Don’t ignore the safety risks of agentic AI

In the race to deploy agentic artificial intelligence systems across workflows, an uncomfortable truth is being ignored: Autonomy invites unpredictability, and unpredictability is a security risk.  If we don’t rethink our approach to safeguarding these systems now, we may find ourselves chasing threats we barely understand at a scale we will’t contain.

Agentic AI systems are designed with autonomy at their core. They’ll reason, plan, take motion across digital environments and even coordinate with other agents. Consider them as digital interns with initiative, able to setting and executing tasks with minimal oversight.

However the very thing that makes agentic AI powerful — its ability to make independent decisions in real-time — can be what makes it an unpredictable threat vector. In the frenzy to commercialize and deploy these systems, insufficient attention has been given to the potential security liabilities they introduce.

Whereas large language model-based chatbots are mostly reactive, agentic systems operate proactively. They may autonomously browse the online, download data, manipulate application programming interfaces, execute scripts and even interact with real-world systems like trading platforms or internal dashboards. That sounds exciting until you realize how few guardrails could also be in place to watch or constrain these actions once set in motion.

‘Can’ vs. ‘should’

Security researchers are increasingly raising alarms in regards to the attack surface these systems introduce. One glaring concern is the blurred line between what an agent can do and what it should do. As agents gain permissions to automate tasks across multiple applications, additionally they inherit access tokens, API keys and other sensitive credentials. A prompt injection, hijacked plugin, exploited integration or engineered supply chain attack could give attackers a backdoor into critical systems.

We’ve already seen examples of huge language model agents falling victim to adversarial inputs. In a single case, researchers demonstrated that embedding a malicious command in a webpage could trick an agentic browser bot into exfiltrating data or downloading malware — with none malicious code on the attacker’s end. The bot simply followed instructions buried in natural language. No exploits. No binaries. Just linguistic sleight of hand.

And it doesn’t stop there. When agents are granted access to email clients, file systems, databases or DevOps tools, a single compromised motion can trigger cascading failures. From initiating unauthorized Git pushes to granting unintended permissions, agentic AI has the potential to duplicate risks at machine speed and scale.

The issue is exacerbated by the industry’s obsession with capability benchmarks over safety thresholds. Much of the main focus has been on what number of tasks agents can complete, how well they self-reflect or how efficiently they chain tools. Relatively little attention has been given to sandboxing, logging and even real-time override mechanisms. Within the push for autonomous agents that may tackle end-to-end workflows, security is playing catch-up.

The necessity to catch up — fast

Mitigation strategies must evolve beyond traditional endpoint or application security. Agentic AI exists in a gray area between the user and the system. 

Role-based access control alone won’t cut it. We want policy engines that understand intent, monitor behavioral drift and may detect when an agent begins to act out of character. We want developers to implement fine-grained scopes for what agents can do, limiting not only which tools they use, but how, when and under what conditions.

Auditability can be critical. A lot of today’s AI agents operate in ephemeral runtime environments with little to no traceability. If an agent makes a flawed decision, there’s often no clear log of its thought process, actions or triggers. That lack of forensic clarity is a nightmare for security teams. In at the least some cases, models resorted to malicious insider behaviors when that was the one solution to avoid alternative or achieve their goals—including blackmailing officials and leaking sensitive information to competitors

Finally, we want robust testing frameworks that simulate adversarial inputs in agentic workflows. Penetration-testing a chatbot is one thing; evaluating an autonomous agent that may trigger real-world actions is a very different challenge. It requires scenario-based simulations, sandboxed deployments and real-time anomaly detection.

Halting first steps

Some industry leaders are starting to reply. OpenAI LLC has hinted at dedicated safety protocols for its recentest publicly available agent. Anthropic PBC emphasizes constitutional AI as a safeguard, and others are constructing observability layers around agent behavior. But these are early steps, and so they remain uneven across the ecosystem.

Until security is baked into the event lifecycle of agentic AI, moderately than being patched on afterward, we risk repeating the identical mistakes we made through the early days of cloud computing: excessive trust in automation before constructing resilient guardrails.

We are not any longer speculating about what agents might do. They’re already executing trading strategies, scheduling infrastructure updates, scanning logs, crafting emails and interacting with customers. The query isn’t whether or not they’ll be abused — but when.

Any system that may act have to be treated as each an asset and a liability. Agentic AI could turn out to be some of the transformative technologies of the last decade. Nevertheless, without robust security frameworks, it could also turn out to be some of the vulnerable targets.

The smarter these systems get, the harder they’ll be to manage on reflection. Which is why the time to act isn’t tomorrow. It’s now.

Isla Sibanda is an ethical hacker and cybersecurity specialist based in Pretoria, South Africa. She has been a cybersecurity analyst and penetration testing specialist for greater than 12 years. She wrote this text for SiliconANGLE.

Image: SiliconANGLE/Google Whisk