Yes. A plain RPA bot follows fixed steps, while an AI step reads text, such as an email or a document, and decides something from it. That text may be written by an outsider. So the AI step needs untrusted input handling, tight limits on what the bot can then do, and a human approval on risky actions.
What changes when AI enters a bot
Wikipedia's overview contrasts RPA with AI by saying RPA follows a predefined workflow. Once you add an AI step, part of the workflow is no longer predefined. The model's output depends on its input, and input can come from customers, suppliers or anyone who can send an email.
The OWASP Citizen Development Top 10 now covers risks from AI assisted coding and AI agents as well as low-code platforms, and its first entry is called Blind Trust. Trusting the output of an AI step without checking it is a clear example.
Typical risks
| Risk | Example | Control |
|---|---|---|
| Hidden instructions in input | An invoice contains text telling the model to change a bank detail | Treat all content as data, never as instructions |
| Wrong output accepted | The model misreads an amount and the bot pays it | Check values against rules, not just the model |
| Excess access | The bot can read the whole mailbox or drive | Narrow its access to what the task needs |
| Data sent out | The step sends records to an outside service | Know where data goes and approve it |
| No record of why | A decision cannot be explained later | Log the input reference, output and the decision taken |
A safer design
- Split the job. Let the AI step classify or extract, and let fixed rules decide what action follows.
- Validate the output. Check types, ranges and allowed values before anything is written.
- Limit the tools. The bot account behind the AI step should be able to do only the small set of actions the task needs.
- Require approval for anything irreversible, for example payments, deletions or external messages.
- Keep a person's decision on the record. Log who approved, what they saw and when.
- Test with hostile samples. Feed the step documents with planted instructions and confirm the bot ignores them.
We cover a related decision for payments in how to give an AI step in an automation access to payments safely.
Who should approve AI steps
Treat adding an AI step as a change that needs the same review as a new integration. Ask where the data goes, what the step can trigger, who owns it, and how you would switch it off quickly.
What not to promise
Do not tell customers that an AI step is safe or that it removes human error. Say what controls you run, such as input checks, approval gates and logs.
Where Safeguard fits
Safeguard offers MCP Guardrail and agent identity for teams that connect AI agents to tools, plus policies and guardrails around what automation may do. Check whether your automation uses those protocols before relying on that.
Quick check
Does an AI step make an RPA bot an AI agent?
Not necessarily. It becomes more agent like as it gains the ability to choose actions, so limit its tools and add approvals.
Can I rely on the model to ignore hidden instructions?
No. Design as if some will get through, and make sure the worst result is small and reversible.
Sources
Last reviewed: 19 October 2026.
