Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap

Abstract

Conventional signature-based defenses no longer protect the heterogeneous, large-scale infrastructures that the Internet of Things (IoT) now constitutes. Large language models (LLMs) and agentic artificial intelligence (AI) — systems that autonomously perceive, reason, plan, and act — open a path to self-defending IoT ecosystems, but the integrating literature remains fragmented. Following a PRISMA 2020 protocol, this survey systematically analyzes 153 peer-reviewed studies published between 2020 and 2026 in IEEE Xplore, the ACM Digital Library, and MDPI journals. We organize the corpus along a four-pillar taxonomy: agent architecture (single- vs. multi-agent), reasoning strategy (chain-of-thought, ReAct, plan-and-solve, tool use), action scope (detection, response, threat hunting, vulnerability discovery, deception), and deployment topology (edge, fog, cloud). We synthesize four flagship application domains, consolidate datasets and benchmarks, and analyze open challenges including hallucination, prompt-injection robustness, explainability, privacy, latency, and governance. A 2026 research roadmap identifies four high-priority directions — federated agentic learning, verifiable autonomous reasoning, trustworthy multi-agent collaboration, and resource-hardened edge agents. A companion reproducibility kit — prompt templates, reference single- and multi-agent loops, and an Edge-IIoTset-style evaluation harness, released as illustrative scaffolding rather than a validated framework — is publicly available and archived on Zenodo (DOI 10.5281/zenodo.20726552).

I. Introduction

The global population of Internet of Things (IoT) endpoints is projected to exceed 30 billion devices by 2026, spanning consumer wearables, smart-city fabrics, vehicular telematics, medical implantables, and industrial control systems supervising critical infrastructure. The same heterogeneity, low-cost manufacturing economics, and decade-long deployment lifetimes that make IoT economically attractive also make it structurally hostile to traditional defensive postures: device firmware is rarely patched, cryptographic identities are inconsistent or absent, and the traffic of tens of millions of microcontrollers cannot be triaged by human analysts at any plausible staffing ratio. The Mozi botnet — which by 2021 had infected over 1.5 million devices and formed multiple large peer-to-peer botnets — exemplifies how modern IoT-scale adversaries outpace conventional signature-based defense, and subsequent Mirai variants continue to reproduce this pattern.

Over the same period, two technological trajectories have matured that promise a structural response to this asymmetry. The first is the emergence of large language models capable of zero-shot reasoning over heterogeneous textual artifacts — packet captures rendered as text, system logs, threat-intelligence reports, MITRE ATT&CK technique descriptions, CVE narratives — without bespoke feature engineering. The second is the development of agentic AI: software systems that wrap LLM reasoning in perception, planning, memory, tool-use, and multi-agent communication loops, enabling them to autonomously execute multi-step security tasks that previously required human analysts. Together they open a credible path to self-defending IoT ecosystems in which heterogeneous traffic is interpreted semantically, anomalies are explained in natural language, response playbooks are dynamically synthesized, and adversarial actions are deceived in real time.

Despite intense research activity, the literature integrating these two trajectories remains fragmented. Recent surveys treat LLMs in cybersecurity generally, generative AI in IoT broadly, or specific sub-domains such as SOC automation, CTI extraction, or autonomous penetration testing. No prior systematic review unifies agent architecture, reasoning strategy, action scope, and deployment topology into a single coordinate system specifically for IoT cybersecurity, nor maps the field's open problems onto a concrete 2026 research roadmap. The absence of such synthesis impedes both academic progress and industrial adoption.

Our contributions are: (1) a four-pillar taxonomy of agentic AI for IoT security, operationalized in a companion open-source repository; (2) a critical synthesis of four flagship application domains — anomaly interpretation, intelligent response orchestration, predictive risk assessment, and adversarial deception — including quantitative comparisons of detection accuracy, mean-time-to-respond reductions, and edge inference latencies; (3) a consolidated atlas of datasets and benchmarks; (4) a rigorous analysis of open challenges; (5) a 2026 research roadmap with four high-impact directions and concrete experimental milestones; and (6) a companion reproducibility kit archived on Zenodo. The remainder of the paper is organized as follows: Section 2 gives background, 3 the methodology, 4 related surveys, 5 the taxonomy, 6 application domains, 7 datasets and benchmarks, 8 open challenges, 9 the roadmap, 10 the code artifact, and 11 conclusions.

