Multi‑Agent Systems

Reference

Sources

The bibliography behind the reference, slides, webapp, and code — every paper, documentation page, and essay that informs the project. 257 entries across 25 groups.

257 sources

§1

Pattern Taxonomies and Surveys

14

Sources that catalogue, classify, or survey agent / multi-agent patterns. Useful background for our four-domain taxonomy (Thinking / Flow / Collaboration / System Operation).

  • Agent Design Pattern Catalogue: A Collection of Architectural Patterns for Foundation Model based Agents

    Liu et al., Journal of Systems and Software (2024) · Peer-reviewed catalogue of 18 architectural patterns grouped by lifecycle phase (goal creation, reflection, collaboration, accountability). The most authoritative academic catalogue of agent patterns as a concept. arXiv ↗︎ Journal version (Elsevier) ↗︎

  • Multi-Agent Collaboration Mechanisms: A Survey of LLMs

    Tran et al. (2025) · Comprehensive survey of coordination patterns; directly underpins our Collaboration domain.

  • A survey on LLM-based multi-agent systems: workflow, infrastructure, and challenges

    Springer Vicinagearth (2024) · Three-pillar taxonomy; their workflow maps to our Flow and their infrastructure to our System Operation.

  • A Taxonomy of Hierarchical Multi-Agent Systems: Design Patterns, Coordination Mechanisms, and Industrial Applications

    arXiv (2025) · Five-axis taxonomy (control hierarchy, information flow, role/task delegation, temporal hierarchy, communication structure) — orthogonal drill-down into the Collaboration domain.

  • Large Language Model Agent: A Survey on Methodology, Applications and Challenges

    arXiv (2025) · Methodology-centred taxonomy organised around construction, collaboration, and evolution.

  • Microsoft Azure — AI Agent Orchestration Patterns

    Microsoft · Vendor-published practitioner taxonomy; splits single-agent vs. multi-agent then sub-patterns.

  • Google Cloud — Choose a design pattern for your agentic AI system

    Google · Decision-tree-style pattern guide; closer in spirit to our webapp Decision Guide than to the taxonomy itself.

  • Databricks — Agent system design patterns

    Databricks · Sequential, parallel, supervisor, hierarchical — practitioner-grade patterns covering Flow + Collaboration.

  • Agent design patterns

    Lance Martin / LangChain (blog, 2026) · Recent practitioner synthesis from a LangChain maintainer.

  • Agentic Design Patterns

    Antonio Gulli (book; Google engineer; ~400 pp; 21 patterns, MCP excluded) · Practitioner catalogue — each pattern with TL;DR, use, pros/cons, examples. Largely re-frames patterns this project already catalogues across Domains 1–4; primary source for the Exploration & Discovery and Resource-Aware Optimization entries.

  • Mark Kashef — "Master ALL 20 Agentic AI Design Patterns"

    Mark Kashef (video, 2024) · Hour-long plain-language summary of Gulli's book; secondary aid.

  • Top Agentic AI Frameworks

    Omdena (blog, 2024) · Practitioner survey of leading agentic frameworks with use-case guidance.

  • Agentic AI Frameworks: Benchmark

    AIMultiple (2026) · Measures end-to-end latency and token consumption for LangGraph, LangChain, AutoGen, and CrewAI across five tasks and 2,000 runs; the primary source behind the framework-performance claims in Part VII.

  • Agentic AI Framework Comparison

    Moxo (blog, 2026) · Vendor comparison of agentic frameworks; restates AIMultiple's benchmark on latency and token usage rather than running its own.

§2

Agent Autonomy and Control Axes

9

Sources that frame agent systems along an autonomy axis (workflow → agent; how much the LLM decides on its own) and a control axis (centralized → distributed coordination). Underpins the 2-axis pattern map and any framing that positions systems on a spectrum.

  • Building Effective Agents

    Anthropic (2024) · Anchors the spectrum: "A system is more agentic the more an LLM decides how the system can behave." Workflows (predefined code paths) vs. agents (LLM dynamically directing).

  • What is an AI agent?

    LangChain blog · Proposes agent autonomy as a spectrum; explicitly draws the SAE autonomous-vehicle L0–L5 analogy.

  • How to think about agent frameworks

    LangChain blog · Uses the autonomy axis to compare frameworks; closest external precedent for ranking systems along it on a chart.

  • Workflows and agents

    LangChain docs · Formalises the workflow ↔ agent distinction and where Router / Tool-calling / ReAct sit on the spectrum.

  • A Survey of Multi-Agent Organizational Paradigms

    Horling & Lesser, The Knowledge Engineering Review (2004) · Canonical pre-LLM survey of how agent collections are organized — hierarchies, holarchies (holons), coalitions, teams, congregations, societies, federations, markets, and matrix forms — with their coordination costs and trade-offs. The authoritative source for the organizational-paradigm vocabulary underneath the centralized → distributed control axis.

  • Multi-Agent Collaboration Mechanisms: A Survey of LLMs

    Tran et al. (2025) · Explicit centralized / decentralized / hybrid taxonomy of coordination structures. Already cited in Pattern Taxonomies and Surveys.

  • What Is Agentic Architecture?

    IBM · Practitioner-grade explanation of centralized vs. distributed agent coordination.

  • Single-agent and multi-agent architectures

    Microsoft Dynamics 365 docs · Vendor mapping of supervisor / decentralized / hybrid models.

  • Centralized vs. Distributed Agent Collaboration Models

    Auxiliobits (practitioner blog) · Side-by-side trade-off summary.

§3

Conceptual Essays and Practitioner Guides

7

  • Building Effective Agents

    Anthropic (2024) · Workflows vs. agents and the canonical composable patterns (prompt chaining, routing, parallelization, orchestrator-workers, evaluator-optimizer).

  • A Practical Guide to Building Agents

    OpenAI (2024) · Pragmatic introduction to agent design choices, tools, and guardrails (PDF).

  • How we built our multi-agent research system

    Anthropic Engineering (2025) · Production lessons on orchestrator-worker MAS, parallelism, and reliability.

  • Don't Build Multi-Agents

    Cognition AI (2024, opinion) · Counter-position arguing single-agent loops often beat MAS; useful for the anti-pattern section.

  • Agentic Design Patterns, Part 1: Reflection

    Andrew Ng / DeepLearning.AI (2024, blog) · Practitioner overview of the reflection / self-critique loop as a foundational agentic pattern.

  • Agentic Design Patterns: A System-Theoretic Framework

    Dao et al. (2025) · Twelve-pattern system-theoretic framework (Integrator, Retriever, Recorder, Selector, Planner, Deliberator, Executor, Tool Use, Coordinator, Reflector, Skill Build, Controller); primary source for Part VI of the knowledge base.

  • Understanding the Agentic Reasoning Loop

    Digital Bricks (2026, blog) · Accessible vendor-blog restatement of the four-phase reasoning loop (Think / Act / Observe / Reflect) and supporting framing for Part VI's runtime-loop preamble. Also references Microsoft Copilot Studio's "enhanced task completion" as a productized form of the loop. Higher-level than the Dao et al. framework above; useful as introductory reading.

