AI Agent Security Risks: When AI Acts on Its Own

Most AI agent security risks come down to a single shift: a chatbot only talks, but an agent acts. When you ask a normal chatbot something, it answers, and you decide what to do next. An AI agent skips that step. It can send the email, run the code, update the spreadsheet, or place the order on its own. That autonomy is exactly what makes agents useful, and exactly what makes them risky.

This is not a theoretical worry anymore. In 2026, research from the Cloud Security Alliance and Token Security found that 65% of organizations had at least one AI-agent-related security incident in the past year. This guide is the map of what can actually go wrong when AI acts on its own, so you can spot the risk before you hand an agent the keys.

I got a first-hand reminder of this while writing this post. I let Claude act as an agent in my browser, searching and clicking on my behalf, and before it could do anything it asked for two macOS permissions: full control of my mouse and keyboard, and the ability to record my screen. The access is genuinely useful, and it is also a lot of reach to hand any piece of software. It is exactly the kind of broad access that turns a small agent mistake into a real one.

Letting Claude act in my browser meant granting full mouse and keyboard control plus screen recording. That reach is the point, and the risk.

Chatbots propose, agents act

A regular chatbot has a natural safety valve: you. It proposes, you dispose. Nothing happens in the real world until a human takes the next step. An agent removes that valve. Give it access to your email, files, and tools, tell it a goal, and it will take whatever actions it decides are needed to reach that goal.

A chatbot proposes and you dispose. An agent removes the human step and acts on its own, which is where the risk begins.

That single change turns a wrong answer into a wrong action. A chatbot that misunderstands you wastes a minute. An agent that misunderstands you might email the wrong person, delete the wrong file, or approve the wrong refund before anyone notices.

Five AI agent security risks, in plain terms

Almost everything that goes wrong with agents falls into a handful of buckets.

1. It does too much (excessive agency)

This is the headline risk, and OWASP lists it as “Excessive Agency.” The model gets something slightly wrong, and because it was allowed to act, the small mistake becomes a real incident: it issues the refund, changes the shipping address, updates the customer record, or runs the command. The danger isn’t that the AI is evil; it’s that it’s confidently wrong while holding real permissions.

2. It gets hijacked by what it reads

Agents constantly read outside content: web pages, emails, documents, tickets. Hidden instructions in that content can quietly redirect the agent, an attack called indirect prompt injection. Because an agent can then act, a hidden line of text can turn into a real action, like leaking data or sending a message. (For how this works, see our guide to direct vs indirect prompt injection.)

3. It exposes or leaks data

To be useful, agents get broad access to your information, and broad access is exactly what leaks. In the 2026 incident data, 61% of agent-related incidents involved sensitive data exposure. An over-connected agent can pull data from one place and send it somewhere it never should have gone.

4. It uses tools and permissions it shouldn’t

Agents act through tools and credentials, and most are over-permissioned. Only about 22% of teams treat agents as their own identity; most still hand agents shared API keys with far more access than the task needs. When something goes wrong, that broad, shared access is the blast radius.

5. One agent’s mistake spreads to others

As teams chain agents together, a single compromised or confused agent can feed bad output into the next one. In simulated multi-agent systems, one poisoned agent corrupted 87% of downstream decisions within hours. Errors propagate faster than a human can catch them.

Confidence is rising faster than security

The uncomfortable part isn’t just the incidents; it’s the gap between how safe leaders feel and how exposed they actually are, and that gap is widening fast. In Gravitee’s 2026 State of AI Agent Security research, stated confidence in agent visibility jumped from 82.6% to 91.8% in just four months, while the agents themselves did not get much safer: on average, 48% of production AI agents still run unsecured. In the same research, only about 24% of organizations said they had full visibility into which of their own agents are talking to each other.

In other words, agents are being trusted with real actions faster than anyone is watching them. That mismatch, high autonomy plus low oversight, is what turns an ordinary mistake into a headline.

The high end is no longer hypothetical either. In November 2025, Anthropic disclosed the first documented large-scale cyberattack run mostly by an AI agent: attackers manipulated its Claude Code assistant into carrying out an estimated 80 to 90 percent of a cyber-espionage campaign against around 30 organizations, by feeding it small, routine-looking tasks that added up to a real attack. Almost no one reading this will face a state-sponsored crew, but the mechanism is the same one in your own tools: an agent that can chain small actions can be steered into a big one.

Limit the damage, not the autonomy

You don’t make agents safe by trusting them more carefully; you make them safe by limiting what a mistake can do. The core moves are simple to state, and each is its own deeper topic:

• Least privilege. Give an agent access only to the specific tools and data the task needs, nothing more.
• A human in the loop for anything irreversible. Sending money, deleting data, emailing customers: require a person to confirm.
• Its own identity and a log. Give each agent its own credentials, not a shared key, and log what it does, ideally down to which instruction triggered which action, under which permissions, and whether a human approved it, so you can see and reverse anything that went wrong.
• Guard what it reads. Treat outside content as untrusted, since that’s the main way agents get hijacked.

Each of these is expanded in the rest of this series, from limiting agent permissions to understanding the tools and connectors agents rely on. Start here, then go deeper where it matters for you.

FAQ

Sources

• OWASP: LLM06 Excessive Agency (Top 10 for LLM Applications)
• Cloud Security Alliance and Token Security: AI agent security incident research, 2026
• Gravitee: State of AI Agent Security 2026 Report
• Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign (Nov 2025)

Figures reflect industry reports published in 2026. Check the linked primary sources for methodology and updates.