Try this at your next team meeting. Ask who knows exactly how many AI agents your company has running right now, and what each one’s allowed to touch. Then watch the silence. That silence is the problem, not a side note. A 2026 enterprise survey found 88% of organizations had a confirmed or suspected AI agent security incident in the past year. Not a fear. Not a projection somebody dreamed up to sell you a subscription. Already happened. To nearly nine out of ten companies asked.
Agentic AI isn’t the chatbot everyone got used to over the last couple of years. Not even close. A chatbot answers a question and waits for the next one. An agent goes and does things. Books the meeting. Pulls the report. Updates the record. Sends the email. Moves the file. Give it a goal, and it strings together steps on its own, often reaching into three or four different systems along the way. That’s what makes it useful. And it’s exactly what makes it dangerous the second something manages to manipulate it.
Security professionals have already cast their vote on how seriously to take this. A Dark Reading readership poll found 48% of cybersecurity professionals now name agentic AI security as the single biggest concern heading into 2026, ahead of deepfakes, ahead of passwordless adoption, ahead of pretty much everything else on the list. So, here’s why that risk looks so different from what came before, how agents actually get exploited, and what you can realistically do about it, whether you’re running a handful of AI workflows or you’re a hundred agents deep already.
Why Agentic AI Changes the Risk Equation
Traditional software runs on code someone wrote and reviewed. It does what it’s told, every single time, the same predictable way, forever. An AI agent doesn’t work like that. It runs on a language model interpreting a goal and deciding, on its own, what steps get it there. That’s the whole point of the technology. It’s also why the old security playbook doesn’t fully apply anymore, and that gap is where most of AI agent security actually lives.
A regular app has a fixed set of things it can do. A security review can list every single one, start to finish, in an afternoon. An agent won’t sit still for that kind of review. Its behavior shifts depending on what it reads, what it’s told, what tools happen to be available in that moment. You can’t fully predict it. You can’t patch it the way you’d patch a known software bug. Researchers studying this space describe an “agent estate” that changes weekly, sometimes daily, which means any security review is basically stale before the ink dries.
And here’s the part that makes it worse. Most agents run with far more access than they actually need. A finance agent built to answer billing questions might, in practice, have read access to the entire customer database, simply because nobody bothered to scope its permissions down. That’s not a hypothetical I’m inventing to scare you. It’s the default state of most agent deployments right now, and it’s exactly the kind of gap that turns a small manipulation into a very large incident.
Permissions: The Problem Hiding in Plain Sight
Be honest for a second. Does every AI agent at your company only have access to what it strictly needs? Or did someone just grant broad access because it was faster to set up that way? For most companies, it’s the second one. And that single shortcut is doing more damage than almost anything else on this list.
Security researchers have a name for this: excessive agency. It gets flagged, over and over, as one of the top risks in agentic systems, and for good reason. When an agent has more reach than its job requires, a successful manipulation doesn’t just produce a wrong answer. It produces an unauthorized action. Wrong answers are annoying. Unauthorized actions move money, delete files, expose customer data.
The fix has a name every security professional already knows: least privilege. Give each agent access only to the specific systems and data it needs for its specific job, nothing more. Add approval gates for anything consequential, a wire transfer, a bulk data export. Sounds obvious once it’s written down like that, doesn’t it? It’s rarely how agents actually get deployed in practice, because scoping permissions down takes real work up front, and skipping that work feels harmless right up until the day it isn’t.
Prompt Injection: The Threat You’ve Probably Never Explained to Your Team
Learn one term from this whole article. Make it this one. Prompt injection happens when someone hides instructions inside content your agent reads: an email, a webpage, a document, a database entry. Those hidden instructions hijack the agent’s behavior. The agent doesn’t even realize anything’s wrong. OWASP ranked it the top threat to LLM applications. NIST went further and called indirect prompt injection generative AI’s single biggest security flaw. Full stop.
What makes it genuinely unnerving is that it’s not theoretical anymore. Not even a little. In June 2025, researchers disclosed EchoLeak, a zero-click vulnerability in Microsoft 365 Copilot. A single crafted email, no link to click, no attachment to open, could trigger Copilot to quietly pull internal files and ship them off to an attacker’s server. No user interaction required. None. The victim didn’t do anything wrong. They just had an email land in their inbox like any other Tuesday. Microsoft rated it critical and pushed emergency patches, but the incident proved something security teams had been arguing about for two years straight: prompt injection isn’t a lab curiosity anymore. It’s a working exploit against production systems people rely on every single day.
