News & Articles

AI has moved beyond simply answering questions or giving recommendations. By now, you may have heard a new(er) term floating around the internet: agentic AI. These are AI systems that can be given access to tools, company data, and applications, with the goal of performing tasks on a user’s behalf.

While this added functionality may improve efficiency, it can also create cybersecurity risks. For example, an AI system that can only draft emails inherently has different risks than one that’s able to view inboxes, see customer information and send emails on a person’s behalf. 

As businesses begin to use these agentic systems, they should consider both what information an AI agent can access and what authority an AI agent has to act on that information. 

What are key distinctions of agentic AI? 

An important difference in understanding the risk profiles between standard AI (like an LLM) and agentic AI is not just that the agent can perform more tasks. Instead, it is often an issue of access. For example, a conversation with an LLM may be a one-time input and output of that information, while the use of agentic AI may give the agentic system ongoing access and authority to operate inside company environments. This increase in access and authority has the potential to substantially increase the amount of risk that comes with this type of system, because agentic AI may be able to use its existing permissions to make decisions or perform actions without human oversight.  

Therefore, the level of access and permission an agent has can be pivotal to how risk is controlled and managed in an organization. An AI agent with narrow access and required human oversight/permission will likely present lower risks than one that is able to act independently without such restrictions. For businesses, this makes permissions, oversight and the ability to stop or limit an agent central to cybersecurity concerns.

How can businesses maintain control over AI agents? 

The National Institute of Standards and Technology’s AI Risk Management Framework (“NIST AI RMF”) provides a useful way for businesses to approach these risks. This voluntary industry standard framework organizes AI risk management into four functions: Govern, Map, Measure and Manage. Rather than just a checklist, this framework encourages organizations to establish responsibility for their AI systems, understand how they work, evaluate their risks and continue managing those risks throughout the AI lifecycle.  

This framework is flexible and can be applied to agentic AI systems. As a foundation, the principles outlined in the NIST RMF can help businesses answer practical security questions: Who is responsible for overseeing an agent? What is the agent’s intended role? What systems and sets of information does it need access to? What could happen if mistakes are made? And what measures are in place if its actions/behavior have to be limited or stopped?

Additionally, NIST has begun focusing specifically on identity and authorization risks for these AI agents, including issues like authentication and auditing. 

How can AI agents become a cybersecurity target?

Businesses may also consider attacks directed at the AI agent itself, such as prompt injection. Prompt injection is where instruction contained in a prompt (or input) is used to manipulate an AI agent’s behavior. For an AI agent, this prompt could be in an email, document or other outside content that the agent is asked to review. 

For example, pretend a business has an AI agent which is tasked at reading emails and has access to internal files. A malicious email might contain instructions attempting to persuade the AI agent to retrieve information it does not need and disclose sensitive information back to the sender of the email. This is a classic example of a prompt injection attack that deployers of AI agents should be aware of. 

NIST’s agent-security work specifically identifies prompt injection as an issue organization are recommended to consider when developing identity and authorization controls for agents. 

What safeguards should businesses look for? 

Security should not depend solely on the employee using an AI agent correctly. Instead, businesses should consider the protections that are built into the AI agent itself. 

For example, an AI agent may be designed with limited, instead of broad, access to company information by default. This way, the AI agent’s ability to access information is limited by permissions required to perform its rule. Higher-risk actions may require additional approval. For example, an agent might be allowed to draft an email independently, but sending sensitive information would require human confirmation, approval, and oversight of the agent. 

Businesses may also consider whether the agent creates records or logs of its own activity, whether different systems can be restricted, and if an agent’s access is able to be quickly suspended. These safeguards may limit damage caused by both mistakes and outside attacks that result in attempts to manipulate an agent. 

Again, the goal does not need to be to prevent AI from acting independently, but rather to ensure that its ability to act stays within clearly identified boundaries. 

Why does monitoring matter? 

Even when a business has security limits in place, it will still need to be able to identify when an AI agent behaves unexpectedly or attempts to go outside those pre-defined limits. 

A recent OpenAI incident provides a good example of why monitoring is essential.  In September 2026, an AI agent was given a search-based training task, and in completing the task, the agent found that there was a gap in internet access restrictions and used the internet to query an external chatbot. OpenAI reported that its monitoring system detected the unauthorized activity within about 15 minutes, and additional controls were added that would have blocked the access.

This incident highlights the possibility that setting permissions before deployment may not be enough to prevent AI agents from only acting within their boundaries. Put simply, businesses should also monitor what an agent does. For example, a standard review of an AI agent’s activity logs may help determine:

• What system an agent accessed,
• What actions it performed,
• When that action occurred,
• Whether sensitive information was involved, and,
• Whether the activity stayed within an agents assigned role/access.

Businesses should remember that cybersecurity runs in both directions, and risks can include: 1) protecting an AI agent from unauthorized access, and 2) monitoring the AI agent itself for unauthorized activity. If unusual activity occurs, businesses should know how to quickly respond. 

What happens if an AI agent accesses something it should not? 

Existing cybersecurity laws may also be relevant when an AI agent interacts with systems outside of the business. 

For example, the federal Computer Fraud and Abuse Act (“CFAA”) addresses certain access to protected computers without authorization or beyond its authorized access. Courts have already begun to explore how this law applies when an AI agent performs the action.

In Amazon.com Services LLC v. Perplexity AI, Inc., Amazon argued that Perplexity’s agentic browser violated the CFAA by accessing Amazon through users’ accounts. In August 2026, the Ninth Circuit vacated a preliminary injunction against Perplexity after concluding Amazon was unlikely to show that Perplexity itself has accessed Amazon’s computers. Instead, the court viewed the user as accessing Amazon with the AI agent helping perform the actions. 

In this case, the court made clear that its decision was limited to the facts of that case and did not create a broad rule for agentic AI. The bigger takeaway is that businesses should set clear limits on where their agents can operate and what they can access.

However, businesses should not assume they are off the hook just because an AI acted independently. California Civil Code § 1714.46 says a company cannot defend a claim by arguing that the AI caused the harm on its own. This does not mean the business is automatically liable, but it highlights why companies need to keep oversight and controls in place.

What should businesses take away?

Agentic AI are changing the way businesses operate, but giving an AI system the ability to act upon company data and applications should require additional security planning and considerations before deployment. Businesses deploying agentic AI may want to consider the following:

• Define the agent’s job: establish clear guidelines as to what the agent is supposed to do and what falls in and out of that role.
• Limit permissions: give the agent access only to the systems it absolutely needs to operate with for its assigned tasks.
• Keep humans in the loop: determine how best to monitor agentic AI’s actions and, where necessary, implement additional oversight. 
• Look for built-in safeguards: evaluate whether the agent supports limited permissions, approval controls, logging and quick revocation of access. 
• Monitor agent activity: maintain oversight to determine what the agent accessed and if it acted outside its role. 
• Avoid giving agents access to sensitive data: avoid giving an AI agent access to health, financial, employee or highly confidential client information.
• Protect against manipulation: consider how the agent interacts with potentially malicious emails, websites and other outside information.
• Prepare for incidents: establish protocols and procedures to quickly disable agents if needed. 

Agentic AI changes the cybersecurity question from what AI can see to what AI can do. Businesses need to understand this and limit authority, monitor activity and be prepared to step in if something goes wrong.