# The Real Risk of Agentic AI: It's Not the AI, It's How You Code It


As organizations race to deploy autonomous AI agents across their infrastructure, security researchers are sounding a critical alarm: the technology isn't inherently dangerous. The danger lies in developers misunderstanding how these systems actually work—and repeating decades-old security mistakes in the process.


## The Threat Landscape


Agentic artificial intelligence systems are proliferating at unprecedented speed. Recent estimates suggest that approximately one-third of organizations globally have either already adopted or plan to deploy agentic AI technology in the near future. Yet despite this rapid adoption, few teams fully understand how these systems function or where vulnerabilities actually exist.


The misconception is widespread: many developers treat AI agents as opaque "black boxes" where magical intelligence operates beyond human comprehension. This dangerous assumption is leading organizations to deploy systems without properly auditing the underlying code that connects AI models to real-world applications—where the actual security gaps live.


## Background and Context


### What Are Agentic AI Systems?


Agentic AI represents a significant evolution from traditional large language models (LLMs). Rather than simply generating text in response to prompts, these agents autonomously make decisions, call software tools, take actions, and chain complex operations together.


In practice, an agentic AI system consists of:


  • A trained language model that reasons about problems and decides on actions
  • Tool integrations that allow the model to interact with external systems (APIs, databases, code execution environments)
  • Decision loops that enable the model to evaluate results and take follow-up actions
  • System prompts and constraints designed to guide behavior

    • This architecture is fundamentally different from static AI models. Agents actively interact with production systems, making them potential attack surfaces if not properly secured.


    ### Adoption Timeline


    The acceleration in agentic AI deployment has been dramatic:

  • 2024: Early enterprise experimentation
  • 2025: Widespread pilot programs across finance, healthcare, and enterprise software
  • 2026: Mass adoption in operations, IT automation, and customer service

    • According to industry surveys, adoption drivers include:

  • Cost reduction through task automation
  • Operational efficiency gains
  • Ability to handle complex, multi-step workflows
  • Integration with existing enterprise systems

    • ## Technical Details: Where Vulnerabilities Actually Live


    ### The Architecture of Risk


    Acronis senior security researcher Eliad Kimhy articulated the core insight that's reshaping how security professionals view agentic AI: "What people don't understand is that agentic systems still rely on a lot of old world technology and a lot of old world vulnerabilities."


    The vulnerability equation is straightforward:


    | Component | Traditional Risk | Agentic AI Risk |

    |-----------|-----------------|-----------------|

    | LLM itself | Prompt injection, jailbreaks | Shared with traditional LLMs |

    | Tool APIs | API authentication, authorization | Magnified — agent makes calls autonomously |

    | System integration | Standard injection, escalation flaws | Magnified — agent has broader access |

    | Data flow | Sensitive data exposure | Critical — agent may extract/exfiltrate during operation |

    | Decision logic | Logic bugs | New risk — agent may make unintended decisions based on input |


    The critical insight: agentic AI systems don't introduce new vulnerability classes. They amplify old ones.


    ### Real-World Example: The Salesforce Vulnerability


    Last fall, researchers discovered a critical vulnerability in Salesforce that demonstrated this principle perfectly. The flaw wasn't inherent to any AI technology—it was a standard authorization bypass. However, when an agentic AI system with access to Salesforce interacted with the platform, the agent could autonomously exploit the vulnerability at scale and speed no human attacker could match.


