A Survey of Security in Real-World Agents: From Digital Agents to Embodied AI

Real-world agents extend language-model reasoning to digital operations and physical action, raising a central security question: how do digital-side attacks cross trust boundaries in robotic systems, and what physical safety conclusions can existing evidence support? This survey examines semantic hijacking, sensory manipulation, and middleware injection across software agents, modular robotic agents, and vision-language-action (VLA) systems. We compare how untrusted content acquires task authority, corrupted observations affect action generation, and middleware access reaches execution interfaces under different permission and control assumptions. An experiment-level analysis examines environment, trajectory, privilege and exposure, consequence, and assurance, distinguishing generated plans, software-state changes, simulated execution, and physical robot actions. The comparison reveals important evidence boundaries: RoboPAIR evaluates driving plans in Dolphins but API-mediated robot actions in Jackal, while Apollo point-cloud replay demonstrates altered braking decisions without measuring physical deceleration. These differences prevent planning or command-level success from being treated as direct evidence of physical safety violations. Across defenses, protection depends on the integrity of the state used for checking, coverage of executable command paths, and the timing of intervention. Reported attack suppression also need not imply useful protection: Safe Prompting reduces targeted attack success to zero while clean-task success also falls to zero in its LIBERO evaluation. Together, these findings identify the conditions under which digital compromise reaches physical execution, delimit the safety claims supported by current experiments, and motivate stronger assurance of action enforcement and recovery under compromised state.