From LLMs to Autonomous AI Agents for Cybersecurity: A Survey

i

This article has been updated. A Correction to this article was published on .

i

The Original Article was published on

i

The Original Article was published on

i

This article has been updated

i

This article was retracted on

i

This article has been updated

Abstract

Large language model (LLM)-based agents are rapidly transforming how cybersecurity tasks are automated, assisted, and evaluated, yet the literature remains fragmented across diverse security settings. We systematize agent for security through a systematic literature review (SLR). Following an established review protocol, we collected candidate studies from top security venues, China Computer Federation (CCF)-ranked conferences and journals, Google Scholar, OpenAlex, Crossref, and arXiv. Starting from more than 46,000 initial records, we applied title screening, abstract review, relevance scoring, deduplication, snowballing, and full-text verification, retaining 205 papers published from 2023 to 2026. We develop a five-dimensional taxonomy that connects external security applications with the internal design of agent for security systems. The taxonomy covers application domains, agent capabilities, technical paradigms, data and knowledge, and agent architecture, providing a unified view of where these systems are applied, what enables their operation, and how they are constructed and organized. Across these dimensions, we characterize major research directions, compare research emphases, synthesize representative methods, and identify emerging hotspots, underexplored areas, and open challenges for developing trustworthy and effective agent for security systems.

Keywords

cybersecurity / large language model / agent for security / artificial intelligence / survey

CHANGE HISTORY

A Correction to this paper has been published:
https://doi.org

The Retraction Note was updated to reflect reception of statements of disagreement from all authors.

This article has been retracted.Please see the Retraction Notice for more detail:
https://doi.org

Rights & permissions

Higher Education Press 2026

Just Accepted

This article has successfully passed peer review and final editorial review, and will soon enter typesetting, proofreading and other publishing processes. The currently displayed version is the accepted final manuscript. The officially published version will be updated with format, DOI and citation information upon launch. We recommend that you pay attention to subsequent journal notifications and preferentially cite the officially published version. Thank you for your support and cooperation.