When Agentic AI Meets Integrated Sensing and Communication

This survey paper, authored by Kai Li, Conggai Li, Sarah Ali Siddiqui, Syed Sohail Ahmed, Xin Yuan, Shenghong Li, and Wei Ni (ACM Comput. Surv., August 2026), introduces and systematically analyzes a new networking paradigm termed AISAC (Agentic AI-enabled Integrated Sensing and Communication). The paper defines AISAC as follows:

"Agentic artificial intelligence (AI) is transforming Integrated Sensing and Communication (ISAC) from a function-oriented physical-layer technology into a goal-driven, closed-loop intelligent system, a paradigm we term AISAC."

The authors elaborate: "This nexus of agentic AI and ISAC is referred to AISAC, a new networking paradigm, in which autonomous AI agents, capable of perception, reasoning, planning, and decision-making, are embedded within ISAC systems to jointly orchestrate sensing and communication resources toward intent-driven, mission-level objectives."

The paper argues that AISAC is driven by a growing demand for federated intelligence and context-aware services, with an aim to jointly optimize spectrum utilization, energy efficiency, and decision-making latency. It leverages edge computing to process sensed data locally while using communication links for cooperative exchange and distributed learning. The authors note that "ISAC transmitters and receivers can be controlled by AI agents. The frequency, bandwidth, power control, and beamforming can be implemented by agentic AI. The radar signal processing can be executed by agents trained to infer different targets and recognize different radio fingerprints of objects."

The paper also highlights that existing research is fragmented: Existing work on learning-based sensing, resource allocation, reconfigurable intelligent surfaces (RIS), edge intelligence, multi-agent coordination, and resilient networking has developed largely in isolation.

The survey makes four primary contributions:

1. A six-stage closed-loop framework comprising observation, contextualization, reasoning and prediction, planning and orchestration, execution and collaboration, and feedback and resilience. This framework integrates previously fragmented research on ISAC, RIS, UAVs, federated learning (FL), and agentic AI into a coherent technical narrative.

2. Five levels of agentic maturity, from physical-layer primitives to fully closed-loop agentic ISAC, used to classify representative studies by their primary stage, contribution side, and demonstrated (rather than claimed) agentic capability.

3. An audit of representative studies against nine agentic-specific evaluation criteria, including contextual correctness, goal completion, tool-call success, and recovery time, showing that none of the audited studies reports more than one or two of them, exposing a gap between claimed and demonstrated agentic maturity.

4. An analysis of privacy, security, resilience, and sustainability as cross-cutting requirements that apply differently at each stage of the closed loop, rather than as a single undifferentiated attack surface.

The authors formalize the AISAC closed loop with the equation:

phy

ytRF → ot → ctsem → sˆt +1:t +H → pt → at → ytRF +1,

where "ytRF denotes received communication and sensing signals, otphy denotes extracted physical observations, ctsem denotes contextual and semantic state, sˆt +1:t +H denotes predicted future states over horizon H, pt denotes an agent-generated plan, and at denotes sensing, communication, computation, mobility, and infrastructure-control actions. The authors clarify that this equation is a synthesis introduced in this survey rather than a model adopted from a single prior work."

The paper distinguishes three functional layers:

1. Physical ISAC and supporting computation layer — performs signal transmission, sensing, communication, and low-level control, with observations represented as CSI, AoA, ToA, Doppler, range, velocity, SNR, confidence. The authors stress that "Most optimization-centric ISAC and computation-aware studies primarily contribute to this layer. Their beamforming, scheduling, and offloading algorithms are therefore best interpreted as executable tools for a higher-level agent rather than as complete agents themselves."

2. AI-based contextual intelligence layer — converts physical observations into task-relevant representations: ctsem = object identity, activity, risk, scene state, network state, uncertainty. This includes multimodal fusion, semantic mapping, anomaly detection, uncertainty estimation, and world-model construction.

3. Agentic reasoning and orchestration layer — operates on context together with mission goals, memory, predicted states, and available resources, with agent state expressed as stagent = ctsem, gt, mt, sˆt +1:t +H, Rt, where gt is the current objective, mt is memory, and Rt denotes available resources.

