On September 15, 2026, TechTimes summarized a finding that should unsettle any enterprise running agents in production: breaches can occur in the pipeline—planning, memory, tool invocation—without safety dashboards obsessed with the final response lighting a single alarm. The academic work behind the headline is a Systematization of Knowledge (SoK) submitted to arXiv on September 11 by Md Jueal Mia, Yanzhao Wu, Selcuk Uluagac and M. Hadi Amini.
The title says it plainly: “SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration.” Unlike a single-attack paper, an SoK synthesizes accumulated literature and reframes it. Here the reframe is blunt: three assumptions of current AI security practice are wrong, and all three point at the same monitoring hole.
First fallen assumption: “aligned” does not mean “defended.” RLHF and Constitutional AI optimize preferences on the normal-use distribution; adversarial robustness requires worst-case resistance. Empirically they are orthogonal properties: a more aligned model can, for some attack classes, be more vulnerable than a less aligned one. Investing only in alignment does not progressively harden against engineered jailbreaks.
Second: defenses that lower attack success rates do so inconsistently across models, attacks and components, while imposing real over-refusal and latency costs. For enterprise agents in legal, customer ops or software work, refusing too often is not an academic nuance—it is lost utility. The paper’s security-utility-efficiency framework aims to make that tradeoff visible.
Third—and most operational—infrastructure almost exclusively watches “final-response safety.” An agentic system traverses interaction, planning/reasoning, memory, tool-use and inter-agent communication layers. An adversary can poison the plan, corrupt persistent memory or redirect tools, and still produce output that passes content filters. The green light lies by design.
The classic example is indirect prompt injection: a web document retrieved during research inserts hostile instructions; the agent exfiltrates data or skews conclusions; the final report looks normal. Copilot workflow jailbreaks documented by the Alan Turing Institute in July 2026 already pointed, in a coding niche, to the same family of single-turn evaluation failures.
The paper lands in a charged political moment. Days earlier, Dario Amodei warned about agent swarms that could seize large parts of the internet within six to twelve months. An enterprise survey cited in the same TechTimes coverage suggested 77% lack verified agent inventories and only 19% have an automated gate blocking bad releases—while 74% “trust” their tests to catch failures.
European regulation is beginning to mirror the diagnosis: the AI Act pushes logging of intermediate events relevant to risk, not only final outputs. Salesforce’s AI Control Plane (September 11) and Zscaler’s Agentic SOC (September 9) are sold precisely as per-action observability. The paper does not design a complete defense architecture; it does say what to stop pretending.
Immediate actions Neural Pulse translates from the SoK: (1) stop using output ASR as a proxy for pipeline security; (2) demand per-layer session traces from vendors; (3) least privilege on every tool—a compromised plan must not reach unnecessary capabilities. None of that fully closes the gap; it shrinks surface and improves detection.
Honest limits: this is an empirical synthesis SoK, not a certification of any specific product; enterprise survey figures come from the same week’s journalism and should be read as context, not as the paper’s dataset. We do not claim every production agent is already compromised.
For CISOs and AI owners, the mindset shift is the deliverable. One-prompt, one-response red-teaming certified chatbots; it does not certify multi-step agents. Anyone waving a 2024 safety badge as proof of 2026 agentic readiness is, on this evidence body, watching the wrong indicator.
September 15 close: while labs fight over existential narrative, Mia et al.’s SoK drops to the wiring. If Amodei fears swarms, this paper explains why your dashboards might applaud while the swarm plans. The next security dollar should buy intermediate traces—not another cosmetic filter on the last sentence.
The SoK genre has a pedagogical advantage: it forces the community to see the forest of attacks and defenses instead of one isolated CVE. Mia et al. use that form to tell CISOs the agentic forest is not watched by cameras aimed only at the exit door—the metaphor for final-response monitoring—while the memory warehouse and tool workshop burn.
The research agenda the paper calls for—session-trajectory-level safety evaluation—does not yet exist at commercial scale. Until it does, serious organizations should assume high uncertainty and compensate with aggressive least privilege, tool segmentation and humans in the loop for irreversible actions (payments, deploys, deletions, potential exfiltration).
