Bibliography

Twenty-odd things worth reading in full after this wiki, with one line each on why they earned the spot. This is a reading list, not a citation dump. Every page carries its own sources in front matter, and the crosswalk is where traceability lives.

The four to read first: Willison on the lethal trifecta, Beurer-Kellner et al. on design patterns, the 2025 AI Agent Index, and ISO/IEC 42001 Annex A (to see what a certificate does not cover).

Start here — the mechanism

• Simon Willison, “The lethal trifecta for AI agents” (simonwillison.net, 16 June 2025). Three properties, one page, and the clearest statement of why this is an architecture problem. The vocabulary the rest of the field now borrows.
• Beurer-Kellner et al., “Design Patterns for Securing LLM Agents against Prompt Injections” (arXiv:2506.08837, June 2025). Six patterns that trade generality for provable resistance. The single most useful paper for anyone designing an agent that must not be hijacked.
• Debenedetti et al., “Defeating Prompt Injections by Design” (CaMeL) (arXiv:2503.18813, 2025). The strongest worked instance of the same idea: control flow from trusted code, data from wherever.

Agent security and architecture

• Chan et al., “Visibility into AI Agents” (FAccT ‘24, arXiv:2401.13138). Where, why, how, by whom, plus three measures that map onto identifiers, monitoring and logs. Peer-reviewed, and the boundary statement at the end is the honest one.
• Chan et al., “Infrastructure for AI Agents” (arXiv:2501.10114, TMLR 2025). What has to exist outside the agent for any of this to work.
• Shavit, Agarwal et al. (OpenAI), “Practices for Governing Agentic AI Systems” (December 2023). Seven practices, and a scope note conceding that hijacking falls outside them: a frontier lab naming the gap this wiki’s security pages fill.
• Kolt, “Governing AI Agents” (arXiv:2501.07913). The agency-law reading, including why incomplete instructions make discretion unavoidable rather than sloppy.
• Nasr, Carlini, Hayes, Shumailov, Tramèr et al., “The Attacker Moves Second” (arXiv:2510.09023, USENIX Security 2026). Twelve published defenses, adaptive attack, over 90% success. Read it before buying a filter.
• Syros et al., “SAGA: A Security Architecture for Governing AI Agentic Systems” (NDSS 2026, arXiv:2504.21034). Where the sub-agent problem is modelled rather than waved at.
• Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign” (13 November 2025). 80–90% of an intrusion lifecycle run by agents, financial institutions among the targets. First-party and unaudited, and still the best-evidenced version of the cheap adaptive attacker.

Standards and frameworks — read the parts that matter

• ISO/IEC 42001:2023, especially §6.1.4 (AI system impact assessment) and Annex A. Read Annex A specifically to see that the 38 controls are management and documentation controls. A certificate attests to those and no more.
• ISO/IEC 27001:2022 §6.1.3. The Statement of Applicability mechanism, and Note 3, the licence for adding agent controls to a certified system.
• NIST, “SP 800-53 Control Overlays for Securing AI Systems: Concept Paper” (14 August 2025). Short. Its Table 1 disambiguates four parallel NIST efforts better than any summary, and its assumptions section is a citable authority for fixing baseline security first.
• OWASP GenAI Security Project, “Agentic AI — Threats and Mitigations” v1.1 (December 2025) and “Securing Agentic Applications Guide” v1.0 (July 2025). The threat vocabulary and the builder-side companion. The second states honestly that governance is out of scope.
• Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 (the Digital Omnibus). Read Annex III and Article 99 in the original; almost everything written about scope and penalties is wrong in a specific, checkable way.

What regulators have actually said

• Advisers Act Rules 204-2 and 206(4)-7 for adviser-only firms; SEC Rule 17a-4 and FINRA Rules 4511 and 3110 for broker-dealers; both sets for dual registrants. Old, category-based, and binding now. No AI rule is needed to reach an agent’s output. Read the applicable pair; citing the other one in an examination is a bad opening.
• SEC Division of Examinations, FY2026 priorities. The sentence that staff will assess whether firms adequately supervise their AI use is the whole regulatory story for most funds.
• Financial Stability Board, “Monitoring Adoption of AI and Related Vulnerabilities in the Financial Sector” (10 October 2025). What supervisors are building toward.

