Research Intelligence Explorer

Agent Authority Boundary

The sequence through which AI influence reaches retrieval, tools, authorization, action, and external consequence.

AI Product Supply Chain

An AI product is composed of models, prompts, policies, data, context, tools, orchestration, infrastructure, evaluations, and generated artifacts.

AI Security Execution Gap

The gap between recognizing AI risk and producing reproducible evidence that an engineered control works.

Inside-Out AI Security Assurance

Security assurance should begin with the system, boundary, and failure path rather than the desired claim.

M.A.D.E.

The durable operating functions of AI Security Engineering.

Role Architecture Follows Risk Architecture

AI security roles should be derived from system exposure, required functions, ownership, team structure, tooling, and evidence obligations.

Signal Divergence

AI Security Engineering is forming through research, building, security, public attention, governance, exploitation, harm, staffing, and funding at different speeds.

AI Security arXiv Corpus 2026

Canonical State 2026 AI-security-tagged arXiv corpus.

AI Security Job Descriptions 2026

Canonical State 2026 ATS job-description corpus.

AI Security Media Corpus 2026

Canonical normalized State 2026 rolling media corpus.

AI-Relevant Vulnerabilities 2026

Strict canonical State 2026 AI-relevant vulnerability corpus.

OpenSSF Repository Snapshot 2026

Canonical State 2026 OpenSSF Scorecard repository snapshot.

Public AI Incidents 2026

Canonical State 2026 public AI incident corpus.

From Risk Architecture to Role Architecture

Canonical figure from The State of AI Security Engineering 2026.

How a Profession Reproduces Itself

Canonical figure from The State of AI Security Engineering 2026.

Institutionalization

Canonical figure from The State of AI Security Engineering 2026.

Outside IN

Canonical figure from The State of AI Security Engineering 2026.

ROLE Compression

Canonical figure from The State of AI Security Engineering 2026.

The Agent Authority Boundary

Canonical figure from The State of AI Security Engineering 2026.

The AI Product Supply Chain

Canonical figure from The State of AI Security Engineering 2026.

The Durable Functions of AI Security Engineering

Canonical figure from The State of AI Security Engineering 2026.

Agentic Anarchy

Agentic product capability is advancing faster than explicit security ownership for identity, tool access, authorization, and external consequence.

Boardroom-to-Backlog Gap

Executive AI risk narratives often fail to translate into named controls, owners, and evidence artifacts at the engineering level.

Entry-Level Extinction

AI security hiring is weighted toward experienced practitioners while the discipline lacks mature entry pathways and workforce infrastructure.

Model Supply Chain Blind Spot

Organizations often treat the model as the AI product while under-modeling the data, context, prompts, tools, orchestration, infrastructure, and generated artifacts around it.

Skill Washing

AI language can appear in security hiring without materially changing the underlying responsibilities, controls, or operating model.

Skills Validation Gap

The market asks for AI security engineering skills before it has standardized, practical evaluation pathways to validate them.

The Agentic Surface Emergence

Prompt-injection, function-calling, and tool-calling security signals remain a small share of the research and tooling surface today, but are rising quickly.

The Attention Deficit

Across 53,680 analyzed media items, capability coverage outpaces security coverage by roughly 5.0:1 (8,447 capability items vs. 1,682 across every security-labeled bucket combined).

The Builder Vacuum

94.3% of observed repositories in GHArchive's bounded rolling-window sample (412 of 437) remain unclassified as AI-security-specific — the AI-native tooling ecosystem employers ask for barely exists yet.

The Compliance Reflex

Established compliance language substantially outweighs AI-native governance and control vocabulary in hiring language.

The Evidence Gap

Organizations frequently move from policy or tooling claims directly to assurance without demonstrating the control, test, telemetry, and evidence chain.

The Exploited Present

53 AI-relevant CVEs have reached CISA Known Exploited Vulnerability status — actively exploited in the wild today, not a theoretical future risk.

The Framework Paradox

Of 8 tracked AI-native security frameworks, 5 are document-only and only 3 are machine-readable — none are natively integrated into CI/CD pipelines, security tooling, or automated evidence collection.

The Frankenstein Role

AI security hiring often compresses responsibilities historically distributed across several security disciplines into one requisition.

The Frontier Paper Stack

3,411 of 10,152 unique arXiv papers in the current pull are strict AI-security papers, already naming concrete work in prompt/generation security, agentic action security, model and ML attack security, governance assurance, privacy protection, MCP/tool-use security, and red teaming.

The Knowledge Desert

Only 8 Wikimedia pages are narrowly tagged AI-security-specific against a field with 3,411 strict AI-security arXiv papers and 437 classified GitHub repos — there is no canonical public reference for AI security engineering as a practice.

The Privacy Asymmetry

Differential privacy and privacy-preserving ML remain active arXiv research terms (112 and 32 papers in the current pull), but privacy still appears in hiring language mainly as a GDPR/compliance checkbox rather than a named engineering capability.

The Probability Pivot

AI security hiring language increasingly reflects probabilistic systems reasoning and ambiguity tolerance rather than deterministic pass/fail control thinking.

The Red Team Misnomer

AI red teaming is frequently described as a standalone activity even though durable value depends on control engineering, telemetry, replay, remediation, and regression.

The Telemetry Blind Spot

arXiv puts only 1.99% of papers (202 of 10,152) in detection and runtime monitoring, and media coverage of AI cyber defense is just 0.9% of volume (486 of 53,680 items) — among the least-researched and least-covered AI security topics.

The Tool Incumbency Trap

Compliance automation incumbents appear in hiring language more visibly than AI-native security testing and evaluation tooling.

The Unicorn Index

The market prices one role while frequently describing team-level capability breadth, compressing five or more specialties into a single requisition.