And it’s happened elsewhere. Slack’s AI assistant got tricked by an injected prompt into echoing private channel tokens straight to an attacker. A separate technique called ASCII smuggling got Microsoft 365 Copilot to encode sensitive data into invisible characters hidden inside a Markdown image link, then quietly transmit it out. None of these are edge cases some researcher dreamed up with too much free time on their hands. They’re documented incidents against tools plenty of businesses already use every day.
Agent Hijacking: When Your Own Tool Turns Against You
Prompt injection is the how. Agent hijacking is the what happens next. An attacker uses that injected instruction to seize ongoing control of an agent and turn it into a tool working for them, not you. Researchers have documented cases involving AutoGPT where poisoned memory entries caused an agent to keep acting on an attacker’s behalf across multiple sessions, well after the original injection happened. The agent looked completely normal to anyone watching. It just wasn’t working for the company anymore. It was working for someone else entirely.
The scariest version of this isn’t some curious researcher poking at a demo. It’s a nation-state operation. Security researchers have documented a state-sponsored campaign, tracked as GTG-1002, where hijacked coding agents reportedly carried out somewhere between 80 and 90% of an espionage operation against roughly thirty targets, largely on autopilot. Read that again, slowly. The bulk of an actual espionage campaign, executed by AI agents that had been turned, with barely any ongoing human direction from the attacker who compromised them in the first place. That’s not a distant future risk you can push off to next year’s budget cycle. That’s already happened.
Data Leakage: The Quiet Version of the Same Problem
Not every incident needs a dramatic hijacking to hurt you. Sometimes an agent just leaks data because nobody thought carefully about where its outputs actually go. Agents summarizing documents, answering customer questions, or pulling records for a report can end up dropping sensitive information into a response that gets logged, cached, forwarded, or displayed somewhere it never should’ve landed. Add memory into the mix, where an agent retains information across sessions, and one bad interaction can quietly contaminate everything that agent does afterward. There’s no clever fix here, just plain discipline: know what data your agents can touch, log what they actually access, review those logs on a schedule, not just after something’s already gone wrong.
Credential Theft and the Identity Nobody’s Watching
Go ask your IT team this, today. Do your AI agents share login credentials and API keys with each other, or does each one have its own? Research puts the share of organizations using shared API keys across agents at 45.6%. Sounds like a small technical footnote. It isn’t. If one agent gets compromised, the attacker doesn’t just get that agent. They get everything else using the same credential too.
This falls under a category security teams call non-human identity: any credential that lets software authenticate and act without a person directly involved. It’s growing faster than most companies can track, and that’s not an exaggeration for effect. Every agent, every automated script, every service account counts as a non-human identity. Most companies now have vastly more of these than they have actual employees, with far less oversight on each one. Part of building real autonomous AI security means treating these credentials with the same seriousness you’d give a human employee’s login. A few dedicated tools have popped up to handle exactly this: Astrix Security, Entro Security (recently acquired by SailPoint), and Oasis Security, among others. All of them discover, inventory, and enforce least-privilege access across every non-human identity in an organization, agents included. Pricing across this category is almost entirely custom and quote-based, since cost scales with how many identities and integrations you’re covering, but expect it to land in roughly the same range as other enterprise identity tools once you’re past a pilot.
Shadow Agents: Shadow IT’s Faster, Sneakier Cousin
You already know shadow IT, all that unapproved software employees quietly installed without telling anyone. Shadow agents are the same story, just worse. An agent doesn’t sit there passively like an unauthorized app might. It acts. It reads files. It sends messages. It touches systems. All without your security team having any idea it exists.
Picture this. Someone on your team finds an open-source AI agent that automates a task they find tedious. They plug it into their workflow because it saves an hour a day, and they never mention it to IT, because why would they think that’s necessary? Now you’ve got an agent with unknown permissions, unknown data access, and zero monitoring, quietly running inside your business like it belongs there. When shadow data (information sitting in places security teams don’t even know about) meets shadow agents, the risk doesn’t just add up. It compounds. More than a third of breaches now involve shadow data of some kind, and shadow agents are quickly becoming the newest way that hidden information gets touched, moved, and exposed.
Supply Chain: The Risk Living Inside Your Dependencies
Your agents don’t run in isolation. Worth remembering. They rely on plugins, connectors, and increasingly the Model Context Protocol, or MCP, a standard that lets agents talk to external tools and data sources. Every one of those is a potential entry point, and attackers figured that out well before most businesses did.
A backdoored version of LiteLLM, a widely used tool for routing requests between AI models, got downloaded roughly 47,000 times during the three hours it sat on PyPI before anyone caught it. Three hours. A malicious package called postmark-mcp shipped fifteen clean releases first, quietly building up trust and a track record, before an update added code that exfiltrated emails. A remote code execution vulnerability found in widely used MCP infrastructure scored 9.6 out of 10 on the CVSS severity scale, about as bad as these ratings get. None of this requires an attacker to break into your systems directly. They just need to compromise something your agent already trusts, then wait.