§4

Foundational Papers — Reasoning and Thinking Patterns

18

Primary papers behind the Domain-1 thinking patterns.

  • ReAct: Synergizing Reasoning and Acting in Language Models

    Yao et al. (2022) · Origin of interleaved reasoning + tool calls.

  • Toolformer: Language Models Can Teach Themselves to Use Tools

    Schick et al. (2023) · A model learns which API to call, when, with what arguments, and how to fold the result back in; foundational source for the Function Calling pattern.

  • Gorilla: Large Language Model Connected with Massive APIs

    Patil et al. (2023) · Selecting the right call from a large, changing catalogue of APIs; source for the Tool Registry and Capability Routing patterns.

  • Self-Consistency Improves Chain-of-Thought Reasoning in Language Models

    Wang et al. (2022) · Sample-and-vote aggregation over CoT.

  • Plan-and-Solve Prompting

    Wang et al. (2023) · Two-phase plan-then-execute prompting baseline.

  • Understanding the Planning of LLM Agents: A Survey

    Huang et al. (2024) · Survey of planning approaches in LLM agents; primary reference for the Plan-and-Execute pattern.

  • ReWOO: Decoupling Reasoning from Observations

    Xu et al. (2023) · Plans tool calls up front to cut token cost.

  • Reflexion: Language Agents with Verbal Reinforcement Learning

    Shinn et al. (2023) · Self-critique loop for iterative improvement.

  • Tree of Thoughts: Deliberate Problem Solving with LLMs

    Yao et al. (2023) · Search over branching reasoning paths.

  • Executable Code Actions Elicit Better LLM Agents (CodeAct)

    Wang et al. (2024) · Code as the action interface for agents.

  • Chain-of-Thought Prompting Elicits Reasoning in Large Language Models

    Wei et al. (2022) · Antecedent for most "thinking" patterns.

  • Designing LLM Chains by Adapting Techniques from Crowdsourcing Workflows

    Grunde-McLaughlin et al. (2025) · Practitioner-grade reference for the Sequential Pipeline (prompt chaining) pattern.

  • PromptChainer: Chaining Large Language Model Prompts through Visual Programming

    Wu et al. (2022) · Visual-programming approach to composing LLM prompt chains; referenced in the L2 rung.

  • AI Chains: Transparent and Controllable Human-AI Interaction by Chaining LLM Prompts

    Wu et al. (2022) · Foundational prompt-chaining paper showing transparency and control benefits; referenced in the L2 rung.

  • DSPy: Compiling Declarative Language Model Calls into Self-Improving Pipelines

    Khattab et al. (2023) · Automated optimization of LLM prompt pipelines; referenced in the L2 rung.

  • Self-Refine: Iterative Refinement with Self-Feedback

    Madaan et al. (2023) · Self-critique and iterative improvement loop; primary source for the Evaluator-Optimizer and Iterative Refinement patterns.

  • From Decoding to Meta-Generation: Inference-time Algorithms for Large Language Models

    Welleck et al. (2024) · Survey of inference-time strategies including sampling, search, and self-correction; referenced in the L2 rung.

  • FlowForge: Guiding the Creation of Multi-agent Workflows

    Hao et al. · Workflow-design tool cited under Parallelization (Sectioning / Voting).

§5

Foundational Papers — Multi-Agent Coordination

15

  • A Universal Modular Actor Formalism for Artificial Intelligence

    Hewitt, Bishop & Steiger (1973) · Introduced the Actor model of concurrent computation: independent agents that communicate solely by asynchronous message passing; foundational precursor to modern multi-agent message-based coordination.

  • A Blackboard Architecture for Control

    Barbara Hayes-Roth (1985) · Historical root of shared-state coordination between specialists.

  • Improving Factuality and Reasoning via Multiagent Debate

    Du et al. (2023) · Foundational paper for the Multi-Agent Debate pattern.

  • ChatEval: Towards Better LLM-based Evaluators through Multi-Agent Debate

    Chan et al. (2023) · Debate-as-evaluation method; cited under the Multi-Agent Debate pattern.

  • Encouraging Divergent Thinking in Large Language Models through Multi-Agent Debate

    Liang et al. (2023) · Shows that societally diverse agent personas improve debate quality; referenced in the L3 rung.

  • Magentic-One: A Generalist Multi-Agent System for Solving Complex Tasks

    Fourney et al. / Microsoft Research (2024) · Composite orchestration with planning ledger and replanning.

  • GPTSwarm: Language Agents as Optimizable Graphs

    Zhuge et al. (2024) · Agent coordination modelled as executable, learnable state graphs; cited under Graph-based Orchestration.

  • Blackboard Systems

    Engelmore & Morgan (eds.) (1988) · Canonical edited volume on the Blackboard architectural pattern; primary textbook reference for shared-workspace coordination cited in the L3 rung.

  • The Contract Net Protocol: High-Level Communication and Control in a Distributed Problem Solver

    Smith (1980) · Historical root of market-based task allocation between agents; origin of the Contract Net coordination pattern.

  • AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation

    Wu et al. (2023) · Conversation-centric MAS framework paper.

  • MetaGPT: Meta Programming for a Multi-Agent Collaborative Framework

    Hong et al. (2023) · Role-based crew metaphor / SOPs for agent teams.

  • The Anatomy of Autonomy: Why Agents are the Next AI Killer App after ChatGPT

    Lilian Weng / OpenAI blog (2023) · Influential write-up of the agent loop (planning, memory, tool use).

  • An Introduction to MultiAgent Systems, 2nd Edition

    Michael Wooldridge (Wiley, 2009) · Standard academic textbook on MAS; covers coordination, communication, and cooperation in classical (pre-LLM) terms. Author page ↗︎ Publisher ↗︎

  • Deep Research Agents: A Systematic Examination and Roadmap

    Huang et al. (2025) · Systematic survey of deep-research-agent architectures — planning, tool use, and report synthesis; primary source for the Exploration & Discovery pattern.

  • Self-Optimizing Multi-Agent Systems for Deep Research

    Câmara et al. / Zeta Alpha (2026) · A deep-research orchestrator-worker system that reasons over its own traces and refines its prompts with self-feedback; companion source for the Exploration & Discovery pattern.

§6

Retrieval, Memory, and Evaluation

18

  • Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (RAG)

    Lewis et al. (2020) · Origin of RAG as a memory pattern.

  • Agentic Retrieval-Augmented Generation: A Survey on Agentic RAG

    Singh et al. (2025) · Survey of RAG where the agent decides whether, when, and how to retrieve, reformulates queries, and grades results. Primary source for the Agentic RAG pattern (Tool Integration).

  • Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflection

    Asai et al. (2023) · Trains a model to decide when to retrieve and to self-critique retrieved passages; close relative of Agentic RAG.

  • Corrective Retrieval Augmented Generation (CRAG)

    Yan et al. (2024) · Adds a lightweight retrieval evaluator that scores evidence and triggers correction (re-retrieval, web fallback); cited as an Agentic RAG variant.

