Agentic AI means models that can decide and carry out actions, not only produce text. For security teams the shift moves the focus from filtering model output to controlling what an agent is allowed to do: its identity, its permissions, the data it reads and how far a mistake can spread.
What counts as agentic?
The OWASP AI Exchange defines agentic AI systems as ones where a model's inference can specify actions to perform without per-action human approval, in contrast to just showing output for a person to read. It treats this as a spectrum rather than a switch. At one end is a mildly agentic system that performs a single action, such as an AI camera opening a door. Further along, agents also plan, then run in loops, and at the far end do all of that without human intervention.
It suggests asking about properties instead of labels: can the models trigger actions, what harm can they cause, are external services used, is untrusted data coming in, is memory kept for context and plans, and can actions send data out?
Why does this change the risk?
When a model only writes text, a bad answer is a bad answer. When it can call tools, a bad answer can be an email sent, a file deleted or a payment made. The OWASP AI Exchange notes that prompt injection can invoke unwanted actions or even escalate privileges, and that the limits of input controls mean blast radius control becomes more important. It also warns against making the model itself the security feature: developers often assign access control to the AI through instructions, which opens the door to manipulation.
The OWASP Agentic Security Initiative publishes a threat model based reference on agentic threats and mitigations, described as the first in a series of guides.
What controls matter most?
The AI Exchange highlights several:
- Least model privilege. Give each agent only the tools and data it needs. Its agentic authorization framework combines deny by default, enforcement at the infrastructure level, task bound tokens and agent identity.
- Oversight. Humans approve high impact actions, and logs let others review what happened.
- Input handling. Keep untrusted content separate from instructions, and check inputs and outputs.
- Machine to machine access control. Agent to service and agent to agent calls need scoped tokens and session binding, not shared static keys.
- Memory hygiene. Working memory holds an agent's state and plan, so it is a place an attacker can influence future behavior.
A constructed example
A company deploys an assistant that triages support email and can issue small refunds. A customer's email includes text asking the assistant to refund a larger amount and forward the account history to an outside address. A model only chatbot would just reply. This agent has two tools, and if both are unrestricted, both could fire. With least privilege, the refund tool caps at a small amount without approval, the send tool can only reach verified customer addresses, and every tool call is logged under the agent's own identity.
What should security teams do differently?
Treat agents as a new kind of identity, with an owner, a purpose, scoped credentials and a review date. Add agent actions to your audit logs, with enough detail to replay a decision. Include agent workflows in threat modeling, asking at each step what happens if the input is hostile. And test: red team prompts and tool paths, not only the model.
Safeguard offers an MCP Guardrail and agent identity capabilities aimed at this problem, and you can see how a guardrail behaves in the demo below.
How to check or apply this
- List every agent in use or planned, with its tools and data access.
- Give each agent its own identity and owner.
- Remove tools and permissions that are not needed for the task.
- Require human approval for irreversible or high value actions.
- Log tool calls with parameters and identity.
- Treat all retrieved content as untrusted input.
- Test hostile inputs against the full workflow before release.
Quick check
Can a system prompt enforce permissions?
No. Instructions can be overridden by manipulation. Enforce permissions in infrastructure and tokens that the model cannot change.
Is every chatbot agentic?
No. A system that only returns text for a person to read is not agentic. The risk rises as it gains tools, memory, autonomy and the ability to send data out.
Sources
- OWASP AI Exchange, AI Security Overview
- OWASP GenAI Security Project, Agentic AI Threats and Mitigations
Last reviewed: 18 October 2026.
