Cybersecurity glossary
What is Agentic AI Security?
Learn what agentic AI security is, how planning-and-tool-using systems expand the attack surface beyond chatbots, and which controls—identity, least privilege, approvals, and observability—keep agents from causing real-world harm.
Definition
Agentic AI security is the practice of protecting systems in which models plan, remember, and act through tools over multiple steps. It covers identity, authorization, untrusted observations, tool integrity, human approval, and monitoring—because a hijacked or mistaken agent can change tickets, code, money, or infrastructure, not only text.
Why agentic AI security matters
A completion is a suggestion. An agent is a loop. Agentic AI security exists because that loop reads the world and then writes back—through MCP servers, SaaS APIs, shells, and browsers.
The same prompt injection that makes a chatbot rude can make an agent wire a refund or push a commit. Security work therefore looks less like ‘filter bad words’ and more like identity, least privilege, change management, and incident response for a non-human operator.
How an agent run becomes an incident
Receive a goal
A user or scheduler asks for an outcome, not a single Q&A.
Plan and select tools
The model chooses MCP servers, APIs, or code execution based on descriptions.
Observe untrusted data
Pages, tickets, emails, or tool JSON enter context as ‘facts.’
Update the plan
Injected instructions or honest mistakes change the next action.
Act with real credentials
A tool call hits production systems as the agent or as the user.
Loop until stop
Without caps, the agent keeps going—spend, damage, or both.
Control planes for agents
Identity
Every action maps to a user or workload principal; no shared god-mode bot accounts.
Authorization
Tools expose the user’s scopes, not the platform’s. Writes are separate capabilities.
Integrity of tools
Pinned MCP servers, reviewed descriptions, and sandboxes against tool poisoning.
Oversight
Step budgets, spend caps, approvals, and traces a human can replay.
Chatbot versus agent threat emphasis
| Topic | Single-turn chatbot | Agentic system |
|---|---|---|
| Primary harm | Bad or leaked text | Unauthorized real-world change |
| Untrusted input | User message, maybe one upload | Every observation in the loop |
| Stop condition | End of completion | Must be imposed (steps, time, cost) |
| Identity | User talking to a model | Non-human operator using tools |
| Key glossary risks | Injection, leakage, output handling | Those plus excessive agency, MCP, tool poisoning |
- Inventory agents, their tools, identities, data classes, and owners.
- Default to propose-then-approve for writes, money, and external messages.
- Bind tool calls to the requesting user’s permissions.
- Isolate browsing and untrusted retrieval from internal privileged tools.
- Cap steps, tokens, and spend; kill runaway loops.
- Pin and review every MCP server as a production dependency.
- Trace goals, plans, observations, and actions for incident response.
- Red-team with hostile documents and malicious tool metadata, not only chat jailbreaks.
The practical takeaway
Agentic AI security is application security for a planner that can act. The model will be injected, confused, or poisoned. The design question is whether that failure can still reach production systems.
Give agents identity, least privilege, stop conditions, and a human for irreversible work. Treat the tool graph as the real attack surface.
Related security terms
Excessive Agency
The design flaw of giving agents more power than the task needs.
Human-in-the-Loop
Approval gates for irreversible agent actions.
Model Context Protocol (MCP)
A common way agents attach tools and data sources.
Tool Poisoning
Compromise of the tools agents rely on to act.
Indirect Prompt Injection
Untrusted observations that steer an agent’s plan.
Frequently asked questions
What is agentic AI in simple terms?
A system that does not only answer. It breaks a goal into steps, calls tools, reads the results, and continues until it thinks the job is done.
How is agentic security different from chatbot security?
Chatbots mainly risk bad or leaked text. Agents risk side effects: emails sent, PRs merged, cloud APIs called. The threat model includes the whole tool graph.
Did OWASP split this from the LLM Top 10?
Yes in spirit. The LLM Top 10 focuses on the model as a component. When the model becomes an actor with tools and memory, agent-focused guidance (including OWASP agentic work) applies on top.
What is the core failure mode?
Untrusted text (a webpage, ticket, or tool result) changes the plan, and the agent still has permission to execute that plan.
Do we need new identity for agents?
Yes. Agents should act on-behalf-of a user or a tightly scoped workload identity, with logs that say which principal caused which tool call.
Is full autonomy ever appropriate?
For low-impact, reversible, well-bounded tasks maybe. For money, identity, production change, and external messaging, keep a human in the loop.
Where should teams start?
Inventory agents and tools, cut agency, isolate untrusted context, add approvals, and log the plan plus every invocation.
References
Explore authoritative guidance and frameworks related to agentic ai security.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.