AI Agents.

What are AI agents?

An AI agent is software that uses an AI model to work towards a goal with little step-by-step human input. The UK NCSC describes agentic AI as systems that access data sources, remember context, make decisions, use tools and take actions in pursuit of a goal, without continuous human intervention.

NIST says AI agents can now work autonomously for hours, write and debug code, manage emails and calendars, and shop for goods, among other emerging uses.

How do AI agents work?

The NCSC describes agentic systems as a form of advanced generative AI. NIST notes that how useful an agent is depends on its ability to interact with external systems and internal data.

A simple illustration: an agent given the goal “sort my inbox” might read messages, decide what matters and move or reply to them without being asked each time.

Why do AI agents matter for security?

An agent can act, not only answer. That changes the risk. CISA and its international partners say agentic AI systems can introduce extra cybersecurity risks, such as an expanded attack surface, privilege creep, behavioral misalignment and obscure event records. Privilege creep means an account slowly collects more access than it needs.

The NCSC adds several concerns:

• Agents can be permitted to access external systems, data and tools.
• Behavior can be unpredictable, especially when a goal can be read in a way a human would not expect.
• Problems can be harder to spot when actions happen faster than people can review them.
• A particular course of action can be harder to explain.

The NCSC also says agentic systems can inherit known risks of language models, such as jailbreaking and prompt injection. Prompt injection is an input crafted to make a model behave in a way it was not meant to. One documented case is the Hugging Face AI agent intrusion, which Hugging Face says was run by an autonomous AI agent system.

How can organizations reduce the risk?

CISA and its partners advise organizations to avoid granting broad or unrestricted access, especially to sensitive data or critical systems. They also advise starting with low-risk and non-sensitive use cases, and accounting for agentic AI in the organization’s security model and risk posture.

The NCSC gives similar advice:

• Start with tightly bounded pilots that have clearly defined tasks.
• Never give an agent unrestricted access to sensitive data or critical systems.
• Apply least privilege, and use temporary credentials where possible.
• Keep ongoing visibility of how the system operates.
• Plan for incidents, including failures, misuse and loss of control.
• If you cannot understand, monitor or contain an agent’s actions, it is not ready for deployment.

How do AI agents relate to nearby terms?

The NCSC places agentic systems within generative AI. An agent that staff use without approval is a case of shadow AI. An agent that signs in to systems with its own account or credentials is related to non-human identity. NIST lists AI agent security and identity as a research area for trusted adoption.

Is an AI agent the same as a chatbot?

Not exactly. A chatbot mainly replies to messages. Using the NCSC description, an agent also uses tools and takes actions towards a goal. Some chatbots may be built as agents, but the ability to act is what separates the two.

Is “agentic AI” the same as an AI agent?

The terms are often used together. The CISA guide uses “agentic AI systems” for software of this kind, and NIST uses “AI agents”. The CISA guide does not give a formal definition of agentic AI.