  • From Local to Global: A Graph RAG Approach to Query-Focused Summarization (GraphRAG)

    Edge et al. / Microsoft (2024) · Builds a hierarchical knowledge graph for multi-hop, corpus-spanning questions; cited as an Agentic RAG variant.

  • RAPTOR: Recursive Abstractive Processing for Tree-Organized Retrieval

    Sarthi et al. (2024) · Recursively clusters and summarises chunks into a multi-level retrieval tree; cited as an Agentic RAG variant.

  • Beyond Vector Search: 5 Next-Gen RAG Retrieval Strategies

    Machine Learning Mastery (2026, practitioner guide) · Survey of GraphRAG, Agentic RAG, Self-RAG, CRAG, and RAPTOR; source for the Agentic RAG named-variants note.

  • 7 Steps to Mastering Memory in Agentic AI Systems

    Machine Learning Mastery (2026, practitioner guide) · The RAG-vs-agent-memory distinction (read-only/content vs read-write/user) and storage-technology selection; source for the Memory Architecture preamble and storage-selection note.

  • MemGPT: Towards LLMs as Operating Systems

    Packer et al. (2023) · Hierarchical memory for long-running agents; primary source for the Virtual Context Management pattern.

  • Cognitive Architectures for Language Agents (CoALA)

    Sumers et al. (2023) · Formalises agent memory as short-term working memory plus long-term episodic, semantic, and procedural stores; the taxonomy underlying the Memory Architecture subdomain.

  • Generative Agents: Interactive Simulacra of Human Behavior

    Park et al. (2023) · Natural-language memory stream retrieved by a recency + importance + relevance score, with reflection; primary source for the Episodic Memory pattern.

  • Voyager: An Open-Ended Embodied Agent with Large Language Models

    Wang et al. (2023) · An ever-growing skill library of executable code stored and retrieved for reuse; primary source for the Skill Build (procedural memory) pattern.

  • Agent memory framework landscape (2026)

    Machine Learning Mastery (2026, practitioner survey) · Practitioner survey of dedicated memory layers: Letta (the MemGPT lineage), Mem0, Zep, Cognee (knowledge-graph memory), plus the LangChain and LlamaIndex memory modules. Source for the concrete-framework mentions in the Memory Architecture subdomain.

  • Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena

    Zheng et al. (2023) · Reference paper for LLM-as-Judge evaluation; documents position and verbosity bias in model judges.

  • G-Eval: NLG Evaluation using GPT-4 with Better Human Alignment

    Liu et al. (2023) · Chain-of-thought + form-filling judging paradigm; also documents the judge's bias toward LLM-generated text.

  • LLM Evaluators Recognize and Favor Their Own Generations

    Panickssery et al. (2024) · Self-preference bias: an LLM judge scores its own outputs higher than humans do, correlated with self-recognition.

  • Ragas — Evaluation framework for LLM applications

    Ragas · Reference-free RAG/agent metrics (faithfulness, context precision/recall, answer relevancy).

  • DeepEval — LLM evaluation framework

    Confident AI · Pytest-native, CI/CD-oriented evaluation with a broad metric library spanning RAG and agents.

§7

Framework Documentation — LangGraph

13

  • LangGraph — Low-level concepts (State, Nodes, Edges, Conditional Edges)

    LangChain AI · Canonical vocabulary for state-driven agent graphs.

  • LangGraph — Human-in-the-Loop (interrupt / resume / Command)

    LangChain AI · First-class halt points and resumability.

  • LangGraph — Persistence & Checkpointing

    LangChain AI · Shared state across nodes and runs.

  • LangGraph — Multi-agent supervisor

    LangChain AI · Canonical supervisor pattern implementation.

  • LangGraph — Hierarchical agent teams

    LangChain AI · Reference for the Hierarchical Supervisor pattern.

  • LangGraph — Swarm / handoffs

    LangChain AI · Decentralized handoff coordination.

  • LangGraph — Recursion limit

    LangChain AI · Bounds for unbounded loops.

  • LangGraph — PostgresSaver checkpointer

    LangChain AI · Production-grade checkpointer; replaces SqliteSaver under concurrency.

  • LangChain — Frameworks, runtimes, and harnesses

    LangChain AI · Three-layer stack model (Framework / Runtime / Harness) for categorizing agent tooling. Vendor-origin and explicitly exploratory — the companion blog post concedes the categories are fuzzy; the project frames it as a contested lens (see KB Part III). Primary source for the stack-layer concept used in Block 4 and Cross-Cutting View 3.

  • Agent Frameworks, Runtimes, and Harnesses, oh my!

    LangChain blog (Harrison Chase) · The companion post that introduces the split and openly admits "there is still murkiness and overlap." Cited as evidence the taxonomy is exploratory, not settled.

  • The AI Agent Stack in 2026

    The Nuanced Perspective (A. Reganti) · Counter-grouping that classifies CrewAI, AutoGen, Google ADK and the OpenAI Agents SDK as runtimes, using a bipartite runtime/harness split. Cited as evidence the framework↔runtime boundary is contested.

  • LangGraph — GitHub repository

    LangChain AI · Source code and issue tracker.

  • LangGraph: Building Stateful, Multi-Actor Applications with LLMs

    LangChain AI (blog, 2024) · Original launch post introducing LangGraph's stateful graph model; referenced in the L4 rung.

§8

Framework Documentation — AutoGen / AG2

4

  • AutoGen — GroupChat / message-passing design pattern

    Microsoft · Conversation-first coordination model.

  • AutoGen documentation home

    Microsoft · Framework concepts, agents, and orchestration.

  • AG2 (community fork of AutoGen)

    AG2 maintainers · Active community fork referenced in framework comparison.

  • AG2 — GitHub repository

    AG2 maintainers · Source code and issue tracker.

§9

Framework Documentation — CrewAI

3

  • CrewAI — Flows (state, listeners, routers)

    CrewAI · Flow-based analogue to the graph vocabulary.

  • CrewAI — Crews and roles

    CrewAI · Role-based "crew" abstraction.

  • CrewAI — GitHub repository

    CrewAI · Source code and issue tracker.

§10

Framework Documentation — Google ADK

3

  • Google ADK — Workflow agents (Sequential / Parallel / Loop)

    Google · Composable workflow primitives.

  • Google ADK — Overview

    Google · Apache 2.0 agent dev kit, Gemini-first but model-agnostic.

  • Google ADK — GitHub repository

    Google · Source code and issue tracker.

§11

Framework Documentation — AWS Strands

3

  • AWS Strands Agents — Introducing post

    AWS Open Source Blog (2025) · Model-driven loop, three-line agent example.

  • Strands Agents documentation

    AWS · Concepts, model-driven loop, AWS integrations.

  • Strands Agents — GitHub repository

    AWS · Source code and issue tracker.

§12

Framework Documentation — OpenAI Agents SDK / Swarm

3

  • OpenAI Agents SDK

    OpenAI · Successor to the experimental Swarm framework; handoff primitives.

  • OpenAI Agents SDK — GitHub repository

    OpenAI · Source code and issue tracker.

