AI Agent Security: What Changes When the Assistant Can Act

The 30-second explanation

A chatbot answers questions. An agent goes and does things: it reads your inbox, books the meeting, edits the file, runs the command. That is the whole appeal, and it is also the whole risk. A wrong answer on a screen is easy to ignore. A wrong action, like a deleted folder or an email sent to the wrong person, is much harder to undo. And an agent can be steered by the text it reads along the way, such as an email or a web page, as well as by the person who gave it the job.

How it works

1. 1

   1. Goal

   A user gives the agent a task, such as 'clear out my inbox' or 'fix this failing test'.

2. 2

   2. Plan and act

   The model chooses a tool, such as reading mail or editing a file, and runs it.

3. 3

   3. Read the result

   Whatever the tool returns, including any text inside emails or web pages, goes back into the model's context.

4. 4

   4. Repeat or finish

   The agent decides the next step. With no human checkpoint, one bad step leads straight into the next.

On its own, a language model only produces text. An agent connects that model to tools, such as a mailbox, a calendar, a file store, a browser or a shell, and lets it work toward a goal over several steps. It decides what to do, calls a tool, reads what comes back and decides again. That is useful because the work gets done without a person at every step. It also changes the security picture in three ways. First, every tool carries permissions, so an agent with the run of a mailbox can do anything the mailbox allows. Second, the agent reads untrusted content as it works. An email, a web page or a document can hide instructions, and the model may follow them, which is prompt injection with real consequences attached. Third, small mistakes compound across steps, and an agent given a vague goal can pick a destructive way to reach it. The defences are ordinary security practice. Give each agent the smallest set of tools that does the job, keep read-only tools apart from ones that change things, require a person to approve anything with real consequences, cap the steps and the spending, and keep a log of every action so mistakes can be traced and undone.

Real-world example

How to spot it

• Tools the task never needs

  An agent holding mail, file and shell access for a job that only requires reading one document.

• No approval for consequential actions

  Sending, deleting, paying or changing settings happens automatically, with no person in the path.

• Loops with no limit

  No cap on steps, time or spend, so a confused agent keeps going.

• No record of what it did

  Without a log of every tool call and its inputs, nobody can tell what the agent did, let alone undo it.

What to do

1. 1Give each agent only the tools and permissions its task needs, and keep read-only tools separate from ones that change things.
2. 2Require human approval for anything with real consequences: sending data outside the organisation, deleting, spending money or running commands.
3. 3Run agents in a sandbox with limits on steps and spend, and log every tool call so actions can be reviewed and reversed.