When your AI stops asking and starts doing

EPIC28 Ltd · 1 September 2026

The chatbot answered your question. Annoying, maybe. Dangerous? Not really.

Now imagine this: you ask your AI assistant to book a flight. It reads your email, finds your passport number, accesses your corporate card, makes the reservation, and emails you the confirmation. All in thirty seconds. All without asking.

That is an AI agent. It represents the biggest shift in computer security since the cloud, and the threat model flips completely.

The threat model flip

Traditional AI security focused on outputs. Could the AI generate harmful content? Could it reveal training data? Could it be jailbroken into saying something embarrassing? Those were problems of persuasion — tricking an AI into convincing a human to do something bad.

Agentic AI turns the AI into the actor. The question is no longer what the model can say, but what it can do directly, without any human involvement at any step. A chatbot with a vulnerability is a PR problem. An agent with the same vulnerability is a financial loss, a data breach, and a compliance violation — all at once.

Four architectural changes that make agents riskier

1. Tool access

Agents make API calls, write files, execute code, move money. When an agent can book flights, push code, or query databases, its permission scope becomes your attack surface. In 2025, Pillar Security demonstrated a "Rules File Backdoor" attack hiding malicious instructions in the configuration files coding agents rely on — a stark illustration of the blast radius when an agent has production access.

2. Memory and state

Agents accumulate context across sessions, and if that memory is poisoned, every future interaction is compromised. This is no longer theoretical: the MINJA attack, published at NeurIPS 2025, achieved over 95% injection success across tested agent frameworks using query-only interaction, with poisoned records surviving across sessions and executing days later.

3. Autonomy gradients

"Human in the loop" sounds reassuring until you realise most implementations are a rubber-stamp exercise. Users develop approval fatigue. They trust the agent's framing. They click approve without reading. The autonomy was sold as a feature; the oversight became theatre.

4. Action chaining

Agents combine multiple tool calls into a single workflow — read email, extract credentials, call payment API, route funds. Each individual step looks normal. The composite action is a heist.

The incidents are already stacking up

This is not hypothetical. Unit 42 built an entire framework for characterising attacks against agentic systems after demonstrating AI-powered ransomware running from initial compromise to data exfiltration in 25 minutes. Noma Security found ForcedLeak, a critical-severity vulnerability (CVSS 9.4) in Salesforce's Agentforce, where indirect prompt injection forced agents to exfiltrate CRM data. Researchers showed agents leak company data through simple web searches, exploiting privileged corporate access while browsing the internet.

The model is not the boundary. The boundary is whatever the model can reach.

What controls actually answer this

Since the agent is the actor, the security architecture has to move one layer down: away from arguing about prompts and toward controlling actions. The model should propose. Something else should decide.

• An enforcement layer between agent and tools, applying policy to every tool call: what can be called, by whom, with which arguments, against which resources, under which conditions.
• Short-lived, narrowly scoped credentials, instead of long-lived tokens that get copied into notebooks and quietly become permanent.
• Step-up approvals for destructive actions — because the point of automation is speed, and speed is exactly what you don't want when the decision is wrong.
• Detection that baselines tool usage. Agent misuse looks like legitimate business activity, because it is business activity, just misdirected. Without a baseline you cannot see the early shape of an incident: an agent touching unusual datasets, calling unfamiliar tools, hammering an API with small variations.

This threat model is why we built Raucle the way we did: a capability gate on the tool-execution path, fail-closed, with a signed record of every decision. It is also why we are sceptical of security that lives inside the model — the NCSC's own agentic AI guidance converges on the same conclusion: safeguards, sandboxing and active oversight, enforced outside the thing being safeguarded.