Measurement — the studies that hold up

• Yotzov, Barrero, Bloom, Bunn, Davis et al., “Firm Data on AI” (NBER WP 34836 / Atlanta Fed WP 2026-3). Nearly 6,000 executives, verified identities, central-bank panels. The adoption baseline to use instead of any vendor survey, and the source of the deflationary finding that nine in ten report no realized impact.
• Brynjolfsson, Li & Raymond, “Generative AI at Work” (NBER WP 31161; QJE 2025). 14% average, 34% for novices. The skill-compression result the whole citizen-development thesis rests on.
• Noy & Zhang (Science, July 2023). 453 professionals, 40% faster, 18% better. Cite the published version, not the working paper everyone quotes.
• Dillon, Jaffe, Immorlica & Stanton, “Shifting Work Patterns with Generative AI” (arXiv:2504.11436). 66 firms, 7,137 workers, randomized: two hours of email saved and no change in what anyone actually does. The best-identified null in the literature.
• Bick, Blandin & Deming, “The Rapid Adoption of Generative AI” (NBER WP 32966). Adoption at least as fast as the PC, benchmarked properly.
• Johnston, Holtz et al. (OpenAI), “The Shift to Agentic AI: Evidence from Codex” (arXiv:2606.26959). What usage looks like when friction is near zero: a leading indicator, and the authors say so.
• Staufer, Feng, Wei et al., “The 2025 AI Agent Index” (arXiv:2602.17753, FAccT ‘26). Thirty deployed systems, four with agent-specific safety evaluations. Read it before trusting a vendor’s eval claims.
• Databricks, “Introducing OfficeQA” (December 2025) and “OfficeQA Pro” (arXiv:2603.08655). Vendor-built, and the grounded-accuracy ceiling it documents is the number to put next to any demo.

Practitioner writing and books

• Davenport & Barkin (with Chase Davenport), “All Hands on Tech” (Wiley, 2024). The pre-AI citizen-development playbook in full. Agents break specific parts of it; the rest still holds, and the case detail is better than anything published since.
• Ethan Mollick, “Detecting the Secret Cyborgs” and the Leadership/Lab/Crowd essays. Argument, not evidence, and the sharpest available account of why people hide what they build.
• Microsoft, Copilot Studio governance guidance and the agentic AI maturity model. First-party marketing prose that names governance theater and non-enforceable controls as anti-patterns. Read it for the anti-patterns, not the product.
• Barkin & Davenport, “Harnessing Grassroots Automation” (MIT SMR, September 2023). The counterweight this wiki takes seriously: automating a messy process still pays, and the disaster stories had yet to appear in 2023.

Surveys, with their defects stated

• Wharton Human-AI Research & GBK, “Accountable Acceleration” (October 2025, n=801). The only unsponsored repeated cross-section in this corpus. Use it for direction and year-over-year, not for base rates about small firms.
• Deloitte, “State of AI in the Enterprise” 8th edition (n=3,235, fieldwork Aug–Sep 2025). Published methodology, which is more than most. Source of the 21% mature-agent-governance figure.
• EY Responsible AI Pulse, phase 2 (October 2025, n=975 at $1B+ firms). The citizen-development trio (two-thirds permit it, 60% have a policy, half lack visibility), with an audience nothing like the firms this wiki addresses.

Everything above this line has a defect worth knowing. Nothing below it should be cited at all: adoption statistics reprinted without their instrument, “N% of firms are breached by AI” numbers with no base, and any figure whose only home is a roundup article. Several such claims were traced to nothing during this build and are recorded in BUILD-LOG.md.

See also

• Frameworks — what each standard covers, and where it stops.
• Open questions — what none of the above answers.
• Crosswalk — the traceability table these sources sit behind.