Human Oversight: Don’t Let the Machine Make the Call Alone
Here’s one that’s become a cautionary tale in this industry. Air Canada’s chatbot told a customer he could get a bereavement fare refund after the fact, based on outdated information the bot didn’t realize was wrong. The airline argued the bot’s promise wasn’t legally binding. A tribunal in British Columbia disagreed, flatly, and made Air Canada honor what its own AI had told the customer. The lesson isn’t really about airline refund policy. It’s that whatever your agent says and does, your business owns it. Whether a human reviewed it first or not.
That’s exactly why human-in-the-loop review matters most for anything consequential: financial transactions, legal commitments, customer-facing promises, anything expensive or embarrassing to walk back later. Build in approval gates for those specific categories of action. Let the agent draft, recommend, prepare. Keep a person in the loop before it actually commits to something that can’t be quietly undone.
Zero Trust: Stop Assuming Your Agents Are Behaving
Zero trust used to be a phrase mostly applied to human users and devices: verify everything, trust nothing by default, check again at every step. Apply that exact same logic to your AI agents. Don’t assume an agent is behaving normally just because it hasn’t triggered an alarm yet. Silence isn’t the same thing as safety. Verify every action against policy. Log everything. Build in the ability to instantly revoke an agent’s access the moment something looks off; the same way you’d lock a compromised employee account without a second thought.
This matters even more once you’re running multi-agent systems, where several agents work together and pass tasks between each other. Researchers analyzing a large agent network found that 2.6% of posts between agents contained hidden prompt injection payloads, meaning agents were quietly trying to manipulate other agents, not just humans. If one agent in a chain gets compromised, and nothing’s verifying what it hands off downstream, that compromise can spread through your entire agent fleet before a single person notices.
Governance: Turning All of This into an Actual Policy
Every technical fix above falls apart without governance behind it. And governance, here, just means documented ownership, clear rules, and someone whose actual job includes checking that the rules get followed, not left in a slide deck from last year’s kickoff meeting. A few frameworks are worth knowing, even if you don’t go deep on any of them right away.
OWASP publishes a Top 10 for Agentic Applications, covering the risks unique to autonomous AI systems specifically. NIST’s AI Risk Management Framework offers a broader structure for handling enterprise AI risk generally, agentic or not. MITRE ATLAS catalogs real adversarial techniques used against AI systems, similar in spirit to how MITRE ATT&CK works for traditional cybersecurity. You don’t need all three cover to cover. Pick whichever one best matches your industry and existing compliance obligations, and use it as your baseline instead of starting from a blank page.
Practically speaking, good AI governance boils down to one thing: keeping an actual inventory of every agent running in your business, who owns each one, what it can access, and how its behavior gets reviewed. Can’t answer those four things right now, for every single agent your company runs? That’s your starting point. Not the finish line.
Your Security Checklist for Agentic AI
Roughly in order of how much each one matters, and how fast you can actually move on it:
– Apply least privilege to every agent: access only to what its specific job requires, nothing broader
– Build a complete inventory of every AI agent running in your business, including the ones nobody officially approved
– Log everything an agent does, and actually review those logs on a regular basis, not just after something’s already gone sideways
– Pick a governance framework (OWASP’s Agentic Top 10 is a reasonable place to start for most businesses) and use it to structure your policy, rather than inventing one from scratch
– Require human approval for anything consequential: payments, legal commitments, customer-facing promises, bulk data actions
– Stop sharing API keys and credentials across multiple agents. Give each one its own identity
– Treat prompt injection as a real, active threat rather than a theoretical one, and ask any AI vendor you use directly how they defend against it
– Vet every plugin, connector, and MCP integration before connecting it to a live agent, the same way you’d vet any third-party software
The Bottom Line
Agentic AI is genuinely useful, and it isn’t going away. Pretending the risk doesn’t exist won’t make it disappear either. The businesses that get hurt here won’t be the ones using AI agents. They’ll be the ones who deployed agents the way they’d deploy any normal app: broad access, no real oversight, nobody checking in six months later to ask what’s actually running and what it can touch. Treat every agent the way you’d treat a new employee with access to sensitive systems. Give it only what it needs. Watch what it does. Have a plan ready for the day it does something you didn’t expect. Because at the rate this technology’s spreading through business operations, that day is coming for a lot of companies, ready or not.
Praveen Kumar Panjiar is the founder of CompareBizTech.com, where he cuts through the noise in B2B tools with sharp, no-fluff comparisons. His work focuses on breaking down features, pricing, and real-world use cases, built specifically for high-intent buyers evaluating tools and looking to choose the right solution, fast.