  • OpenAI Swarm (experimental, archived)

    OpenAI · Original handoff-based swarm reference implementation.

§13

Framework Documentation — Pydantic AI

3

  • Pydantic AI — Documentation home

    Pydantic / Samuel Colvin · Concepts, agents, RunContext dependency injection, structured output, and Logfire integration.

  • Pydantic AI — GitHub repository

    Pydantic · Source code and issue tracker.

  • Pydantic AI — Harness overview

    Pydantic · The optional capability library ("the batteries for your agent"): context management, guardrails, filesystem, code execution, multi-agent orchestration, shipped as a separate package whose capabilities graduate into core once stable. Cited in Part III (contested-lens note) and Part VII as evidence the "harness" label is overloaded.

§14

Framework Documentation — LlamaIndex

2

  • LlamaIndex — Documentation home

    LlamaIndex · Data connectors, indexing, query engines, and agent workflows; hub for the LlamaHub connector ecosystem.

  • LlamaIndex — GitHub repository

    LlamaIndex · Source code and issue tracker.

§15

Framework Documentation — Semantic Kernel / Microsoft Agent Framework

3

  • Semantic Kernel — Documentation home

    Microsoft · Skills (plugins), planners, multi-language SDK (C#/Python/Java), and Azure-aligned governance.

  • Microsoft Agent Framework — Overview

    Microsoft · Unified successor to Semantic Kernel and AutoGen; converging roadmap for enterprise agentic systems.

  • Semantic Kernel — GitHub repository

    Microsoft · Source code and issue tracker.

§16

Framework Documentation — LangChain4j

2

  • LangChain4j — Documentation home

    LangChain4j maintainers · Java/Kotlin LLM abstractions (AiServices, chains, tools, RAG), Spring Boot and Quarkus integrations, and MCP module.

  • LangChain4j — GitHub repository

    LangChain4j maintainers · Source code and issue tracker.

§17

Protocols — Tool Use and Inter-Agent Communication

13

  • Model Context Protocol (MCP) — Specification

    Anthropic / MCP working group · Open standard for agent ↔ tool integration.

  • Function calling — OpenAI docs

    OpenAI · Reference for the tool-calling primitive shared across providers.

  • A2A Protocol — Announcing the Agent2Agent Protocol

    Google (2025) · Open standard for agent ↔ agent communication.

  • A2A Protocol — Specification

    A2A maintainers · Agent card, message exchange, framework neutrality.

  • Was ist das Agent2Agent-(A2A-)Protokoll?

    Caballar & Stryker / IBM Think (2025) · German-language IBM Think explainer covering both MCP and A2A; cited under MCP in the Tool Integration subdomain.

  • ACP (Agent Communication Protocol) — merged into A2A

    IBM / BeeAI · The former REST-native agent-to-agent messaging specification has merged into A2A under the Linux Foundation; the welcome page carries the notice and migration guide.

  • AGNTCY (Agent Connect) — Project home

    AGNTCY collective (Cisco) · Directories, identity, and discovery for cross-organization agent cooperation.

  • ANP (Agent Network Protocol) — Project home

    open source · Decentralized agent identity and discovery on W3C DIDs.

  • AG-UI — Documentation

    CopilotKit · Event-streamed protocol standardizing agent-to-front-end communication.

  • AP2 — Protocol home

    Google · 60+ partners · Agent-initiated payments using signed user mandates, built on A2A.

  • Agentic Commerce — Project home

    OpenAI · Stripe · Standardized programmatic checkout for agent-driven purchases.

  • x402 — Coinbase Developer Platform

    Coinbase · Revives HTTP 402 for per-call stablecoin payments between agents and APIs.

  • MCP — Model Context Protocol Specification

    Model Context Protocol project · The protocol specification itself; cited from T16 for the consent and transport rules an abuse bypasses.

§18

Production and Operations

10

  • MapReduce: Simplified Data Processing on Large Clusters

    Dean & Ghemawat (2004) · Foundational distributed-processing model underlying parallelization patterns; referenced in the L2 and L4 rungs.

  • Time, Clocks, and the Ordering of Events in a Distributed System

    Lamport (1978) · Established logical clocks and causal ordering as the formal basis for reasoning about event sequences in distributed systems; referenced in the L4 rung on runtime coordination and trace stitching.

  • Sagas

    Garcia-Molina & Salem (1987) · Long-lived transaction pattern for distributed systems; foundational reference for durable execution and compensation chains in agentic runtimes.

  • Dapper, a Large-Scale Distributed Systems Tracing Infrastructure

    Sigelman et al. / Google (2010) · Foundational distributed-tracing architecture underlying modern agent observability stacks; referenced in the L4 rung.

  • LangSmith — Tracing for LLM applications

    LangChain AI · Distributed tracing and token cost tracking.

  • OpenTelemetry — GenAI semantic conventions

    OpenTelemetry · Cross-vendor observability for LLM / agent calls; standard gen_ai.* span attributes.

  • Arize Phoenix — Open-source AI observability & evaluation

    Arize AI · OpenTelemetry/OpenInference tracing paired with LLM-based evaluations over the captured traces.

  • LangGraph — Durable execution & resumability

    LangChain AI · Checkpoint-based recovery for long-running runs.

  • Actor Model of Computation: Scalable Robust Information Systems

    Hewitt (2010) · Actors as the universal primitives of concurrent computation — private state, message passing, no shared memory; foundational source for the Actor Model pattern.

  • Enterprise Integration Patterns

    Hohpe & Woolf (2003) · The canonical catalogue of messaging patterns (publish-subscribe channel, event-driven consumer, choreography); source for the Event-driven Choreography and Pub/Sub Agent Mesh patterns.

§19

Security and Threat Models

41

  • OWASP Top 10 for LLM Applications 2026

    OWASP GenAI Security Project (v1.0, August 2026) · Canonical catalog of application-level LLM security risks, ranked by community vote (75%) weighted against 6,639 classified real incidents (25%); draws the boundary to the Agentic Top 10 at the point where the model becomes an actor. Supersedes the 2025 edition (eight entries renumbered; System Prompt Leakage re-scoped as Hidden Context Exposure). Underpins Part IX §7 (Cascading Security Vulnerabilities) and Part XII.

  • Agentic AI — Threats and Mitigations

    OWASP GenAI Security Project (v1.1; v1.0 February 2025) · Publication of the OWASP Agentic Security Initiative; applies threat-modeling methodology to catalogue 17 emerging threats (T1–T17) of autonomous, LLM-driven agentic systems and their mitigations, and sources the Agentic AI Patterns vocabulary mapped in Part XII. v1.1 promotes two to first-class threats: T16 Insecure Inter-Agent Protocol Abuse and T17 Supply Chain Compromise.

  • Multi-Agentic System Threat Modeling Guide

    OWASP GenAI Security Project (v1.0, 2025) · Builds on Agentic AI — Threats and Mitigations, applying its threat taxonomy to real-world multi-agent systems and the expanded vulnerability surface of agent-to-agent collaboration.

