Skip to content
Adrythm
Book 20 minutes
AI and automation

AI agent

agentic AI / AI that does things / autonomous AI / AI assistant that takes actions

In short

An AI agent is a model that has been granted the ability to take actions, not just produce text. OWASP says the damage one can do comes from three grants: excessive functionality, excessive permissions and excessive autonomy. What it is allowed to do matters more than how good it is.

OWASP defines it by the grant rather than the technology. A system is given a degree of agency by its developer, meaning the ability to call functions or interface with other systems through extensions, in order to undertake actions in response to a prompt. The choice of which extension to invoke can itself be handed to the model. Agent systems then make repeated calls, using the output of one to direct the next.

So the word describes permission, not intelligence. A chatbot answers. An agent does things, and the list of things is something a person decided and wrote down.

The failure is named excessive agency, and OWASP gives it three root causes: excessive functionality, excessive permissions, excessive autonomy. Its examples are unglamorous and familiar to anyone who has run software. A tool chosen so the agent can read documents also carries the ability to modify and delete them. An extension trialled during development is dropped for something better, and the original stays available. Something meant only to read connects to a database with an identity that also holds update, insert and delete rights.

The sentence that matters most is the one about cause. OWASP says excessive agency enables damaging actions in response to unexpected, ambiguous or manipulated output from the model, regardless of what is causing the model to malfunction. Whether it was tricked or simply wrong is beside the point. The size of the damage was fixed when the permissions were granted.

This is no longer a fringe concern. CISA, working with the Australian Cyber Security Centre and other international and United States partners, published guidance on adopting agentic AI that names small and medium businesses among its audiences, and frames the task as aligning AI risk management with existing cybersecurity frameworks and strengthening oversight.

In practice

Three questions turn a demonstration into a decision, and they map onto the three root causes. What can it do, what is it connected to and with whose rights, and where does it act without a person. A vendor who can answer all three quickly has thought about it. A vendor who answers by describing how capable the model is has answered a different question.

Not the same as

A chatbot
That produces text. An agent has been granted the ability to call functions and act on other systems.
Prompt injection
That is one way an agent can be made to misbehave. OWASP is explicit that the damage is the same regardless of what caused the malfunction.

Why it matters to you

The pitch is autonomy, and autonomy is precisely the thing being sold to you as a benefit and recorded by security bodies as a root cause. Neither view is wrong. An agent that can book, refund, email and update records saves real time, and the identical grant is what makes a bad moment expensive. The useful position is not refusing the technology but knowing which grants were made on your behalf, because those are decisions rather than properties of the model.

What to ask or check

  1. 01Which functions can it call, and was each one needed, or did it arrive bundled?
  2. 02What rights does it hold on the systems it touches, and are any of them broader than reading?
  3. 03Which actions complete without a person, and which wait for approval?

What people get wrong

That a more capable model is a safer agent. OWASP ties the damage to functionality, permissions and autonomy, and says it follows from unexpected or manipulated output regardless of what caused the model to malfunction.

Red flags

  • An agent whose connected tools carry write access it was never meant to use.
  • A trial integration left enabled after something better replaced it.
  • A demonstration that shows what the agent can do and never what it is prevented from doing.

Who owns it

Whoever configures the grants, which makes it a build decision you can ask about before signing. CISA frames it as aligning AI risk management with the cybersecurity framework a business already has.

Where you will see it

Anywhere an AI is sold as doing the work rather than drafting it: booking, refunds, updating records, sending mail.

Keep reading

Prompt injection

Prompt injection is when text an AI system reads becomes an instruction it follows. OWASP notes the text does not have to be visible to a person, only parsed by the model, and that no fool-proof prevention is known. The UK's national cyber security body says the same.

Hallucination

A hallucination is AI output that sounds right and is not. OWASP describes the model filling gaps in its training data using statistical patterns, without understanding the content, so the answer can be fluent and unfounded at once. Its own first example is an airline that was successfully sued over its chatbot.

Training data

Training data is what a model learned from. The question owners ask is whether their own data joins it, and there is no single answer: OWASP names three separate stages, pre-training, fine-tuning and embedding. A commitment worth having names the stage and comes in writing.

Retrieval augmented generation

Retrieval augmented generation is how an AI answers from your documents without being trained on them. OWASP describes it as combining a pre-trained model with external knowledge sources at answer time. So the documents sit in a store the system reads from, and who can read that store is the question.

Explainability

Explainability is being able to say how an AI system reached a decision. NIST separates three questions: transparency answers what happened, explainability answers how, and interpretability answers why it meant what it did. A global explanation describes the model. Only a local one answers a customer.

Model drift

Model drift is an AI system getting worse without anyone changing it. Microsoft names the causes plainly: data distribution changes, training-serving skew, data quality problems, shifts in environments and consumer behavior changes can all make a model stale. NIST sets the bar over the entire lifetime of the system, not at launch.

Want this explained against your own numbers?

Twenty minutes, a straight answer, and no follow-up sequence if you decide not to work with us.

Book 20 minutes