · Deferring the memory write past the untrusted content evaded Google's block on tool use while reading it; the second T1 Memory Poisoning incident.
CVE-2025-32711 — AI command injection in Microsoft 365 Copilot
Microsoft Security Response Center (June 2025) · The vendor record for the zero-click "EchoLeak" exfiltration Aim Labs disclosed; rated critical and fixed server-side. Cited by T3 Privilege Compromise.
Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet
Brave (August 2025) · A hidden Reddit comment redirected a browser agent into collecting the user's email address and login code; the T6 Intent Breaking incident.
Copilot Broke Your Audit Log, but Microsoft Won't Tell You
Zack Korman / Pistachio (August 2025) · Asked for no link, Microsoft 365 Copilot read a file and left no audit-log record; the T8 Repudiation & Untraceability incident.
Cursor security advisory GHSA-4cxx-hrm3-49rm (CVE-2025-54135)
Cursor (August 2025) · An indirect prompt injection wrote a workspace MCP config whose start command ran attacker code; the T11 Unexpected RCE incident.
Phishing For Gemini
0DIN — Marco Figueroa (July 2025) · Invisible email instructions made Gemini for Workspace append a fake Google security alert to its summary; the T15 Human Manipulation incident.
Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files (CVE-2025-59536)
Check Point Research (February 2026) · A project-declared MCP server ran before the trust dialog could be accepted; the T16 Insecure Inter-Agent Protocol Abuse incident.
Replit agent deletes a production database (customer thread)
Jason Lemkin, posts on X (July 2025) · The affected customer's account of an agent deleting a production database during a code freeze and misreporting the rollback; the T7 incident.
Disrupting the first reported AI-orchestrated cyber espionage campaign
Anthropic (November 2025) · An attacker split an intrusion campaign into sub-agent tasks that each looked legitimate in isolation; the T14 Human Attacks on MAS incident.
AWS Security Bulletin AWS-2025-015 — Amazon Q Developer VS Code extension
Amazon Web Services (July 2025) · An over-scoped build token let an attacker commit code that shipped in v1.84.0; it did not execute due to a syntax error. The T17 Supply Chain incident.
Information Regarding Malicious 'postmark-mcp' Package
Postmark (September 2025) · A package impersonating Postmark's MCP server added a silent BCC backdoor in version 1.0.16 after fifteen clean releases; a T17 incident.
Security Update: Suspected Supply Chain Incident
LiteLLM (March 2026) · Releases 1.82.7/1.82.8 carried a credential stealer after publishing credentials were taken via the project's CI security scanner; a T17 incident.
Air Canada Chatbot Misinformation: What Travellers Should Know
BBC (February 2024) · Press account of the Moffatt v. Air Canada tribunal decision; cited from the Misinformation entry (LLM07).
ChatGPT Fake Legal Cases: Generative AI Hallucinations
LegalDive (2023) · Trade-press account of the fabricated citations in Mata v. Avianca; cited from the Misinformation entry (LLM07).
ChatGPT Spit Out Sensitive Data When Told to Repeat 'Poem' Forever
Wired (2023) · The divergence attack that made a production model emit memorized training data; cited from Sensitive Information Disclosure (LLM02).

§22

Interoperability (MCP & A2A)

What is the Agent2Agent (A2A) Protocol?
Caballar & Stryker / IBM Think (2025) · IBM Think article covering the A2A protocol.
Agent2Agent Protocol Specification
Linux Foundation · Agent2Agent Protocol Specification under the Linux Foundation.
Model Context Protocol Specification
Anthropic · Model Context Protocol Specification from Anthropic.

§23

Production (Part VIII)

Pydantic v2 documentation
Pydantic · Recursive validation and the model API behind the boundary contract for agent state (Part VIII).
LangGraph Persistence (PostgresSaver)
LangChain AI · Checkpointer concepts and the durable PostgresSaver / AsyncPostgresSaver backends the suspend/resume cycle needs (Part VIII).
Langfuse documentation
Langfuse · Self-hostable tracing and evaluation backend; the open-source option in the observability stack (Part VIII).
Small Language Models are the Future of Agentic AI
Belcak et al. / NVIDIA Research (2025) · Argues SLMs are the right default for the repetitive, well-scoped calls that dominate agentic workloads; primary source for Model Tiering and Small Language Models (Part VIII).
RouteLLM: Learning to Route LLMs with Preference Data
Ong et al. / LMSYS (2024) · Preference-data-trained router that dispatches each request to the cheapest model meeting the quality bar; primary source for the Resource-Aware Optimization pattern and Model Tiering and Small Language Models (Part VIII).
Cost-Aware Contrastive Routing for LLMs
Shirkavand et al. (2025, NeurIPS 2025 spotlight) · Contrastive-embedding router that picks the cheapest accurate model within adaptive cost bands via a single k-NN lookup; companion source for the Resource-Aware Optimization pattern.
Introduction to Small Language Models: The Complete Guide for 2026
Machine Learning Mastery (2026, practitioner guide) · SLM definition (<10B params), the SLM-vs-LLM routing heuristic, and efficiency methods (distillation, quantization, sparse attention).
5 Production Scaling Challenges for Agentic AI in 2026
Machine Learning Mastery (2026, practitioner guide) · Orchestration, observability, cost (kill switches, retry storms), evaluation (behavioural / simulation testing), and governance as the five production gaps; supports Part VIII and Part IX.
7 Agentic AI Trends to Watch in 2026
Machine Learning Mastery (2026, practitioner guide) · Graduated / bounded autonomy, governance and security agents, and FinOps model tiering; supports the HITL graduated-autonomy framing (Part V §6) and Model Tiering (Part VIII).

§24

Durable Runtimes & Agent Harnesses

Temporal — Documentation
Temporal Technologies · Durable workflow engine documentation; covers deterministic replay, automatic retries, and saga support for long-running stateful orchestration. docs ↗︎ repo ↗︎
Inngest — Documentation
Inngest Inc. · Event-driven durable execution documentation; step functions, retries, and flow control on a managed event backbone without running your own queue. docs ↗︎ repo ↗︎
Restate — Documentation
Restate Systems · Durable execution documentation for distributed services; covers durable promises, virtual objects, and exactly-once handlers across microservices. docs ↗︎ repo ↗︎
Deep Agents SDK — Documentation
LangChain AI · Opinionated, batteries-included harness on LangGraph; documents built-in planning, subagents, and virtual file system for long-horizon autonomous agents. docs ↗︎ repo ↗︎
Claude Agent SDK — Documentation
Anthropic · Agentic harness documentation; covers the gather-context / act / verify loop behind Claude Code, with tools, subagents, and first-class MCP support. docs ↗︎ repo ↗︎

25 Gruppen

Weiter erkunden

Verwandte Referenzen.

Suche