II. Background and Preliminaries

An IoT system is conventionally decomposed into three layers: a perception layer of resource-constrained sensors and actuators; a network layer of fog gateways, edge routers, 5G/6G slices, and wide-area protocols such as MQTT and CoAP; and an application layer of cloud analytics, dashboards, and orchestration platforms. Each layer exhibits distinct attack surfaces: firmware exploits and command injection at perception; traffic flooding, protocol fuzzing, and lateral movement at network; credential abuse, supply-chain compromise, and data exfiltration at application — while the 5G/6G transition compounds the problem through network slicing whose isolation guarantees become themselves the target of slice-hopping attacks. Defensive practice has historically relied on signature-based intrusion detection, supplemented by autoencoder, isolation-forest, and recurrent anomaly detectors — brittle against zero-day attacks, with high false-positive rates that drown analysts, and no native facility for explaining decisions. Graph neural networks and federated learning improved raw accuracy but remain opaque pattern matchers that cannot reason about novel attacker strategies or synthesize multi-step responses.

Large language models are transformer networks trained on massive text corpora to predict the next token, and three properties make them particularly suited to security applications: zero-shot generalization, semantic interpretation of heterogeneous artifacts within a single context window, and natural-language explanation of decisions that a human operator can audit. Concrete results illustrate the potential: BARTPredict achieves 98% accuracy in predicting IoT attacks on the BoT-IoT benchmark, and edge-deployed DistilBERT and TinyBERT models classify intrusions at over 99% accuracy with sub-70-millisecond inference latency. These headline figures are, however, reported on different datasets with different attack distributions and split protocols and are therefore not statistically comparable — a point we return to with the 10–20 percentage-point cross-dataset degradation in Section 7.1. LLM-augmented GPT-2 pipelines combine signature detection with semantic reasoning to identify previously unseen variants, while APOLLO (a GPT-4o phishing detector) generates both a classification and a human-readable explanation per message, and CyberNER-LLM extracts entities from threat-intelligence reports at accuracies approaching human experts.

The agentic paradigm is defined by a control loop wrapping the language model: perception (reading telemetry, logs, alerts), reasoning (chain-of-thought, ReAct, or plan-and-solve), memory (task context and retrieved knowledge), tool use (vulnerability scanners, query interfaces, evidence collectors), and multi-agent communication (dividing labor among specialized agents). This loop locates each study in the taxonomy: single-agent architectures with a tight, low-overhead loop, or multi-agent designs with specialized roles (detector, hunter, responder) and coordination cost, or hybrid hierarchical designs. Human-oversight gates govern autonomy tiers so that high-impact actions (e.g., quarantining devices or blocking traffic) require human approval — a practice institutionalized by governance frameworks such as the NIST AI Risk Management Framework.

Three families of efficiency techniques are critical for IoT deployment: quantization (reducing precision from 32/16-bit to 4- or 8-bit integers), pruning (removing low-magnitude weights), and knowledge distillation (training a small “student” model to mimic a large “teacher”). As reported by Wang et al., DistilBERT retains roughly 97% of BERT-base accuracy on IoT-IDS tasks with around 40% fewer parameters and roughly 60% faster inference, while cross-view distillation achieves 92–95% parameter reduction while sustaining macro-F1 above 0.986. These techniques are what enable LLMs to run on the constrained hardware that dominates the installed IoT base.