    ### Common Vulnerability Patterns in Agentic Deployments


    Organizations deploying agentic AI are inadvertently recreating classic security mistakes:


    1. Insufficient tool isolation: AI agents with access to administrative APIs lacking proper scope restrictions

    2. Weak authentication for tool calls: API keys stored in plain text or insufficiently rotated

    3. No audit logging of agent actions: Difficult to detect when an agent is misused

    4. Inadequate input validation: Agents passing user input directly to backend systems

    5. Privilege creep: Agents granted broader access "just in case" they need it

    6. No circuit breakers: Agents continue executing actions despite signs of compromise or misconfiguration


    ## Implications for Organizations


    ### The Velocity Problem


    Unlike human attackers who operate at human speed, compromised or misconfigured agents can cause damage in seconds. An agent with overly broad permissions might:


  • Extract entire databases before detection systems trigger
  • Provision malicious cloud resources across dozens of accounts
  • Modify security configurations or disable logging
  • Chain together multiple API calls to escalate privileges

    • ### The Detection Gap


    Most organizations' security monitoring was built for human or traditional attack patterns. Agentic AI operations often:

  • Generate unusual API call patterns that don't match "known bad" signatures
  • Execute thousands of operations in automation workflows that mask genuine attacks
  • Operate during "normal" business hours because they're legitimately scheduled
  • Use privileged credentials that appear authorized in logs

    • ### Industries at Highest Risk


    Financial services and banking: Agents with access to transaction systems, account modifications, and customer data


    Healthcare: Agents managing patient records, prescription systems, and billing platforms with sensitive PHI


    Cloud infrastructure: Agents with provisioning and configuration rights across production environments


    Software development: Agents with code repository access and deployment permissions


    ## Recommendations for Secure Agentic AI Deployment


    ### Fundamental Principles


    1. Audit Before Deploying

  • Understand every tool your agent can access
  • Document all APIs, databases, and systems in the agent's operational scope
  • Identify what sensitive data each tool contains or modifies

    • 2. Apply Zero-Trust to Agents

  • Agents should have *minimum required* permissions, not "convenient" permissions
  • Require explicit authorization for sensitive operations
  • Implement API key rotation for agent credentials independent of human credentials

    • 3. Treat Agent Actions as Suspicious

  • Log every action an agent takes with full context
  • Monitor for anomalous patterns: unusual call sequences, access to unexpected systems, bulky data transfers
  • Implement circuit breakers that halt agents if suspicious patterns emerge

    • 4. Segment Agent Environments

  • Run agents with limited network access
  • Use VPC isolation for agent workloads
  • Separate agent credentials from human credentials

    • 5. Red Team Your Agents

  • Test what happens if an agent's instructions are poisoned
  • Verify agents can't escape their intended scope
  • Simulate compromised tool APIs to see if agents can be manipulated

    • ### Practical Implementation


    Organizations should:


  • Conduct security reviews of every API or system an agent can touch, not just the AI component
  • Implement audit trails that capture agent decisions and actions with enough detail for forensic analysis
  • Design constraints into agent prompts that prevent unintended scope expansion
  • Establish incident response procedures specific to agent compromise (agents may be actively causing harm during investigation)

    • ## HackWire Analysis


    Why This Matters Now


    The timing of this conversation is critical. We're at an inflection point where agentic AI is moving from experimental projects into production workloads—often without adequate security review. The narrative around AI risk has been dominated by abstract concerns about alignment and emergent behavior. Meanwhile, the immediate, concrete risk—that developers will build autonomous systems with the same security shortcuts they've always taken—is unfolding in real time.


    What Acronis is pointing out isn't novel in isolation: we've known that API security, privilege management, and input validation matter for decades. What's novel is the *scale and velocity* at which bad practices can now be executed. An improperly secured API might have been a moderate risk when humans manually queried it. That same API becomes a critical risk when an autonomous agent can exploit it thousands of times per minute.


    The industry is repeating a familiar pattern: moving fast, assuming new technology changes fundamental security principles (it doesn't), and discovering the hard way that legacy vulnerabilities scale with the technology. This cycle played out with cloud computing, with containerization, and with serverless architectures. Each time, we thought "this is different." Each time, the fundamentals reasserted themselves.


    The encouraging news: unlike abstract AI risk, this is *solvable*. Organizations that treat agentic AI deployment like infrastructure security—strict access controls, comprehensive logging, threat modeling, incident response planning—will be protected. Those that treat AI agents as magic and assume the training process prevents bad outcomes will become cautionary tales.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Tools](https://www.hackwire.news/category/tools) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)