You know how building security works in a skyscraper? You can classify threats by what the intruder does once inside — picks a lock, climbs through a vent, tailgates an employee — but none of that tells you which floor they entered on. A lockpick on floor 2 and a lockpick on floor 40 are the same technique but completely different security problems. This paper argues that embodied-AI security has been stuck classifying lockpicks when it should be classifying entry floors. The committed claim: existing surveys of foundation-model-powered embodied agents organize threats by mechanism (jailbreaks, prompt injection, backdoors, adversarial examples) rather than by the trust boundary the adversary first crosses. Liu et al. propose a "first-compromised-trust-boundary" taxonomy that separates WHERE attackers enter from HOW they attack, producing five layers and twelve distinct attack surfaces. This is a survey paper, not a novel defense — but the organizing principle is genuinely new and the coverage is current through August 15, 2026. The twelve surfaces span the full stack: model supply chain, user instructions, context and memory, physical semantic environments, multimodal perception, world state, internal reasoning, task planning, action interfaces, middleware, multi-agent communication, and execution control. The authors cataloged 58 attack records and 61 defense records and did something surveys rarely do well — they quantified the distribution of research attention across surfaces. The finding is stark: attack research clusters on multimodal perception and action interfaces, while defenses pile up at action-level and runtime protection. Both the offense and defense communities are fighting over the same two floors of the building while leaving entire wings unmonitored. The underexplored zones are exactly the ones you'd worry about in production: context and long-term memory (where persistent state accumulates poisoned beliefs over time), middleware and networking (where API calls traverse unverified infrastructure), world-state integrity (where the agent's internal model of reality can be silently corrupted), and multi-agent trust (where Byzantine behavior in robot swarms could propagate unchecked). These aren't exotic academic concerns — they're the attack surfaces that matter most when you move from single-turn demos to long-horizon, multi-robot deployments. As a survey, the validation regime is necessarily different from an experimental paper. The authors aren't proving a defense works; they're arguing their taxonomy is more useful than mechanism-based alternatives. The evidence is structural: they show cross-layer propagation paths that mechanism-based taxonomies miss entirely. A prompt injection that corrupts long-term memory, which later distorts planning, which eventually produces a dangerous action — that chain crosses three trust boundaries, and a mechanism-based taxonomy files it under "prompt injection" and moves on. The trust-boundary view traces the full kill chain. The open challenges section is where the paper earns its keep: state provenance (how do you verify the agent's beliefs weren't tampered with?), compositional defenses (how do you stack protections across layers without creating new failure modes?), long-horizon attack propagation (adversarial inputs that only manifest after hundreds of steps), physical realizability (can these attacks actually work on real hardware, not just in simulation?), Byzantine multi-robot behavior, and unified closed-loop evaluation. That last one matters most — the field currently has no standardized way to test whether an embodied agent is secure across the full control loop. The paper doesn't propose solutions, and it doesn't pretend to. Its contribution is the map itself — and a map that shows you where nobody's looking is worth more than another defense for the two surfaces everyone's already watching.