III. Methodology: A PRISMA-Style Systematic Review

The synthesis is structured around five research questions: (RQ1) Which agent architectures and reasoning strategies dominate the published IoT-cybersecurity literature, and how do they trade off coordination overhead against detection accuracy? (RQ2) What detection-accuracy versus end-to-end latency frontier has been reported for LLM-driven defenders at the edge, fog, and cloud tiers? (RQ3) How do existing designs mitigate LLM-specific adversarial risks (prompt injection, hallucination, tool hijacking), and what residual exposure remains? (RQ4) Which datasets and benchmarks validate agentic IoT defenders, and what aspects of agent behavior remain unmeasured? (RQ5) Which research directions, pursued over the next 24 months, would most materially close the gap between laboratory demonstrations and trustworthy production deployments? We searched three peer-reviewed venues — IEEE Xplore, the ACM Digital Library, and MDPI journals — covering January 2020 through May 2026 (final search 29 May 2026), deliberately excluding preprint repositories including arXiv so that every included study had passed formal peer review. Search strings intersected two term groups: the AI methodology (“large language model” OR “agentic AI” OR “multi-agent” OR “ReAct” OR “chain-of-thought” OR “tool use”) and the security application (“IoT” OR “edge security” OR “intrusion detection” OR “threat hunting” OR “vulnerability discovery” OR “honeypot”). We transparently distinguish the 153-study PRISMA corpus from foundational background references (CoT/ReAct methodologies, governance documents, the Mozi-botnet primary studies) that do not count toward the corpus.

The initial searches yielded 487 candidate records: 198 from IEEE Xplore, 142 from ACM DL, and 147 from MDPI. After removing 63 duplicates, 424 records remained for title-and-abstract screening, of which 218 were excluded as out of scope; the remaining 206 underwent full-text screening with 53 further exclusions — 31 for insufficient empirical validation, 14 with fewer than two pages of substantive content, 7 non-English without translation, and one out-of-window — leaving a final corpus of 153 studies. The first author screened and the senior author spot-checked a 15% random sample at each stage (Cohen's kappa = 0.84, 90.4% agreement), and each included study was coded along seven dimensions: bibliographic identifier, IoT layer/topology, agent architecture, reasoning strategy, security focus, key benchmarks, and critical limitations. The corpus comprises 58 IEEE, 39 ACM, and 56 MDPI papers, with a temporal skew toward 2024–2025 reflecting the acceleration of agentic research after capable function-calling models appeared in late 2023.

We disclose six limitations for methodological transparency: first, the three-venue restriction omits high-quality work in USENIX Security, IEEE S&P, NDSS, and Elsevier/Springer journals — expected to affect taxonomy cell density, not its structure; second, single-reviewer screening with partial spot-checks rather than two fully independent reviewers; third, metadata-based extraction for paywalled papers; fourth, the May 2026 upper bound; fifth, the English-only corpus; sixth, that the companion reproducibility kit is a v0.3.0 scaffolding artifact never validated in any production environment, so any statement referencing it should be read as a proposal, not an established capability.

IV. Related Surveys and Positioning

Several recent surveys touch on adjacent territory but stop short of the agentic AI × IoT cybersecurity intersection this survey synthesizes. Yao et al. review LLM applications across eight cybersecurity domains including a brief IoT subsection, but treat agents only tangentially. Ferrag et al. provide a comprehensive review of generative AI in IoT security with strong GAN and diffusion-model coverage but limited treatment of multi-agent reasoning. The cognitive-layer survey of Ali et al. explicitly addresses LLM-IoT integration but is structured around defense techniques rather than agent architectures. AI-augmented SOC surveys cover agent-based SOC automation in detail but target enterprise networks rather than IoT edge constraints, while Bansal et al.'s agent-evaluation survey catalogs measurement methodology without addressing IoT-specific deployment concerns. Domain surveys — IoV security, SOAR and threat hunting, XAI-for-IoT, deep reinforcement learning for intrusion detection, and graph-based IDS — are likewise partial with respect to this intersection.

