Agentic AI: Where the Real Security Challenges Begin

We’re at an interesting inflection point. After decades of talking about AI that could think, and then AI that could act on what it thinks, we’re now entering an era where AI systems are expected to take action independently based on data they encounter. That’s agentic AI, and unlike the previous generations of AI tools, it comes with a very different set of problems.

Most people outside security don’t immediately grasp why this matters. It sounds efficient. It sounds modern. And it is. But it’s also the moment where theory meets reality in ways that can expose organizations to risks they haven’t had to consider before.

What Makes Agentic AI Different

Let me be clear about what we’re talking about here. The first era of AI gave us models that could recognize patterns and make predictions. The second gave us conversational AI—systems like chatbots that could interact with users. Agentic AI is the third step: systems that not only understand context but take action based on it, often without waiting for human approval.

A customer service bot that routes a complaint to the right department is one thing. An AI system that independently accesses customer accounts, modifies settings, initiates transfers, or escalates cases to third parties? That’s agentic. And that’s where things get complicated.

The appeal is obvious. Efficiency gains are real. When AI can handle routine tasks end-to-end—checking balances, processing requests, flagging anomalies, and executing responses—humans get freed up for higher-value work. Financial institutions especially see this as a win. Members get faster service. Costs go down. On paper, it’s compelling.

The problem isn’t the concept. It’s the execution, the edge cases, and the second and third-order effects that no one talks about until something goes wrong.

The Security and Control Problems Nobody Wants to Discuss

Here’s what keeps me up at night about agentic systems: the attack surface just got much wider, and the blast radius of a compromised agent is exponentially larger.

When a traditional tool or even a conversational AI makes a mistake or gets tricked by a prompt injection attack, a human typically reviews the output before anything happens. There’s a friction point. There’s a checkpoint. With agentic AI, you’ve removed that checkpoint by design. That’s the whole point—speed. But speed and safety are often in tension, and we don’t yet have good solutions for maintaining both simultaneously.

Consider a few scenarios:

• Compromised context: What if an attacker poisons the data that an agent uses to make decisions? The agent will act on false information with confidence. How long before anyone notices?
• Authorization creep: An agent is given permission to perform certain actions. But what happens when it encounters an edge case or an unusual request that falls into a gray area? Does it escalate? Does it guess? Does it err on the side of performing the action?
• Cascade failures: One agent makes a decision based on outdated information. That decision triggers another agent to act. Which then triggers a third. Within minutes, you have a chain of automated decisions that no one predicted or wanted.
• Adversarial inputs: A bad actor learns how the agent reasons and deliberately structures requests to manipulate it into taking unintended actions. This is harder to detect than traditional fraud because it looks like normal system behavior.

And here’s the thing: these aren’t hypothetical. They’re inevitable. Not if, but when.

The Audit and Compliance Problem

Now layer in regulatory requirements. When a human employee makes a decision, we can audit it. We can ask why they did it. We can trace their reasoning. With agentic systems, the decision-making process lives inside a black box.

An agent acts. Something goes wrong. A customer’s money is moved incorrectly. A private record is disclosed. A fraudulent transaction is approved. And now regulators are asking: “Why did your system do this?” The honest answer from most organizations will be: “We’re not entirely sure.” That’s not a good position to be in.

Explainability becomes critical, but most AI systems aren’t built with explainability as a first-class feature. It’s an afterthought. And retrofitting it is hard. You end up with explanations that are technically correct but functionally useless.

Getting It Right Means Accepting Constraints

The organizations that will successfully deploy agentic AI won’t be the ones trying to minimize friction everywhere. They’ll be the ones willing to add friction back in at critical points.

That might mean limiting agent authority to specific, narrow domains. It might mean requiring human review for actions above certain thresholds. It might mean building in mandatory escalation procedures when an agent encounters uncertainty. It might mean accepting that some processes will be slower because they need human oversight.

This isn’t a failure of the technology. It’s maturity. It’s recognizing that speed for its own sake isn’t a strategy. Speed with safety, accountability, and auditability—that’s worth building toward.

The financial services world especially needs to internalize this. Your members are trusting you with their money and their data. Agentic AI can serve them better, but only if you build these systems with skepticism built in from day one. Assume something will go wrong. Design for it. Test for it. And maintain the ability to stop it if needed.

That’s how you get agentic AI right.

Source: From insight to action: Getting agentic AI right for members