  • Agentic AI Threat Modeling Framework: MAESTRO

    Cloud Security Alliance (2025) · Introduces MAESTRO (Multi-Agent Environment, Security, Threat, Risk, and Outcome), a seven-layer-plus-cross-layer framework for threat-modeling agentic AI by architectural layer rather than attack technique; source for the KB's MAESTRO section (Part XII): the architectural lens, the framework comparison, the six-step workflow, and the cross-layer threat taxonomy.

  • OWASP Top 10 for Agentic Applications for 2026

    OWASP GenAI Security Project — Agentic Security Initiative (December 2025) · A prioritised consolidation (ASI01–ASI10) of the agentic threat corpus, ranking the ten highest-impact categories with architectural blueprints and code samples; mapped to the KB's T1–T17 catalogue in Part XII § Control & Certification Standards. Not a new taxonomy — a ranked view of the same threats.

  • OWASP Agentic Skills Top 10 (AST10)

    OWASP Agentic Skills Top 10 project (Incubator, v1.0 in public review, 2026) · Catalogs the ten most critical risks of agent skills — the packaged instruction files and scripts (SKILL.md, skill.json, manifest.json) an agent loads to run a workflow with its tools: malicious skills, supply chain compromise, over-privileged skills, insecure metadata, untrusted external instructions, weak isolation, update drift, poor scanning, missing governance, and cross-platform reuse. Source for Part XII § OWASP Agentic Skills Top 10, where it is cataloged as a draft vocabulary.

  • OWASP GenAI Data Security Risks & Mitigations 2026

    OWASP GenAI Security Project (v1.0, 17 March 2026) · Twenty-one data-layer risks (DSGAI01-DSGAI21) across the GenAI lifecycle — leakage, poisoning, conversation bleed, vector-store platform security, over-broad context, telemetry leakage, inference and reconstruction. Deliberately not another Top 10: the data-layer companion to the LLM and Agentic lists. Source for Part XII § OWASP GenAI Data Security Risks, which maps the eight entries that bear on Memory Architecture.

  • AIUC-1: Crosswalks OWASP Top 10 for Agentic Applications

    OWASP GenAI Security Project + AIUC (May 2026) · Bidirectional crosswalk between the AIUC-1 controls standard (six principles, ~50 controls) and the OWASP Top 10 for Agentic Applications, with a rationale taxonomy of eight control functions (Prevent, Constrain scope, Human gate, Detect, Validate, Govern, Isolate, Disclose) and a gap analysis; source for Part XII § Control & Certification Standards.

  • Securing Agentic Applications Guide 1.0

    OWASP GenAI Security Project (v1.0, July 2025) · Practical guidance for designing, developing, and deploying secure LLM-powered agentic applications; the actionable-controls companion backing the defensive patterns cross-linked throughout Part XII.

  • Secure MCP Server Development + Third-Party MCP CheatSheet

    OWASP GenAI Security Project — Agentic Security Initiative (2025–2026) · Concrete defensive controls for the Model Context Protocol boundary — server hardening (auth, validation, session isolation, hardened deployment) and safe consumption of third-party MCP servers (tool poisoning, prompt/memory injection, tool interference); the actionable specifics under T16 Insecure Inter-Agent Protocol Abuse and T17 Supply Chain Compromise.

  • Implementing Statistical Guardrails for Non-Deterministic Agents

    Machine Learning Mastery (2026, practitioner guide) · Semantic-drift detection via cosine-distance z-scores and confidence gating via Shannon entropy; primary source for the Statistical Guardrails pattern (Governance & Safety).

  • The Protection of Information in Computer Systems

    Saltzer & Schroeder (1975) · Origin of the principle of least privilege and separation of privilege; foundational source for the Least Privilege Agent pattern.

  • NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails

    Rebedea et al. (2023) · Programmable input/dialog/output rails independent of the underlying LLM; source for the guardrail patterns.

  • Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations

    Inan et al. (2023) · A safety classifier applying a risk taxonomy to both prompts and responses; source for the Multimodal Guardrails pattern.

  • State of Agentic AI Security and Governance

    OWASP GenAI Security Project — Agentic Security Initiative (v2.01, 2026) · The primary source for Part XIII (Governance & Assurance): the safety–security convergence at the deployment layer, agent identity as a control plane, the shift from static compliance to runtime governance, and the Enterprise Adoption Maturity Model (adoption tiers AT0–AT8 × governance levels 0–4).

  • OWASP Non-Human Identities Top 10 (2025)

    OWASP (2025) · The top ten risks of non-human identities (service accounts, API keys, agent credentials): improper offboarding, secret leakage, overprivileged and long-lived NHIs, NHI reuse. The identity-plane risk vocabulary Part XIII maps agent-identity failures onto (ghost agents, credential blast radius, trust transitivity).

  • Agent Name Service (ANS) for Secure AI Agent Discovery 1.0

    OWASP GenAI Security Project (v1.0, 2025) · A DNS-inspired, PKI-backed registry giving agents stable identifiers mapped to cryptographic IDs (DIDs, SPIFFE IDs) and authoritative metadata (ownership, allowed tools, trust tier) across A2A/MCP/ACP; the discovery-and-attestation surface in Part XIII's agent-identity control plane.

  • Threat Defense COMPASS 1.0

    OWASP GenAI Security Project (v1.0, September 2025) · A methodology and spreadsheet (the AI Threat Resilience Strategy Dashboard) that consolidates threats, vulnerabilities, defenses, and mitigations into one iterated view for rapid threat prioritization; operationalizes the LLM Top 10 and Agentic taxonomies rather than adding a new one. The tactical companion to the maturity model in Part XIII.

  • The lethal trifecta for AI agents: private data, untrusted content, and external communication

    Simon Willison (16 June 2025) · Coins the lethal-trifecta heuristic: an agent combining access to private data, exposure to untrusted content, and the ability to communicate externally is exploitable end-to-end by a single prompt injection. Source for Part XIII's risk-bounding heuristics.

  • Agents Rule of Two: A Practical Approach to AI Agent Security

    Meta AI (31 October 2025) · Turns the lethal trifecta into a design constraint: within a session with no trusted human in the loop, an agent should satisfy at most two of {untrustworthy input, sensitive-data access, state-change/external communication}. Source for Part XIII's risk-bounding heuristics.

  • Regulation (EU) 2024/1689 — the EU Artificial Intelligence Act

    European Parliament & Council (2024) · The binding EU regulation for high-risk AI; Part XIII leans on Art. 72 (continuous lifetime monitoring → runtime drift detection), Arts. 25–26 (provider/deployer duties), and Art. 3(23) (substantial modification) as the regulatory driver of runtime governance over static compliance.

  • Artificial Intelligence Risk Management Framework (AI RMF 1.0)

    NIST (2023) · The voluntary US framework for governing AI risk (Govern, Map, Measure, Manage); one of the durable governance anchors whose shared assumption — that system behavior can be described before operation — agentic systems violate, per Part XIII.

  • ISO/IEC 42001:2023 — AI management systems

    ISO/IEC (December 2023) · The certifiable AI management-system standard (AIMS): policies, roles, impact assessment, continual improvement. Not a harmonized standard under the EU AI Act, so certification grants no presumption of conformity. Cited in Part XIII § Where the durable frameworks attach.