The authors rigorously distinguish agentic AI from conventional AI applied to ISAC. They state: Agentic AI should not be justified by claiming that conventional AI is necessarily static. The distinction instead lies in the scope, representation, and organization of the decision process. A key contrast: conventional AI uses predefined loss, reward, or optimization target, whereas agentic AI receives high-level mission or operator intent that must be translated into technical objectives. Conventional systems make prediction, classification, or one-step control decisions, while agentic systems produce multi-step plan coordinating multiple functions, tools, and action entities. For failure handling, conventional AI uses predefined robust objective or fallback policy, while agentic AI performs diagnosis, recovery planning, task migration, isolation, escalation.

The paper proposes a hierarchy with three interacting loops:

• Fast physical-control loop: "Deterministic signal-processing algorithms, optimizers, MPC controllers, or lightweight policies perform beam tracking, power control, waveform adaptation, RIS updates, packet scheduling, and safety-critical mobility control."

• Medium-timescale orchestration loop: Specialized agents determine sensing priorities, target schedules, cooperating nodes, computation offloading, resource budgets, and collaboration topology.

• Slow cognitive and learning loop: Mission agents perform intent interpretation, long-horizon planning, world-model updating, continual learning, memory consolidation, and system-level adaptation.

The hierarchy is summarized as Mission Agent → ISAC Orchestrator → Schedulers and Solvers → Physical Controllers.

The paper identifies representative agent roles: "a mission agent for intent translation, a context agent for multimodal fusion, a prediction agent for mobility and channel forecasting, sensing and communication agents for resource scheduling, a computation agent for edge execution, an infrastructure agent for RIS and UAV control, and a security agent for verification and recovery. These agents need not directly solve every low-level problem. Instead, they can invoke waveform and beamforming solvers, RIS optimizers, spectrum schedulers, channel predictors, digital twins, DRL policies, offloading engines, secure aggregation mechanisms, and anomaly detectors."

• Level 0—Physical ISAC primitive: waveform, beamforming, sensing, RIS, or computation mechanisms without an adaptive AI controller.

• Level 1—AI-assisted ISAC component: AI improves one task, such as sensing interpretation, model aggregation, resource allocation, or privacy-aware learning.

• Level 2—Adaptive ISAC controller: the system observes network states and dynamically chooses actions through RL, MARL, or online learning.

• Level 3—Context-aware agentic component: the system introduces semantic context, intent interpretation, structured reasoning, tool selection, or explicit planning.

• Level 4—Closed-loop Agentic ISAC: the system integrates physical or contextual perception, mission-level goals, memory and prediction, multi-step planning, tool-enabled execution, outcome evaluation, and feedback-driven adaptation.

The authors find that most reviewed works cluster at L0–L2 and that L3–L4 systems remain comparatively rare.

The paper identifies novel vulnerabilities arising from the tight coupling of sensing and communication in AISAC:

AISAC combines the vulnerabilities of agentic AI and ISAC into a single, multifaceted attack surface.

A distinctive threat is "privacy leakage from sensing-computation correlation. ISAC tightly couples sensing acquisition with computational inference on the same device. This allows adversaries to exploit correlations between sensing signals, such as radar echoes or wireless reflections, and model outputs, such as predictions, to infer sensitive environmental states."

The paper also discusses how "poisoned updates can propagate through shared sensing features and communication signals, not just model parameters. This makes detection significantly harder. A compromised vehicle or UAV, for instance, may inject falsified sensing data that biases the collaborative model toward incorrect environmental interpretations, triggering cascading errors across the entire ISAC system."

Cross-domain adversarial threats represent a further, newer frontier in AISAC security: "They might perturb sensing waveforms to influence feature extraction, or inject malicious gradients that alter waveform generation policies. Such cross-functional interference amplifies the impact of an attack. It also renders conventional, function-isolated defenses inadequate."

The survey organizes the literature along the six stages:

Physical observation and execution (Section 4): Reviews task-oriented AISAC, joint optimization frameworks, RIS-assisted systems, advanced programmable surfaces (STAR-RIS, RHS), and mobile platforms (UAVs, vehicles). The authors note that a complete agentic system must additionally translate mission-level goals into constraints, select among these tools, predict the consequences of alternative actions, and verify the outcome after execution.

Contextualization (Section 5): Covers multimodal fusion, cross-domain tracking, vehicular SLAM, and distributed reconstruction. The key finding: "contextualization alone is not equivalent to agency. Most existing systems do not explicitly connect the constructed context to persistent memory, uncertainty-aware goal reasoning, multi-step planning, or verified ISAC tool use."

