Agentic AI

A chatbot produces text and stops. You read it and decide what to do. An agent is given a goal and works towards it: choosing actions, calling tools, reading results, and choosing again, until it decides it is finished.

The interesting boundary is not intelligence. It is whether the loop closes without a person in it.

The three properties that matter for security

Its behaviour is generated at runtime. An agent’s next action is produced from a model, a prompt and whatever it read a moment ago — not from source code you could review before running it. Every historical mitigation that begins “inspect the software, then decide whether to trust it” has nothing to inspect.

Its input is attacker-controlled. Agents read issues, documentation, web pages and tool output, and any of those can carry text that the model treats as instruction. That makes every agent a confused deputy candidate by default.

It acts with your authority. On your machine, the agent is a process you started, so it inherits everything you can do — see ambient authority. The combination of “chooses its own actions” and “holds all your permissions” is what makes this a distinct risk class rather than a variation on running an app.

Why “is it trustworthy” is the wrong question

Before agents, the security question about a program was roughly binary: is this software what it claims to be. Signing, reputation and provenance all answer versions of that, and they still matter.

They no longer suffice, because a completely legitimate agent from a reputable vendor, running unmodified, can still take an action that costs you something — because the action was suggested by a document it read, or because the goal was ambiguous, or because the shortest path to the goal ran through a credential.

The useful question becomes what can this program reach, which is an authority question. That is what AI containment governs.

Not a synonym for autonomous

“Agentic” and “autonomous” get used interchangeably and should not be. Autonomy is about how much human confirmation sits in the loop, and it is a dial: an agent that asks before every action is still agentic.

That dial also has a well-known failure mode. Confirmation fatigue is real — approve two hundred prompts and you are approving reflexively by the fiftieth — which is why confirmation is a useful control and a poor sole control, and why the boundary underneath it has to hold when someone clicks yes on autopilot.