Securing Agentic AI: Threat Models and Trust Boundaries for LLM-Based Agents and Tool-Use Protocols (2025)

Abstract

Background: 2025 turned large language models from chat systems into agents — systems that read content, decide on actions, and invoke privileged tools. Two interoperability protocols industrialized this shift: Anthropic's Model Context Protocol (MCP), whose June 2025 revision re-specified MCP servers as OAuth 2.1 resource servers, and Google's Agent2Agent (A2A) protocol, donated to the Linux Foundation in June 2025 with broad industry backing. The same year produced the attack record that defines the threat model: Invariant Labs' tool-poisoning disclosure (April 2025) and GitHub-MCP "toxic agent flow" exploit (May 2025), and the formalization of the "lethal trifecta" — private data, untrusted content, and external communication combined in one agent (June 2025). Objective: We consolidate the 2025 agentic-AI security record into an engineering threat model for tool-using agents and evaluate the mitigations that the protocol layer, the platform layer, and application design can supply. Methods: Qualitative synthesis of the 2024–2025 primary disclosures, protocol specifications, and governance instruments; construction of a six-class attack taxonomy and a six-class mitigation-coverage assessment. Results: The defining property of agentic systems is boundary collapse: untrusted content becomes instructions that drive privileged actions, so the classical separation between "data" and "execution" — the foundation of most security architecture — does not hold. Every major 2025 exploit is an instance of one pattern; mitigations partition cleanly into classes that reduce blast radius (capability-scoped tools, OAuth-scoped delegation, confirmation gates) and classes that detect misuse (provenance labeling, toxic-flow analyzers), but no 2025 mechanism eliminates the confused-deputy problem itself. Conclusions: Agentic-AI security in 2025 is an exercise in boundary engineering under an acknowledged residual risk : scope every capability, bind identities to delegation chains, gate irreversible actions, and instrument for detection — while treating prompt injection as unsolved and designing so that its exploitation is survivable.