Artificial intelligence was initially sold to organisations as a way to make people more productive. It could summarise documents, analyse data, draft correspondence, generate code and answer operational questions in seconds.
Then AI began moving from conversation to action.
Agentic AI can now plan workflows, use software tools, access APIs, retrieve information and make operational decisions with limited human intervention. Some systems can even delegate tasks to other agents.
That changes the cybersecurity equation.
In a previous publication of mine which I titled, Your AI Strategy Is Incomplete Without an AI Security Strategy, I argued that organisations cannot pursue AI adoption while treating security as an afterthought. That argument remains valid, but agentic AI raises a more urgent question, which is, what happens when an autonomous system has the authority to act across an organisation’s infrastructure after it has been compromised?
The central vulnerability is no longer simply whether an AI model can be manipulated into producing harmful or confidential information. It is whether a compromised agent can use legitimate access to take consequential actions.
That is the defining security challenge of the agentic era.
The New Software Insider
Traditional software waits for explicit instructions and operates within predefined rules. An AI agent receives an objective and determines how to achieve it. It selects tools, retrieves information and acts on the environment around it.
That autonomy makes agents commercially valuable. It also makes them difficult to secure.
When an organisation gives an employee access to sensitive systems, identity governance determines what that person can see, what they can change and how their actions are recorded. An AI agent should face the same scrutiny.
Granting an agent broad access to corporate databases and APIs without a security architecture is effectively giving a non-human actor privileged access to the organisation.
The difference is speed.
A human may make one damaging decision. An agent connected to an ERP, CRM or financial system can make hundreds of consequential decisions before anyone notices.
The agent therefore becomes a new kind of insider: an authorised non-human insider.
When Legitimate Access Becomes an Attack Vector
Consider an autonomous customer-support agent authorised to access customer records, transaction histories and refund systems.
An attacker may not need to breach those systems directly. A malicious instruction embedded in a customer email, support ticket, document or webpage could manipulate the agent into using its legitimate permissions against the organisation.
This is the danger of indirect prompt injection.
The attacker does not necessarily need to steal credentials. They can persuade an authorised agent to misuse the authority it already has.
The principle of least privilege therefore needs to apply to machines as rigorously as it does to people.
An agent that schedules meetings should not have access to financial records. An agent that analyses financial data should not be able to initiate transfers. Credentials should be temporary, scoped and revocable rather than permanent keys with broad access.
The more capable an agent becomes, the more disciplined its boundaries must be.
The Problem Gets Harder When Agents Talk to Agents
The risk becomes more difficult to contain when organisations deploy networks of autonomous agents.
Imagine one agent retrieving external data, another interpreting it, a third calling a financial API and a fourth updating internal records.
A security incident can then become a chain rather than a single event.
Where did the malicious instruction enter the system?
Which agent acted on it?
What information did that agent receive?
What permissions were active at the time?
Can the organisation reconstruct the chain afterwards?
These questions expose a weakness in conventional security monitoring.
Traditional tools are good at recording logins, network traffic and system events.
Agentic systems introduce another layer: machine decisions shaped by context, prompts and interactions between agents.
Without detailed tracing of those interactions and tool calls, investigators may know that something went wrong without being able to establish how it happened.
That is a serious incident-response problem.
‘Human in the Loop’ Is Not Enough
Organisations often describe human oversight as their primary safeguard against AI risk. But oversight is meaningless if the human cannot intervene at the speed of the system.
If an agent can execute hundreds of actions in minutes, reviewing its activity hours later is not real-time control.
Effective governance requires observability.
Organisations need to know what an agent was instructed to do, what information it accessed, which tools it used, what permissions it exercised and what actions followed.
They also need to confront a growing problem: shadow agency.
The next version of shadow IT will not simply be employees using unauthorised software. It will be employees deploying autonomous agents with access to local files, internal systems, credentials and external communication channels without their organisation fully knowing they exist.
Agent sprawl could become one of the defining enterprise security problems of the late 2020s.
Five Questions Every AI Agent Should Answer
Organisations do not need an entirely new philosophy of cybersecurity. They need to apply established security principles to a new class of actor.
Every enterprise AI agent should be able to answer five questions:
1. What can it see?
Define strict boundaries around the data, repositories and APIs it can access.
2. What can it do?
Separate information retrieval from actions that modify records, move money, send communications or deploy code.
3. Who authorised it?
Maintain a clear and verifiable chain of human accountability for high-impact actions.
4. Can we observe it?
Capture sufficient telemetry to reconstruct its decisions, interactions and tool use.
5. Can we stop it?
Build in anomaly detection, permission revocation and reliable kill-switches.
These controls should exist before an agent is trusted with consequential authority, not after an incident exposes the gap.
My experience working with complex digital publishing systems reinforces a simple principle that information should never automatically become authority.
In media organisations, external copy, user submissions and third-party information pass through verification and editorial controls before they can influence what gets published. Enterprise AI needs a comparable separation between information and instruction
An external document may contain useful information. That does not mean it should be allowed to instruct the system.
When information can directly trigger execution, the information itself becomes part of the attack surface.
Securing Agency, Not Just AI Models
The agentic AI revolution will create enormous opportunities for organisations willing to automate complex work. But the security model cannot remain focused primarily on protecting models and data.
The real question is authority.
What has the organisation allowed the machine to see?
What has it allowed the machine to change?
What happens when the machine is manipulated?
And, crucially, can humans still stop it?
Every serious security architecture assumes that something will eventually fail. Credentials will be compromised. Software will contain vulnerabilities.
People will make mistakes. Systems will behave unexpectedly.
Autonomous AI deserves the same assumption.
The organisations that navigate the agentic era successfully will not be those that give machines the most power. They will be those that can give machines meaningful agency while retaining meaningful human control.
The future of AI security is therefore not about eliminating autonomy. It is about securing agency.