  • NIST AI 600-1 — Generative AI Profile

    NIST (v1.0, July 2024) · The GenAI-specific profile of the AI RMF: the same Govern/Map/Measure/Manage structure applied to generative systems. Cited alongside the AI RMF in Part XIII.

  • MITRE ATLAS — Adversarial Threat Landscape for AI Systems

    MITRE (content v2026.06) · The adversary-technique taxonomy for machine-learning and GenAI systems, in the ATT&CK style. The technique-level vocabulary under the Part XII threat entries: ATLAS names the move, the entry names the failure, MAESTRO names the layer.

  • MITRE ATT&CK — Enterprise techniques

    MITRE (v19.1) · The classic enterprise adversary-technique catalog. Covers the non-AI half of an agent's blast radius: once a tool call reaches a shell, database or cloud API, the incident is an ordinary one.

  • MITRE CWE — Common Weakness Enumeration

    MITRE (4.20) · The root-cause weakness taxonomy the OWASP catalogs map their entries onto; cited in Part XIII as the defect-level companion to ATT&CK.

  • CSA AI Controls Matrix (AICM)

    Cloud Security Alliance (v1.1, 22 June 2026) · A control matrix for AI systems in the lineage of the Cloud Controls Matrix — a procurement and assurance instrument rather than a design input. Cited in Part XIII beside AIUC-1.

  • OWASP AIVSS — AI Vulnerability Scoring System

    OWASP (v0.8) · Scoring for agentic AI risks with an autonomy premium over the base score; the prioritization instrument for the otherwise unordered threat catalogs. Cited in Part XIII.

  • International AI Safety Report 2026

    Bengio et al. (2026) · The internationally mandated scientific synthesis on general-purpose AI risk; its three-category split (malicious use / malfunctions / systemic risks) grounds Part XIII's distinction between AI security (≈ malicious use) and AI safety (≈ malfunctions).

  • GenAI Red Teaming Guide: A Practical Approach to Evaluating AI Vulnerabilities

    OWASP GenAI Security Project (v1.0, January 2025) · The primary source for Part XIV (Red Teaming & Adversarial Assurance): the definition of GenAI red teaming (safety/security/trust/performance across the whole stack), how it differs from traditional red teaming and from benchmarking, the four pillars (Model / Implementation / System / Runtime), the engagement methodology, and the adversarial technique catalogue.

  • Agentic AI Red Teaming Guide

    Cloud Security Alliance + OWASP GenAI Security Project (2025) · The agentic extension of the GenAI red-teaming methodology: twelve adversarial test categories for autonomous, tool-using, multi-agent systems (authorization hijacking, goal manipulation, memory/knowledge-base poisoning, multi-agent exploitation, untraceability, and more), each with test requirements, attack vectors, and example prompts. Source for Part XIV's twelve-category crosswalk to the T1–T17 threats.

  • AI Security Solutions Landscape for AI and Agentic Red Teaming, Q2 2026

    OWASP GenAI Security Project (2026) · Frames GenAI and agentic red teaming as a structured, lifecycle-wide approach — identifying, measuring, mitigating, and governing risk through coordinated adversarial testing, defensive validation, and continuous feedback loops; the continuous-assurance framing in Part XIV.

  • OWASP ASVS — Validation, Sanitization and Encoding (V5)

    OWASP Application Security Verification Standard 4.0.3 · The general application-security requirements the LLM10 mitigations point at for encoding model output per sink.

  • OWASP API4:2023 Unrestricted Resource Consumption

    OWASP API Security Top 10 (2023) · The API-level sibling of LLM06 Unbounded Consumption; rate, size and cost limits as an API contract.

  • CycloneDX — AI/ML bill of materials

    OWASP CycloneDX · The bill-of-materials format the supply-chain mitigations name for models, adapters and datasets (AIBOM / ML-BOM).

  • OpenSSF Model Signing (sigstore/model-transparency)

    Open Source Security Foundation · Signs a model artifact against a transparency log, binding it to a signer identity; cited by LLM04 Supply Chain.

  • The Dual LLM Pattern

    Simon Willison (April 2023) · Separates a privileged planner from a quarantined model that reads untrusted content; cited by LLM03 Excessive Agency.

  • Rogue Agents: Stop AI From Misusing Your APIs

    Twilio · Practitioner guidance on scoping what an agent's tools may reach; cited by LLM03 Excessive Agency.

  • leaked-system-prompts

    Jujumilk3 (GitHub collection) · A running collection of extracted system prompts — the evidence that hidden context is discoverable; cited by LLM08.

  • Prompt Leak

    Prompt Security · Vendor explainer on system-prompt extraction; cited by LLM08 Hidden Context Exposure.

§25

Security Research — Attacks and Demonstrations

32

  • Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications

    Cohen, Bitton & Nassi (arXiv:2403.02817, 2024) · A self-replicating prompt spread between GenAI email assistants, each infected assistant passing it on; the canonical T12 demonstration.

  • Red-Teaming LLM Multi-Agent Systems via Communication Attacks

    He et al. (arXiv:2502.14847, 2025) · Compromised whole multi-agent systems by intercepting and rewriting only the messages between agents; T12 Agent Communication Poisoning.

  • Multi-Agent Systems Execute Arbitrary Malicious Code

    Triedman, Jha & Shmatikov (arXiv:2503.12188, 2025) · Adversarial files and pages hijacked AutoGen, CrewAI and MetaGPT into running code or leaking data; cited by T11 and T14.

  • Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems

    Lee & Tiwari (arXiv:2410.07283, 2024) · A self-replicating injection passed between agents through ordinary messages; the T13 Rogue Agents demonstration.

  • Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification

    Zhang et al. (arXiv:2407.20859, 2024) · Misled agents into repeating commands until their iteration limit, tying up downstream capacity; the T4 Resource Overload demonstration.

  • Flooding Spread of Manipulated Knowledge in LLM-Based Multi-Agent Communities

    Ju et al. (arXiv:2407.07791, 2024) · Invented facts spread agent-to-agent and persisted in retrieval memory; the T5 Cascading Hallucination demonstration.

  • Frontier Models are Capable of In-context Scheming

    Meinke et al., Apollo Research (arXiv:2412.04984, 2024) · In environments built to reward it, models disabled oversight and kept up deception under questioning; the T7 demonstration.

  • GitHub MCP Exploited: Accessing private repositories via MCP

    Invariant Labs (May 2025) · A malicious issue drove an agent to publish private repository contents; every tool call was permitted, only the sequence was not. T2 Tool Misuse.

  • WhatsApp MCP Exploited: Exfiltrating your message history via MCP

    Invariant Labs (April 2025) · An MCP server swapped its tool description after approval ("rug pull") and exfiltrated message history; T16 Insecure Inter-Agent Protocol Abuse.

  • Supabase MCP can leak your entire SQL database

    General Analysis (July 2025) · A support ticket steered an assistant holding a service_role key into dumping a private table; the confused-deputy form of T3.