Table 3 summarizes this survey's positioning against the most directly comparable prior work within the IEEE, ACM, and MDPI corpora: compared with broad LLM-for-security surveys we narrow scope to IoT but go deeper on agent architecture and edge deployment, and compared with all-AI IoT-security surveys we narrow the AI lens to agentic systems but extend coverage to 2026 publications and consolidate a companion code artifact. No prior survey in these corpora indexes a four-pillar taxonomy (architecture × reasoning × scope × topology) of the form developed here. The positioning is reinforced by a complementary narrative scan of representative work from top-tier systems-security venues — PentestGPT (USENIX Security 2024), KARONTE (IEEE S&P 2020), ChatAFL (NDSS 2024), and the Liu et al. prompt-injection benchmark — all of which map cleanly onto the four-pillar coordinates, supporting the claim that the taxonomy does not shift under a broadened venue policy, while the closest excluded-venue comparators (Zhang et al. in Springer; Jamshidi et al. in Elsevier) converge independently on the same dominant open problems: hallucination, prompt-injection exposure, and evaluation immaturity.

V. A Four-Pillar Taxonomy of Agentic AI for IoT Cybersecurity

We organize the surveyed literature along four orthogonal dimensions that together yield a 4-tuple coordinate locating every study and surfacing under-explored regions of the design space. Figure 2 renders the taxonomy as a hierarchy tree linking each pillar to its options and then to IoT-layer assignments.

Pillar I — agent architecture: single-agent systems run a tight, low-overhead perceive-reason-act loop suited to focused edge detection tasks where resources are scarce. Multi-agent systems divide labor among specialized roles — a detector, a hunter, a responder — raising capability on complex tasks at the price of coordination overhead and compound failure; no corpus system conforms to the emerging interoperability protocols (MCP/ANP/A2A), a deficit the roadmap targets. Hybrid and hierarchical designs combine a fast local loop with upper-level coordination for long-horizon planning.

Pillar II — reasoning strategy: chain-of-thought (CoT) is the lightest loop and fits the industrial closed loop (≤0.1 s), while tool-augmented ReAct dominates the literature because it binds reasoning to external action (querying, scanning, containing). Plan-and-solve front-loads the task into a ~3-step plan before execution, and reflection/self-critique multiplies latency by 1.5–2× in exchange for reliability gains. The accompanying table sets compatibility budgets: CoT-only for the closed loop, all loops for soft real-time (1–10 s), and all for retrospective analysis (>10 s).

Pillar III — action scope: detection-only systems classify and explain without containment action, while response orchestration synthesizes dynamic playbooks and integrates with SOAR platforms to cut response times. Threat hunting proactively seeks latent threats via model-generated queries, vulnerability discovery finds flaws in firmware and protocols (though only 2 of 13 studies in this scope report a verified false-discovery rate — a faithfulness deficit), and adversarial deception deploys LLM-driven honeypots to lure attackers and gather intelligence on them in real time.

Pillar IV — deployment topology: edge/on-device deployments run quantized small language models (SLMs) under sub-100 ms budgets, but these models' prompt-injection susceptibility remains largely unmeasured against the 26–41% CyberSecEval baseline. Fog/gateway deployments balance latency and capability by aggregating telemetry regionally, while cloud-centric deployments host full-capability models but collide with the raw-traffic egress (privacy) problem. Table 2 documents the accuracy–latency–robustness frontier across tiers with an explicit warning: accuracy cells are best-reported peaks on different benchmarks, not comparable across rows — only within-study deltas qualify as directly comparable.

VI. Application Domains

This section synthesizes four flagship domains. First, anomaly interpretation: semantic alert triage acts as the first analyst, with the model reading packet traffic and logs in one context and explaining the anomaly in auditable natural language, reducing alert fatigue. LLM-augmented GPT-2 pipelines combine signature detection with semantic reasoning to identify previously unseen attack variants, while APOLLO generates a classification plus a human-readable explanation for every phishing message.

Second, intelligent response orchestration: the agent synthesizes dynamic playbooks adapted to the affected asset and the observed attack surface, integrating with SOAR platforms to execute containment (quarantining devices, blocking malicious flows, rotating credentials) with human-approval gates for high-impact actions. Surveyed studies report mean-time-to-respond reductions, but these are laboratory peaks on differing benchmarks, not comparable across studies.