Reasoning and planning (Section 6): Reviews AI-native 6G architectures, LLM-based reasoning, learning-enabled RIS control, and federated policy optimization. The authors find that most assume predefined rewards, objectives, and action spaces and are best classified as R (reasoning and prediction) or bounded P (planning).

Distributed execution (Section 7): Analyzes coordination topologies — centralized aggregation, hierarchical, and peer-to-peer/swarm. The authors conclude: "FL clients, RIS controllers, and mobile nodes should not automatically be labeled as agents. A distributed component becomes agentic only when it possesses an explicit objective, contextual state, action capability, and feedback mechanism."

Feedback and resilience (Section 8): Reviews Byzantine-robust aggregation, adversarial defenses, failure recovery, and cross-layer resilience. The finding: Robustness without diagnosis and replanning is insufficient for mission-level autonomy.

The paper audits representative studies against nine dimensions: contextual correctness, uncertainty calibration, goal completion, planning latency, constraint violations, tool-call success, coordination overhead, recovery time, and human-intervention frequency. Key findings:

• ISAC controllers reporting convergence and sum-rate report only planning latency (partial, via convergence speed) among the agentic dimensions.

• FL participant selection studies report only coordination overhead (partial, via participant selection cost).

• Resilience mechanisms report recovery time (partial, via failure-recovery latency).

• Agent-oriented architectures report None reported quantitatively... all nine dimensions reported only descriptively, not measured.

• Even the strongest examples... report at most one or two dimensions, none covering contextual correctness, tool-call success, or human intervention.

The paper identifies eight remaining gaps, summarized in Figure 9:

1. Physical-to-semantic grounding — Grounding must become a design target, not a by-product, requiring uncertainty-aware fusion propagating sensing confidence (CRB, SNR) into semantics; knowledge-augmented context tied to verifiable measurements; and consistency checks.

2. Predictive wireless–physical world models — world models must couple physical, wireless, and computational state in one representation rather than separate outputs; and they must return calibrated uncertainty, not point estimates.

3. Real-time agent–PHY interaction — "High-level reasoning runs at hundreds of milliseconds to seconds; beam tracking and safety-critical control need slot- or millisecond-level responses... Verified, bounded-latency interfaces are needed, not unstructured message passing."

4. Safe tool use and verified execution — a wrong tool choice, misconfiguration, or out-of-regime call is invisible in the tool's own metrics, requiring feasibility checks between plan and controller, tool-use logging for audit and rollback, and verification of when a tool's output is trustworthy.

5. Heterogeneous multi-agent collaboration — agents must advertise state, agree on task allocation under partial observability, and reconfigure as nodes join, fail, or move... concrete protocols remain undeveloped.

6. Verifiable privacy and resilience guarantees — agentic AISAC offers little verifiable assurance that a deployed system behaves as intended, suggesting differential-privacy accounting, certified robustness bounds, trusted-execution or homomorphic-encryption computation, and formal policy verification.

7. Incentive-driven collaborative intelligence — "resource-constrained nodes have different owners, costs, and incentives, so participation and honesty cannot be assumed... Contribution-aware reward allocation, reputation and trust scoring, and ledger-based verification are needed."

8. Resource-efficient and sustainable autonomy — Closed-loop operation at L3–L4 adds persistent cognitive and communication overhead... Efficient learning, communication, and computation must be co-designed with renewable, carbon-aware infrastructure.

The paper also calls for benchmarks and end-to-end evaluation, noting Evaluation should move beyond physical-layer metrics (rate, Cramér–Rao bound, latency, accuracy) toward nine agentic dimensions, and recommending reproducible benchmarks exposing both physical-layer dynamics and agent-level tasks in one environment.

The paper concludes: "As future 6G networks evolve toward autonomous, distributed intelligence, AISAC marks a significant paradigm shift. It moves away from conventional communication-centric architectures and toward deeply integrated, intent-driven sensing and communication ecosystems. By embedding agentic AI into ISAC, intelligent edge entities can collaboratively perform environmental perception, distributed learning, adaptive communication, and autonomous decision-making under dynamic and heterogeneous wireless conditions. The identified open challenges point toward a trust…

Based on this paper, I can improve AI systems in the following specific ways:

1. Implement a closed-loop, goal-driven architecture — The AI system will shift from one-shot prediction/classification to a six-stage loop: observe, contextualize, reason/predict, plan/orchestrate, execute/collaborate, and feedback/resilience. It will be able to translate high-level mission intent into multi-step technical plans, invoke specialized tools (optimizers, predictors, controllers) as needed, and adapt based on outcome evaluation.

