Why agentic AI creates new risk categories
The core problem with agentic AI risk is that the AI system acts, not just responds. A chatbot answers a question; an agent books a flight, sends an email, or modifies a database record. The consequences of an agentic action are external to the system itself — which means errors, manipulation, or policy violations cannot always be caught by reviewing the model's output.
Three properties of agentic systems expand the risk surface beyond conventional AI:
- Multi-step execution: Agents decompose goals into sub-tasks and execute them in sequence. Each step creates an opportunity for the system to take an unintended or unauthorized action.
- Tool use: Agents call external APIs, read and write files, query databases, and trigger workflows. These capabilities give the agent real-world reach that a chatbot cannot have.
- Environmental input processing: Agents retrieve and act on content from the environment — web pages, documents, emails. This content may contain adversarial instructions designed to redirect the agent's behavior, a technique known as prompt injection.
The four categories of agentic AI risk
1. Unauthorized access and privilege escalation
Agents that use tools often inherit the permissions of the user or system account that deploys them. Without scoped, least-privilege credentials, an agent may read data, call endpoints, or trigger workflows it was never intended to reach. In multi-agent architectures, a compromised or misbehaving agent can chain permissions across systems beyond the scope of any individual authorization decision.
2. Data exfiltration
An agent with read access to business systems and write access to external communication channels — email, webhooks, API calls — creates a data exfiltration path that traditional DLP tools cannot see. The risk is amplified when agents are configured to summarize documents, generate reports, or respond to external queries on behalf of the organization.
3. Irreversible or destructive actions
Unlike a chatbot generating a response that a human reviews before acting on, agents execute directly. A misconfigured or manipulated agent may delete records, send communications, execute financial transactions, or modify production systems before any human has reviewed the intent or the action. Not all of these effects can be undone.
4. Indirect prompt injection
When an agent processes untrusted external content — a retrieved document, a web page, an email — that content may embed instructions designed to hijack the agent's goal. The agent treats the injected instructions as legitimate task input and executes them under the authorization context of the system it is running on. This attack class is specific to agentic systems and has no direct equivalent in conventional application security. The OWASP LLM Top 10 lists prompt injection as the top LLM application risk.
Agentic AI risk vs. traditional AI risk
Traditional AI governance frameworks focus on model behavior: bias, hallucination, fairness, and safety in outputs. Agentic AI risk is a different problem — it concerns what the agent does in the world, not what the model says.
| Traditional AI risk | Agentic AI risk | |
|---|---|---|
| Primary concern | Model outputs (bias, hallucination, safety) | Agent actions (tool calls, data access, side effects) |
| Failure mode | Wrong or harmful response | Unauthorized or irreversible action |
| Observable by | Reviewing model output | Inspecting tool calls, access logs, external effects |
| Mitigation layer | Model safety training, output filtering | Runtime policy enforcement, human approval gates |
| Reversibility | Mostly reversible — responses can be ignored | Sometimes not — sent emails, modified records, API calls |
How to mitigate agentic AI risk
Effective mitigation operates at the infrastructure layer, not the prompt layer:
- Least-privilege tool access: Every agent should have a scoped credential that permits only the specific tools and data ranges required for its task. Session-scoped credentials should expire when the task completes.
- Pre-execution approval gates: High-risk actions — sending data externally, modifying production records, triggering financial transactions — should require explicit human approval before the agent proceeds.
- Tamper-evident audit logs: Every tool call, data access, and model decision should be logged with a structured, immutable record that enables forensic reconstruction of what the agent did and why.
- Input sanitization for retrieved content: Content retrieved from untrusted sources should be inspected for prompt injection patterns before the agent processes it as task input.
- Kill switches and emergency stops: Agentic systems should be stoppable mid-task without corrupting state, and the stop action should itself be logged.