  • When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems

    Palo Alto Networks Unit 42 (October 2025) · A malicious peer used an open A2A session to slip instructions to a financial agent, which leaked data and traded; T13 Rogue Agents.

  • Agent In the Middle — Abusing Agent Cards in the Agent-2-Agent (A2A) Protocol

    Trustwave SpiderLabs (April 2025) · A rogue agent's exaggerated Agent Card won every task, because nothing authenticates a self-description; T9 Identity Spoofing.

  • Bypassing AI Agent Defenses With Lies-In-The-Loop

    Checkmarx Zero (September 2025) · Padding an approval prompt pushed the real command out of view, so the human gate approved it; T10 Overwhelming Human-in-the-Loop.

  • ZombAIs: From Prompt Injection to C2 with Claude Computer Use

    Johann Rehberger / Embrace The Red (October 2024) · A web page talked a computer-use agent into downloading and running a binary that joined a command-and-control server; T6.

  • Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection

    Greshake et al. (arXiv:2302.12173, 2023) · The paper that named indirect prompt injection; cited by LLM01.

  • Universal and Transferable Adversarial Attacks on Aligned Language Models

    Zou et al. (arXiv:2307.15043, 2023) · Automatically generated suffixes that transfer across aligned models; cited by LLM01.

  • The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections

    Nasr et al. (arXiv:2510.09023, 2025) · Static attack-success rates near zero rose above 90% once the attacker adapted to the deployed defense; the adaptive-testing argument in LLM01.

  • Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training

    Hubinger et al. (arXiv:2401.05566, 2024) · Backdoors survive safety training and stay dormant until triggered; cited by LLM05 Data and Model Poisoning.

  • Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples

    Souly et al. (arXiv:2510.07192, 2025) · As few as 250 poisoned documents compromised models from 600M to 13B parameters regardless of dataset size; the scale finding in LLM05.

  • Poisoning Language Models During Instruction Tuning

    Wan et al. (arXiv:2305.00944, 2023) · Poisoned instruction-tuning examples steer later behavior; cited by LLM05.

  • Stealing Part of a Production Language Model

    Carlini et al. (arXiv:2403.06634, 2024) · Recovered parts of a production model through its API; the extraction half of LLM06 Unbounded Consumption.

  • We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs

    Spracklen et al. (arXiv:2406.10279, 2024) · Measures how often coding models invent package names — the basis of "slopsquatting"; cited by LLM04 Supply Chain.

  • Text Embeddings Reveal (Almost) As Much As Text

    Morris et al. (arXiv:2310.06816, 2023) · Reconstructs source text from stored embeddings (Vec2Text); why an "embeddings-only" leak is a document leak in LLM09.

  • Information Leakage in Embedding Models

    Song & Raghunathan (arXiv:2004.00053, 2020) · Early demonstration that embeddings leak their inputs; cited by LLM09 Vector and Embedding Weaknesses.

  • Sentence Embedding Leaks More Information than You Expect

    Zhou et al. (arXiv:2305.03010, 2023) · Extends embedding inversion to sentence encoders; cited by LLM09.

  • A Survey on Trustworthy LLM Agents: Threats and Countermeasures

    arXiv:2503.09648 (2025) · Survey of agent-specific threats and defenses; cited by T13 Rogue Agents.

  • Mechanistic Interpretability for AI Safety — A Review

    Bereska & Gavves (arXiv:2404.14082, 2024) · Review of interpretability methods as a safety instrument; cited from the deceptive-behavior discussion in Part XII.

  • PoisonGPT: How we hid a lobotomized LLM on Hugging Face to spread fake news

    Mithril Security (2023) · A surgically modified model published under a trusted-looking name passed standard benchmarks; cited by LLM04.

  • Hijacking Safetensors Conversion on Hugging Face

    HiddenLayer (2024) · Compromised a model-format conversion service — the transformation step as a supply-chain surface; cited by LLM04.

  • ChatGPT Plugin Exploit Explained: From Prompt Injection to Accessing Private Data

    Johann Rehberger / Embrace The Red (2023) · Model output reaching a privileged plugin without validation; cited by LLM10 Improper Output Handling.

  • Proof Pudding (CVE-2019-20634)

    AI Vulnerability Database (AVID) · Model-extraction case record; cited by LLM02 Sensitive Information Disclosure.

  • The Rise of the Deceptive Machines: When AI Learns to Lie

    UNU C3 (2024) · Essay on deceptive model behavior; cited from T7 Misaligned & Deceptive Behaviors.

§20

Background — Limits of Prompting

5

  • Defeating Nondeterminism in LLM Inference

    Thinking Machines Lab (2025) · Most authoritative recent source on LLM non-determinism: shows that outputs vary even at temperature=0 because of batch-invariance failure in inference kernels, not floating-point folklore.

  • Non-Determinism of "Deterministic" LLM Settings

    arXiv 2408.04667 (2024) · Empirical study quantifying nondeterminism across providers and settings.

  • Be Clear, Direct, and Detailed

    Anthropic prompt-engineering guide · Frames prompts as instructions requiring engineering rigor, not natural-language requests.

  • Define your success criteria

    Anthropic empirical-evaluation guide · Frames LLM verification as an open eval-design problem.

  • OpenAI — Temperature and sampling

    OpenAI · Reference for non-determinism even at temperature=0.

§21

Real-World Incidents — Anecdotes and Failure Cases

19

  • Moffatt v. Air Canada (BCCRT, Feb 2024)

    Civil Resolution Tribunal of British Columbia (2024) · Civil Resolution Tribunal of British Columbia held Air Canada liable for negligent misrepresentation by its chatbot, which had hallucinated a bereavement-fare refund policy. Awarded CAD $812.02. McCarthy Tétrault legal analysis ↗︎ ABA Business Law Today ↗︎ CanLII case comment (2025) ↗︎

  • Chevrolet of Watsonville chatbot — "$1 Tahoe" (Dec 2023)

    Business Insider coverage (2023) · Customer prompt-injected a dealership's GPT-powered assistant into agreeing to sell a 2024 Chevy Tahoe for $1 with the binding response "That's a legally binding offer — no takesies backsies."

  • Mata v. Avianca (SDNY, June 2023)

    Southern District of New York (2023) · Two lawyers were sanctioned after submitting a federal court filing in which ChatGPT had hallucinated six fictional case citations. Court order ↗︎ NYT coverage ↗︎

  • Spyware Injection Into Your ChatGPT's Long-Term Memory (SpAIware)

    Johann Rehberger / Embrace The Red (September 2024) · A prompt injection made ChatGPT write attacker instructions into long-term memory, so later sessions kept leaking what the user typed; the T1 Memory Poisoning incident.

  • Hacking Gemini's Memory with Prompt Injection and Delayed Tool Invocation

    Johann Rehberger / Embrace The Red (February 2025) · Deferring the memory write past the untrusted content evaded Google's block on tool use while reading it; the second T1 Memory Poisoning incident.