2. Institute leveled agentic maturity assessment — The system will be self-aware of its own autonomy level (from L0 physical primitive to L4 closed-loop agentic). It can identify gaps in its capabilities and explicitly upgrade from simple adaptive control to context-aware reasoning, structured planning, and verified tool use.

3. Add semantic contextualization beyond raw data — The AI will fuse multimodal physical observations (CSI, AoA, Doppler, range, SNR) into task-relevant semantic states (object identity, activity, risk, scene state, uncertainty). It will be able to answer what does this environment mean for my mission? rather than just what signals are present?

4. Incorporate uncertainty-calibrated world models — The system will maintain predictive models that couple physical, wireless, and computational state, returning calibrated uncertainty instead of point estimates. It can plan over a prediction horizon while quantifying confidence, enabling safer decisions under dynamic, heterogeneous conditions.

5. Enable hierarchical multi-timescale control — The AI will separate fast physical-control loops (millisecond beam tracking, power control) from medium-timescale orchestration (sensing priorities, resource budgets, collaboration topology) and slow cognitive learning (intent interpretation, world-model updates, continual learning). This allows real-time responsiveness without sacrificing long-horizon mission planning.

6. Build verified tool-use and safe execution mechanisms — The system will log tool calls, check feasibility between planned actions and controller constraints, and verify when a tool's output is trustworthy. It will be able to detect out-of-regime tool calls, roll back misconfigurations, and trigger recovery planning instead of blindly trusting sub-components.

7. Add agentic-specific evaluation and self-monitoring — The AI will continuously measure nine dimensions: contextual correctness, uncertainty calibration, goal completion, planning latency, constraint violations, tool-call success, coordination overhead, recovery time, and human-intervention frequency. It will report quantitative metrics on all of these—not just loss or accuracy—so operators can audit true autonomy.

8. Strengthen resilience with diagnosis and replanning — Beyond Byzantine-robust aggregation or fallback policies, the system will diagnose failures (e.g., poisoned sensing data, compromised nodes, coordination breakdowns), replan around them, isolate malicious components, and escalate unresolved issues. It will distinguish robustness from mission-level autonomy.

9. Support heterogeneous multi-agent collaboration — The AI will advertise its state, agree on task allocation under partial observability, and dynamically reconfigure as nodes join or fail—using explicit protocols for coordination rather than relying on centralized aggregation. It will handle mixed teams of UAVs, vehicles, RIS controllers, and edge servers.

10. Provide verifiable privacy and security guarantees — The system will incorporate differential-privacy accounting, certified robustness bounds, trusted execution, and formal policy verification, making its behavior auditable even when sensing and communication are tightly coupled. It will defend against cross-domain attacks (e.g., perturbing sensing waveforms to influence feature extraction or gradients).

11. Implement incentive-aware collaboration — The AI will account for resource-constrained nodes with different owners, costs, and incentives. It will use contribution-aware reward allocation, reputation scoring, and ledger-based verification to sustain participation and honesty in federated/distributed learning.

12. Optimize for sustainability and resource efficiency — The system will co-design learning, communication, and computation with renewable, carbon-aware infrastructure, reducing the persistent cognitive overhead of closed-loop operation while maintaining performance.

What the improved AI system can do:

• Autonomously manage a 6G ISAC network end-to-end: sense the environment, interpret mission intent (e.g., track the target while maintaining low-latency comms), plan multi-step actions across sensing/communication/computation/mobility, execute via specialized tools, and recover from failures—all without human intervention at each step.

• Provide trustworthy, auditable autonomy: every decision is backed by calibrated uncertainty, tool-call logs, feasibility checks, and measurable agentic performance metrics, so operators can trust it in safety-critical scenarios.

• Collaborate with other intelligent edge entities to jointly optimize spectrum, energy, and latency, adapt to node failures or malicious injections, and maintain mission continuity.

• Operate across timescales: react in milliseconds to channel changes, replan in seconds to new missions, and learn/update world models over longer horizons—closing the loop from physical-layer signal processing to cognitive reasoning.