Most organizations deploying agentic AI have had the AI conversation. They've evaluated models, reviewed vendors, and built a business case. What many haven't had is the security conversation — the one about what happens when an agent with broad system access, autonomous decision-making capability, and no inherent skepticism starts operating in a production environment.
That conversation needs to happen before deployment. Not after the first incident.
The Attack Surface Nobody Mapped
When a human employee gets access to a system, IT knows about it. There's a provisioning process. An access request. Usually, an approval. Access is logged, reviewed periodically, and revoked when the employee changes roles or leaves.
Agents don't go through that process in most organizations today. They get the access they need to do the job — sometimes broad access, because it's easier than scoping it precisely — and then they run. Continuously. Without the periodic access reviews that apply to human users.
That's a new kind of attack surface. And it's one that most security teams haven't fully mapped yet.
An agent that can read customer records, trigger financial transactions, send emails, and update system configurations isn't just a productivity tool. It's a high-privilege account that operates at machine speed. If it's compromised, misconfigured, or manipulated, the blast radius is significant — and the window between something going wrong and someone noticing can be much larger than with a human actor.
Prompt Injection: The Threat Most Developers Underestimate
Here's the attack vector that deserves more attention than it's getting: prompt injection.
An agent that reads external content — emails, documents, web pages, support tickets — can be manipulated through that content. An attacker embeds instructions in a document that the agent is likely to process. The agent, which has no inherent way to distinguish between legitimate instructions from its operator and malicious instructions embedded in data, follows them.
This isn't theoretical. Researchers have repeatedly demonstrated prompt injection attacks against production AI systems. And as agents take on more autonomy — reading more inputs, taking more actions — the attack surface for this class of vulnerability grows.
The defense isn't complicated in principle. Treat agent inputs as untrusted data, the same way a secure application treats user input. Validate what the agent is being asked to do before it does it. Implement human-in-the-loop checkpoints for high-risk actions. But these defenses require developers and security teams to think about agents as attack targets, not just productivity tools.
Identity and Credential Management for Non-Human Actors
Agents need credentials to do their jobs. API keys. Service account tokens. Database access. OAuth permissions. In practice, these credentials are often handled informally — hardcoded in configuration files, shared across multiple agents, or scoped far more broadly than necessary.
That's the same set of credential hygiene problems the industry spent a decade trying to solve for human users. Now it needs to be solved again for agents — and at a scale that's growing fast.
The principle is the same as it was for people: least privilege, short-lived credentials, audit trails, and regular rotation. The implementation looks different because agents aren't logging in with a username and password. But the underlying discipline is identical.
Security teams that have already built strong identity and access management practices are well-positioned here. The work is extending those practices to cover non-human actors — not rebuilding them from scratch.
What Developers Can Do Now
If you're building agents, the security practices that matter most aren't exotic. They're the fundamentals applied consistently.
Scope agent access to exactly what the agent needs for its specific task. Nothing more. Treat every external input the agent processes as potentially hostile. Log agent actions at a level of detail that makes post-incident analysis possible. Build in escalation paths — actions above a certain risk threshold should require human approval before execution.
And document what your agents can do. Not just for your own team, but for the security team that will eventually ask. The organizations with the cleanest security posture around agents are the ones where someone can quickly and completely answer what each agent has access to, what it does with that access, and how its behavior is monitored.
The Timing Problem
The challenge with security conversations is that they're most valuable before something goes wrong and least likely to happen when it does. When an agentic AI deployment is moving quickly and showing early results, security reviews feel like a source of friction.
They're not friction. They're the work that determines whether a successful pilot becomes a sustainable production system — or becomes a case study in what not to do.
The security conversation your clients aren't having about agentic AI is the one that protects everything else they're building. It's worth having now.