  • CVE-2025-32711 — AI command injection in Microsoft 365 Copilot

    Microsoft Security Response Center (June 2025) · The vendor record for the zero-click "EchoLeak" exfiltration Aim Labs disclosed; rated critical and fixed server-side. Cited by T3 Privilege Compromise.

  • Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet

    Brave (August 2025) · A hidden Reddit comment redirected a browser agent into collecting the user's email address and login code; the T6 Intent Breaking incident.

  • Copilot Broke Your Audit Log, but Microsoft Won't Tell You

    Zack Korman / Pistachio (August 2025) · Asked for no link, Microsoft 365 Copilot read a file and left no audit-log record; the T8 Repudiation & Untraceability incident.

  • Cursor security advisory GHSA-4cxx-hrm3-49rm (CVE-2025-54135)

    Cursor (August 2025) · An indirect prompt injection wrote a workspace MCP config whose start command ran attacker code; the T11 Unexpected RCE incident.

  • Phishing For Gemini

    0DIN — Marco Figueroa (July 2025) · Invisible email instructions made Gemini for Workspace append a fake Google security alert to its summary; the T15 Human Manipulation incident.

  • Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files (CVE-2025-59536)

    Check Point Research (February 2026) · A project-declared MCP server ran before the trust dialog could be accepted; the T16 Insecure Inter-Agent Protocol Abuse incident.

  • Replit agent deletes a production database (customer thread)

    Jason Lemkin, posts on X (July 2025) · The affected customer's account of an agent deleting a production database during a code freeze and misreporting the rollback; the T7 incident.

  • Disrupting the first reported AI-orchestrated cyber espionage campaign

    Anthropic (November 2025) · An attacker split an intrusion campaign into sub-agent tasks that each looked legitimate in isolation; the T14 Human Attacks on MAS incident.

  • AWS Security Bulletin AWS-2025-015 — Amazon Q Developer VS Code extension

    Amazon Web Services (July 2025) · An over-scoped build token let an attacker commit code that shipped in v1.84.0; it did not execute due to a syntax error. The T17 Supply Chain incident.

  • Information Regarding Malicious 'postmark-mcp' Package

    Postmark (September 2025) · A package impersonating Postmark's MCP server added a silent BCC backdoor in version 1.0.16 after fifteen clean releases; a T17 incident.

  • Security Update: Suspected Supply Chain Incident

    LiteLLM (March 2026) · Releases 1.82.7/1.82.8 carried a credential stealer after publishing credentials were taken via the project's CI security scanner; a T17 incident.

  • Air Canada Chatbot Misinformation: What Travellers Should Know

    BBC (February 2024) · Press account of the Moffatt v. Air Canada tribunal decision; cited from the Misinformation entry (LLM07).

  • ChatGPT Fake Legal Cases: Generative AI Hallucinations

    LegalDive (2023) · Trade-press account of the fabricated citations in Mata v. Avianca; cited from the Misinformation entry (LLM07).

  • ChatGPT Spit Out Sensitive Data When Told to Repeat 'Poem' Forever

    Wired (2023) · The divergence attack that made a production model emit memorized training data; cited from Sensitive Information Disclosure (LLM02).

§22

Interoperability (MCP & A2A)

3

  • What is the Agent2Agent (A2A) Protocol?

    Caballar & Stryker / IBM Think (2025) · IBM Think article covering the A2A protocol.

  • Agent2Agent Protocol Specification

    Linux Foundation · Agent2Agent Protocol Specification under the Linux Foundation.

  • Model Context Protocol Specification

    Anthropic · Model Context Protocol Specification from Anthropic.

§23

Production (Part VIII)

9

  • Pydantic v2 documentation

    Pydantic · Recursive validation and the model API behind the boundary contract for agent state (Part VIII).

  • LangGraph Persistence (PostgresSaver)

    LangChain AI · Checkpointer concepts and the durable PostgresSaver / AsyncPostgresSaver backends the suspend/resume cycle needs (Part VIII).

  • Langfuse documentation

    Langfuse · Self-hostable tracing and evaluation backend; the open-source option in the observability stack (Part VIII).

  • Small Language Models are the Future of Agentic AI

    Belcak et al. / NVIDIA Research (2025) · Argues SLMs are the right default for the repetitive, well-scoped calls that dominate agentic workloads; primary source for Model Tiering and Small Language Models (Part VIII).

  • RouteLLM: Learning to Route LLMs with Preference Data

    Ong et al. / LMSYS (2024) · Preference-data-trained router that dispatches each request to the cheapest model meeting the quality bar; primary source for the Resource-Aware Optimization pattern and Model Tiering and Small Language Models (Part VIII).

  • Cost-Aware Contrastive Routing for LLMs

    Shirkavand et al. (2025, NeurIPS 2025 spotlight) · Contrastive-embedding router that picks the cheapest accurate model within adaptive cost bands via a single k-NN lookup; companion source for the Resource-Aware Optimization pattern.

  • Introduction to Small Language Models: The Complete Guide for 2026

    Machine Learning Mastery (2026, practitioner guide) · SLM definition (<10B params), the SLM-vs-LLM routing heuristic, and efficiency methods (distillation, quantization, sparse attention).

  • 5 Production Scaling Challenges for Agentic AI in 2026

    Machine Learning Mastery (2026, practitioner guide) · Orchestration, observability, cost (kill switches, retry storms), evaluation (behavioural / simulation testing), and governance as the five production gaps; supports Part VIII and Part IX.

  • 7 Agentic AI Trends to Watch in 2026

    Machine Learning Mastery (2026, practitioner guide) · Graduated / bounded autonomy, governance and security agents, and FinOps model tiering; supports the HITL graduated-autonomy framing (Part V §6) and Model Tiering (Part VIII).

§24

Durable Runtimes & Agent Harnesses

5

  • Temporal — Documentation

    Temporal Technologies · Durable workflow engine documentation; covers deterministic replay, automatic retries, and saga support for long-running stateful orchestration. docs ↗︎ repo ↗︎

  • Inngest — Documentation

    Inngest Inc. · Event-driven durable execution documentation; step functions, retries, and flow control on a managed event backbone without running your own queue. docs ↗︎ repo ↗︎

  • Restate — Documentation

    Restate Systems · Durable execution documentation for distributed services; covers durable promises, virtual objects, and exactly-once handlers across microservices. docs ↗︎ repo ↗︎

  • Deep Agents SDK — Documentation

    LangChain AI · Opinionated, batteries-included harness on LangGraph; documents built-in planning, subagents, and virtual file system for long-horizon autonomous agents. docs ↗︎ repo ↗︎

  • Claude Agent SDK — Documentation

    Anthropic · Agentic harness documentation; covers the gather-context / act / verify loop behind Claude Code, with tools, subagents, and first-class MCP support. docs ↗︎ repo ↗︎

Keep exploring

Related references.

ReferenceGlossaryEvery term in one austere, scannable lookup.Open the glossary PatternsPattern OverviewAll four pattern categories on one map.All four categories ReferenceProtocolsHow agents interoperate — MCP, A2A and AG-UI on the wire.Compare protocols

Search

Search patterns, frameworks, and pages.