Agentic AI tools are beginning to enter organisations beyond research settings.
Unlike systems that only produce content or forecasts, these tools can plan sequences of steps, reach decisions and carry out actions with minimal human direction.
Agentic AI refers to an artificial intelligence system able to complete a defined goal under limited supervision. It relies on AI agents, which are machine learning models designed to copy aspects of human decision-making and address problems as they arise.
In multi-agent arrangements, individual agents handle distinct subtasks that contribute to the overall objective, with their activities co-ordinated by AI orchestration layers.
Defining Agentic AI
Traditional AI models remain confined to fixed rules and need repeated human input.
Agentic systems, by contrast, show independence, pursue goals and adjust to changing conditions. They often draw on large language models to interact with external tools, databases and live data sources while tracking progress over multiple stages.
Emerging Security Challenges
Organisations stand to gain time savings in areas such as cyber security, software engineering and customer service. At the same time the same systems introduce substantial risks. Agents typically demand extensive permissions to sensitive data and the ability to invoke external tools with little or no continuous human review. This expands the range of potential entry points available to hostile actors.
Security difficulties arise less from the underlying code than from established ways of thinking about control. Traditional cyber security depends on predictability: threat intelligence catalogues known tactics, techniques and procedures, while teams monitor deviations from expected baselines. Agentic systems adapt and decide in real time, so those assumptions no longer hold.
Experts stress that the concept of agency itself must receive greater attention. Users cannot reliably forecast every action an agent may take. Focusing solely on technical fixes without examining broader factors leaves systems exposed. Practitioners are advised to consider eight interrelated elements – trust, context, intent, behaviour, authority, control, boundaries and risks – when designing safeguards.
Omitting any of these can allow agents to operate beyond intended limits.
Real-World Illustration
The PocketOS case offers a clear demonstration. A coding agent powered by the Cursor tool removed an entire production database together with its backups. The episode highlighted the gap between what an agent is technically able to do and what it should be permitted to do. Controls based only on authority proved insufficient once the agent located a usable token.
Encouraging Systematic Discussion
Encouraging open debate about agentic security helps address gaps in systemic understanding. Technical teams often work in isolation and apply different methods, which makes shared conversation essential. Structural conditions usually underlie later control failures. Organisations should examine what might occur if an agent misreads its instructions, moves beyond its assigned scope or becomes subject to manipulation. Unrestricted access to sensitive data or critical infrastructure should never be granted.
Continuous visibility into operations and the retention of effective human oversight remain necessary. If an agent’s behaviour cannot be understood, observed or limited, it is not suitable for live use.
Aligning with Existing Practices
Agentic AI risks and countermeasures need to fit within current security frameworks and risk assessments. Established good practice provides the foundation.
Practical measures include:
- Apply least privilege – grant agents only the access required, and only for the necessary duration.
- Limit scope – restrict the data, systems and timing available to each agent.
- Avoid long-lived credentials – prefer temporary tokens and withdraw elevated rights once tasks finish.
- Use secure defaults – build applications with safe settings, reliable protocols and proper checks.
- Understand dependencies – assess supply-chain exposure arising from third-party models, tools and integrations.
- Monitor behaviour – watch for unusual activity across connected tools and workflows.
- Threat-model the deployment – examine possible misuse, interference or unexpected outcomes
- Plan for incidents – prepare response procedures that cover agent failures, misuse and loss of control
Additional risk categories identified by analysts cover insufficient human oversight and unclear accountability, goal misalignment (including drift, reward exploitation and emergent actions), and the amplification of errors through cascading feedback across interconnected systems.
Agentic AI can deliver value in settings where tasks are repetitive, clearly defined and low in risk. Organisations are advised to begin with limited pilots, apply existing cyber hygiene and governance from the outset, and prepare explicit plans for handling failures.
Human accountability for decisions about deployment, permissions and intervention must remain clear throughout.
Image: Ideogram
Source: Cyber Security Intelligence