Third, predictive risk assessment and threat hunting: CyberNER-LLM extracts entities (actors, malware, techniques, indicators) from intelligence reports at near-expert accuracy, and hunting agents generate proactive hypotheses and search queries over historical and live telemetry, shifting the posture from reactive to anticipatory.

Fourth, adversarial deception and honeypots: systems deploy LLM-driven honeypots that mimic real IoT devices, adapting their dialogues to attacker tradecraft to lure adversaries, prolong engagement, and fingerprint tactics in real time. Section 6.5 adds illustrative production-integration scenarios — proposed deployment paths across edge, fog, and cloud tiers — positioned as scaffolding proposals, not validated capabilities.

VII. Datasets, Benchmarks, and Evaluation Methodology

The corpus documents five principal IoT-specific datasets: CICIoT2023 (33 attacks in 7 families — the de facto IoT IDS benchmark), Edge-IIoTset (14 attacks with industrial-IoT realism and protocols such as Modbus), TON_IoT (9 multi-modal attack types: network, OS, sensor), CICIoMT2024 (18 attacks across 40+ medical devices), and BoT-IoT/N-BaIoT for foundational botnet research (Mirai, Bashlite, DDoS). Attack-class counts are taken from each dataset's documentation without re-benchmarking or re-validating labels, under the explicit reading rule: entries describe heterogeneous benchmarks, and figures associated with them are indicative of trends only, not comparable across rows.

LLM- and agent-specific benchmarks comprise CyberSecEval 1–3 (insecure coding, prompt injection, offensive capability) and CyberSOCEval (SOC tasks: malware analysis, CTI reasoning). The survey critiques the absence of agent-native evaluation suites that test multi-step tool use, latency budgets, and adversarial robustness simultaneously — the gap the companion harness targets.

Metrics and reporting practice show a recurring pattern: 10–20 percentage-point cross-dataset performance degradation (Table 1, aggregated from nine primary studies by detector family), because prompts and fine-tuning corpora entrench dataset-specific shortcuts. The reading rule (Section 7.1): all accuracy cells are indicative of trends only; only within-study/within-dataset deltas — such as the transfer drops in Table 1 — qualify as directly comparable. The Arp et al. pitfalls (inflated accuracy under unrealistic class balance and sampling bias) independently motivate these cautions.

VIII. Open Challenges

First, hallucination and verifiable reasoning: models can produce confident explanations for wrong judgments in high-stakes decisions (blocking, quarantining, escalation), and verbalized reasoning need not track actual computation — a faithfulness deficit with only 2 of 13 vulnerability-discovery studies reporting a verified false-discovery rate. Closing it requires attributed reasoning traces and verification mechanisms binding every causal claim to inspectable evidence.

Second, adversarial robustness and prompt injection: agents are themselves attack surfaces — indirect injection via poisoned telemetry, tool-call hijacking, and injection escalating to remote code execution in tool-augmented applications (as the CCS 2024 study showed). Table 4 consolidates layered defenses ordered from input to procedure: syntactic input sanitization, untrusted-input marking, tool-call gating with allow-lists, inter-agent boundaries, human-approval gates for consequential actions, and continuous adversarial evaluation — with residual exposure motivating each subsequent layer.

Third, explainability, auditability, and privacy preservation: production trust requires audit trails binding each decision to evidence and policy, and Table 8 maps the NIST AI RMF functions (Govern, Map, Measure, Manage) onto the four taxonomy pillars with a compliance artifact per function. Conversely, raw-traffic egress blocks cloud analysis under privacy policies, pushing toward federated learning that keeps data on devices — but at bandwidth cost and accuracy degradation under differential-privacy guarantees.

Fourth, the latency–security paradox, governance, accountability, and ethics: deeper reasoning (reflection, multi-step planning) improves decisions but breaks industrial closed-loop budgets (≤0.1 s) — the latency–security paradox at the edge. Governance demands autonomy registers, EU-AI-Act-Annex-III-style risk classifications, and human-oversight gates, while ethics requires data minimization, purpose limitation, and transparency — especially since autonomous defensive systems take consequential actions on live assets.