The vCISO Vacuum

Some organizations are too small to hire the unicorn role the market has priced, but too exposed to defer AI security entirely.

A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots

A three-layer framework intercepting direct and indirect prompt injection throughout the inference pipeline, reducing Attack Success Rate from 71.4% to 11.3% across GPT-4o, Llama 3, and Mistral 7B.

ADR: An Agentic Detection System for Enterprise Agentic AI Security

The first large-scale, production-proven enterprise framework for securing AI agents operating through the Model Context Protocol, deployed at Uber for over ten months across more than 7,200 unique hosts.

ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection

A runtime security framework enforcing a user-confirmed rule set at every tool-call boundary, blocking indirect prompt injection pathways without model modification, evaluated across five state-of-the-art language models.

From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails

Reveals that the reasoning capabilities enabling LLM-based guardrails introduce a novel vulnerability: attackers can inject crafted data to trap the guardrail in extended reasoning loops, effectuating a denial-of-service attack.

Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning

Conducts STRIDE and DREAD threat modeling of MCP implementations across five key components, finding tool poisoning -- malicious instructions embedded in tool metadata -- as the most prevalent and impactful client-side vulnerability.

Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming

Presents AI-Infra-Guard, an open-source framework organizing AI red teaming across infrastructure, protocol/tool, agent behavior, and model layers, spanning deterministic rule matching, LLM-driven auditing, and jailbreak harnesses.

SoK: The Attack Surface of Agentic AI -- Tools, and Autonomy

Systematizes trust boundaries and security risks of agentic LLM-based systems, mapping a taxonomy of attacks spanning prompt-level injections, knowledge-base poisoning, tool/plug-in exploits, and multi-agent emergent threats.

TEMPLATEFUZZ: Fine-Grained Chat Template Fuzzing for Jailbreaking and Red Teaming LLMs

A fine-grained fuzzing framework that systematically exposes vulnerabilities in chat templates, a critical yet underexplored attack surface, achieving a 98.2% average jailbreak attack success rate across twelve open-source LLMs.

TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories

As large language models evolve from static chatbots into autonomous agents, the primary vulnerability surface shifts from final outputs to intermediate execution traces. Introduces TraceSafe-Bench to assess mid-trajectory safety across 12 risk categories.

VATS: Exploiting Implicit Authority in Error-Path Injection via Systematic Mutation

As the Model Context Protocol standardizes tool-calling for autonomous agents, it introduces a critical, unexamined attack surface: the error-handling loop. Error-path injection triples the success rate of standard indirect prompt injection.

The State of AI Security Engineering 2026

What companies really mean by AI Security Engineer and why the operating model is lagging the technology.

ISO/IEC 42001

ISO/IEC 42001 is tracked as a high-trust AI governance standard in the evidence corpus. Extraction and quote-level citation work has not started yet.

MITRE ATLAS

MITRE ATLAS is tracked as a high-trust adversarial-AI security standard in the evidence corpus. Extraction and quote-level citation work has not started yet.

NICE Cyber Workforce Framework

The NICE Cyber Workforce Framework is tracked as a high-trust workforce standard in the evidence corpus. Extraction and quote-level citation work has not started yet.

NIST AI Risk Management Framework

The NIST AI Risk Management Framework is tracked as a high-trust AI governance standard in the evidence corpus. Extraction and quote-level citation work has not started yet.

OWASP Top 10 for LLM Applications

The OWASP Top 10 for LLM Applications is tracked as a high-trust AI security standard in the evidence corpus. Extraction and quote-level citation work has not started yet.

2,547

AI-Relevant Vulnerability Disclosures

Strict canonical AI-relevant vulnerability population.

3,411

AI-Security Papers

AI-security-tagged papers in the State 2026 research corpus.

27,260

Companies Analyzed

Companies represented in the canonical State 2026 hiring corpus.

39:1

Governance Language Ratio

Established compliance-language prevalence relative to AI-native governance and control vocabulary.

754,507

Job Descriptions Analyzed

Canonical State 2026 hiring corpus.

53,680

Media Corpus Items

Items represented in the State 2026 rolling media corpus.

1,286,572

OpenSSF Repository Snapshot

Repositories represented in the State 2026 OpenSSF snapshot.

1,558

Public AI Incidents

Public AI incidents represented in the State 2026 incident corpus.

Agent Security

Security of AI systems that retrieve, invoke tools, authorize actions, and create external consequences.

AI Red Teaming

Adversarial testing of realistic AI failure paths, authority boundaries, control failures, and external consequences.

AI Security Engineering

The engineering discipline responsible for mapping, attacking, defending, and evidencing the security of AI products and systems.

AI Security Evidence

Reproducible evidence that AI security controls exist, operate, and continue to work.

AI Security Governance

Governance language, control ownership, operating accountability, and defensible security claims for AI systems.

AI Security Institutional Formation

The research, building, security, governance, incident, staffing, and funding systems through which a discipline becomes real.

AI Security Workforce

Hiring, role architecture, skills, seniority, labor supply, and workforce infrastructure for AI Security Engineering.

AI Supply Chain Security

Security of the models, data, prompts, policies, tools, orchestration, infrastructure, and generated artifacts that compose AI products.

AI Vulnerability Intelligence

Vulnerability disclosures, exploited records, weakness patterns, and affected AI product surfaces.

Model and Data Security

Security of model artifacts, training and evaluation data, retrieval sources, embeddings, and model promotion workflows.

Open Source AI Security

Public repository activity, security tooling, OpenSSF controls, and builder behavior across AI security ecosystems.

RAG Security

Security of retrieval-augmented generation systems, including authorization, poisoned context, retrieval abuse, and data exposure.