AI Agents: What They Can Do and What Security Risks They Pose

Just a few years ago, we mainly expected artificial intelligence to answer our questions or write text for us. Today, there’s increasing talk of AI agents—systems that can plan their own actions, use tools, and perform tasks on our behalf. But with these new capabilities come new risks. In this article, we explain what AI agents are, what they can be used for, and how to work with them so you don’t run into problems.

What Are AI Agents and How Do They Differ from Chatbots

A typical chatbot works simply: you ask a question, you get an answer. What you do with that answer is up to you. An AI agent goes a step further. It receives a goal, breaks it down into steps, and can use various tools to accomplish them—such as a web browser, email, calendar, file system, or development environment.

The U.S. National Institute of Standards and Technology (NIST), specifically its Center for AI Standards and Innovation (CAISI), describes agent systems as systems capable of performing autonomous actions that affect real-world systems or environments. It is precisely this distinction that is important: an agent not only advises but also acts.

Key Differences at a Glance

• Chatbot: answers individual questions, does not initiate anything on its own; a human decides on every step.
• AI agent: works on the entire task, calls upon tools, can modify files, send a message, or run a program.
• Consequence: A chatbot’s error is usually just an incorrect answer; an agent’s error can be an unintended action.

What AI Agents Can Do in Practice

Agents’ capabilities vary depending on the product and configuration. The following examples illustrate typical scenarios; they are not a guarantee that every tool can handle them reliably.

At work

• Preparing materials for a meeting: the agent gathers relevant documents, summarizes them, and proposes an agenda.
• Sorting emails and drafting response templates, which a human reviews before sending.
• Processing repetitive administrative tasks, such as transferring data between spreadsheets.
• Researching a topic from multiple sources and summarizing the findings.

In programming

• The agent reviews the codebase, proposes changes to multiple files, and runs tests.
• Troubleshooting errors based on error messages and logs.
• Writing documentation, migrating libraries, or refactoring large sections of code.

In everyday life

• Comparing offers and preparing an overview of options, such as when planning a trip.
• Helping organize a calendar and reminders.
• Summarizing long documents, contracts, or manuals into an understandable format.

The common thread is saving time on multi-step tasks. At the same time, it’s important to note that the agent makes mistakes, may misunderstand the task, and its output must be checked, especially when it comes to something important.

Security Risks of AI Agents

The more permissions an agent is granted, the more damage it can cause—whether through its own error or an attacker’s intervention. Let’s take a look at four main areas.

1. Unauthorized or Unintended Actions

OWASP, an organization dedicated to application security, identifies a problem called “excessive agency” in its risk overview for applications using large language models. This occurs when a system is granted more autonomy, permissions, or access than it actually needs. OWASP lists three typical causes: too many functions, too many permissions, and too much autonomy.

In practice, this could mean that an agent with access to the entire clipboard is able not only to read but also to delete or send messages, even though you only wanted a summary from it.

2. Malicious Commands and Prompt Injection

This is probably the most interesting risk. In so-called indirect prompt injection, an attacker hides instructions within content that the agent reads—for example, on a webpage, in an email, or in a document. The model may interpret these instructions as a command and alter its behavior. OWASP ranks this threat first on its list of risks for applications using language models.

The UK National Cyber Security Center (NCSC) warns that prompt injection should not be considered the equivalent of SQL injection. With SQL injection, there is a reliable defense mechanism in the form of separating data from commands. Language models, however, do not distinguish so clearly between data and instructions; therefore, according to the NCSC, it may not be possible to completely eliminate this problem. The recommended approach is therefore to reduce the likelihood and, above all, the impact of exploitation, rather than relying on a single “magic bullet” solution.

In January 2026, NIST also noted in its call for information on the security of AI agents that agent systems may be vulnerable to hijacking (behavioral hijacking), backdoor attacks, and other forms of exploitation.

3. Privacy Protection and Data Leaks

In order for an agent to be helpful, it often needs access to your emails, documents, calendar, or corporate systems. Any such access is a potential pathway for data leaks. If an agent processes content from an untrusted source while also having access to sensitive data, an attacker may attempt to manipulate the agent into sending that data outside the system. It’s also important to know where your data is sent, how long it’s stored, and whether it can be used for further model training. Review the terms and conditions of the specific provider.

4. Cybersecurity and Agent Identity

An agent behaves like another user within systems, often with its own credentials, tokens, or keys. Therefore, in 2026, NIST is also addressing the issue of agent identity and permissions: how to reliably distinguish them from humans and how to ensure that they act only within the scope of what has been explicitly delegated to them. According to a research note from the Cloud Security Alliance, on February 17, 2026, NIST launched the AI Agent Standards Initiative, focused on the security, interoperability, and identity of agents. Binding standards are not yet finalized, so you cannot rely on regulation to solve security issues for you.

How to Use AI Agents More Safely

The good news: many risks can be significantly reduced with sensible configurations. Here’s a practical checklist.

For regular users

1. Grant only minimal permissions. If an agent needs read access, do not allow it to write. If it needs a single folder, do not give it the entire drive.
2. Require confirmation for important actions. Sending a message, making a payment, deleting a file, or changing settings should require your approval.
3. Do not trust content from the internet. Websites, emails, and documents from strangers may contain hidden instructions. Be especially cautious with tasks like “read this link and do what it says.”
4. Do not enter sensitive data unnecessarily. Passwords, credit card numbers, or health information do not belong in the agent.
5. Check the results. The agent may hesitate, invent a detail, or misunderstand the task.
6. Use separate accounts. For experiments, choose a separate account with no access to important data.

For Developers and Companies

• Limit the list of tools the agent can call to the absolute minimum.
• Use short-term, narrowly scoped access tokens, not universal keys.
• Separate the processing of untrusted content from high-impact actions.
• Log what the agent has done so that incidents can be reviewed retrospectively.
• Run agents that execute code in an isolated environment (sandbox).
• Test for resilience against prompt injection and be skeptical of vendors who claim they can completely prevent it. The NCSC recommends looking instead for those who can explain how they mitigate the risk.

What to Watch for When Evaluating “Autonomy”

Marketing often emphasizes how independently agents operate. For security, however, it’s more useful to ask a different question: What’s the worst that could happen if an agent makes a mistake or is manipulated by someone? If the answer is “it will send an email to all contacts” or “it will delete the production database,” additional safeguards must be added, or the task should not be assigned to the agent at all.

Conclusion: Agents are useful, but they are not infallible

In 2026, AI agents are a viable tool that can save time in work, programming, and routine tasks. At the same time, this is a technology whose security landscape is still taking shape: prompt injection remains an unresolved issue, and standards are still being developed. The best strategy is simple: start with limited permissions, require human approval for important actions, and treat untrusted content with caution.