IX. A 2026 Research Roadmap

The roadmap sets four high-impact directions, each tied to a measured corpus gap and a concrete closing milestone. Direction 1 — federated agentic learning (9.1): addresses the privacy/transfer deficit (≥9 of 153 studies showing 10–20 pp cross-dataset degradation, with raw egress blocking cloud analysis); the closing milestone is DistilBERT-grade Edge-IIoTset accuracy under (ε=1, δ=10⁻⁵) differential privacy at ≤2× bandwidth. Direction 2 — verifiable autonomous reasoning (9.2): addresses the faithfulness deficit (only 2 of 13 studies reporting a verified false-discovery rate); the milestone is <10% verbalization-vs.-attribution divergence on SECURE.

Direction 3 — trustworthy multi-agent collaboration (9.3): addresses the interoperability/robustness deficit (0 corpus systems conforming to MCP/ANP/A2A, only 5 of 153 reporting any compound failure mode); the milestone is ≥95% malicious-agent detection in 10+-agent benchmarks at ≤5% throughput loss. Direction 4 — resource-hardened edge agents (9.4): addresses the edge-robustness deficit (edge-SLM prompt-injection susceptibility largely unmeasured against the 26–41% CyberSecEval baseline); the milestone is <5% injection success with <100 ms p50 latency on Cortex-A78.

The horizon is 24 months (RQ5): a staged validation path from illustrative scaffolding to real-data validation, with future broadening of the venue policy toward USENIX Security, IEEE S&P, NDSS, and Elsevier/Springer journals without changing the reproducible corpus counts. Convergence from the excluded-venue syntheses (Zhang et al.; Jamshidi et al.) on the same open problems increases confidence that the taxonomy and analysis are not artifacts of the three-venue policy.

X. Companion Reproducibility Kit

The kit (GitHub: vnageshwaran-de/agentic-iot-security, accessed 29 May 2026; Zenodo archive DOI 10.5281/zenodo.20726552, release v0.3.0, implemented in Python 3.11) comprises: prompt templates for each action scope, reference single-agent ReAct and coordinated multi-agent loops, an evaluation harness for accuracy and per-decision latency on Edge-IIoTset-style traffic, plus the closed coding codebook and coded extraction matrix (corpus/codebook.md and corpus/extraction_matrix.csv) so any reader can replicate the corpus selection and coding decisions. Kit pointers in Table 4 locate the layered defenses in the repository.

Release status and scope (10.5): the kit is illustrative scaffolding for follow-up empirical work, not a production framework — it has never been validated in any production IoT environment, its only shipped validation run uses a deterministic stub on synthetic traffic (Appendix A), and any statement in the survey referencing it should be read as a proposal whose empirical force depends on the staged real-data validation path (Section 10.3), not as established capability. This status is recorded explicitly as a limitation of the present work (Sections 3.8 and 10.5), not claimed as a strength.

XI. Conclusions

This survey provides — to the best of our knowledge — the first systematic review unifying agent architecture, reasoning strategy, action scope, and deployment topology into a single coordinate system dedicated to IoT cybersecurity, grounding the synthesis in a 153-study PRISMA-screened corpus from IEEE Xplore, the ACM Digital Library, and MDPI journals for 2020–2026. It consolidates four flagship application domains, a unified atlas of datasets (CICIoT2023, Edge-IIoTset, TON_IoT, CICIoMT2024) and LLM benchmarks (CyberSecEval, CyberSOCEval), and a rigorous analysis of open challenges from hallucination to governance.

The takeaway: LLMs and agentic AI open a credible path to self-defending IoT ecosystems — where traffic is interpreted semantically, responses are synthesized dynamically, and adversarial actions are deceived in real time — but production trust requires closing the verifiability, adversarial-robustness, and edge-hardening gaps. We call on the research community to pursue the four 2026 roadmap directions — federated agentic learning, verifiable autonomous reasoning, trustworthy multi-agent collaboration, and resource-hardened edge agents — with their concrete experimental milestones, alongside broadened venue coverage and real-data validation of the companion harness.