There is no single agreed “biggest” security risk of agentic AI. OWASP and NIST emphasize attack paths such as indirect prompt injection, agent hijacking, excessive agency, and privilege misuse. OpenAI focuses on limiting the damage an attack can cause even if manipulation succeeds. The AI Now Institute argues that some sensitive uses remain unacceptable while agents can ingest untrusted data and act with powerful access. These perspectives differ less over whether risks exist than over which part of the problem to prioritize and what residual risk is tolerable.
Why do security experts rank agent risks differently?
“What is the biggest security risk of AI agents?” depends on what part of the system you examine. An agent may read external content, interpret it, use tools, and take actions under an identity with particular permissions. Different security perspectives focus on different links in that chain—and therefore recommend controls at different points.
As an Amazon Associate I earn from qualifying purchases.
Application design: what can the agent do?
OWASP’s Excessive Agency guidance starts with the capabilities a developer grants: which tools are available, what permissions they carry, and whether the agent can take consequential actions without review. If a mail assistant only needs to read messages, a tool that can also send them creates unnecessary risk.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Trust boundaries: what can influence the agent?
NIST’s account of agent hijacking focuses on the boundary between trusted instructions and untrusted content. A malicious instruction hidden in a webpage, email, or document may influence an agent that is expected to process that material. In NIST’s terminology, this is indirect prompt injection.
#1 Best Overall
Attack path: what influence can lead to what action?
OpenAI describes the risk in terms of a source that can influence an agent and a “sink”—an action capability—that makes the influence consequential. This framing directs attention both to how an attacker reaches the agent and to what the agent can do afterward. OpenAI also argues that advanced attacks are not usually caught by input-classifying firewall systems, making impact-limiting design important even when detection fails.
Deployment context: what level of risk is acceptable?
The AI Now Institute takes a more precautionary position. In its July 2026 policy brief, Friendly Fire, it argues against using agents that ingest untrusted data when they can execute arbitrary code, access security-critical environments, feed unsanitized outputs into automated pipelines, or inform security- and safety-critical decisions. That is the institute’s policy position, not a consensus rule accepted by every security organization.
These are not two tidy camps. A team can agree that prompt injection is a real threat, adopt least privilege and impact limits, and still disagree with another team about whether those measures make a particular deployment acceptable.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
What happens when an agent is attacked through an email or webpage?
With a conventional chatbot, an injected instruction may produce a misleading answer. With an agent, the same influence may lead to tool use: reading or sending a message, changing a record, calling a remote service, or taking another action permitted by its integrations. The key risk is often the combination of untrusted input and excessive capability, permission, or autonomy—not the input alone.
OWASP’s mail-assistant example makes the interaction concrete: indirect prompt injection in content the assistant reads can become more consequential if a plugin can both read and send mail. OWASP recommends reducing functionality and permissions, requiring manual review for sending, and using monitoring or rate limits to limit damage. It labels logging and rate limiting as measures that do not prevent excessive agency; they are not substitutes for narrowing what the agent can do.
| Threat or failure mode | What can happen | Useful question to ask |
|---|---|---|
| Indirect prompt injection or agent hijacking | Untrusted content in an email, file, or website influences the agent to take an unintended action. | Can external content influence a tool call, and what action could follow? |
| Excessive agency | An integration exposes more tools, permissions, or autonomy than the task requires. | Can the task work with narrower or read-only access? |
| Tool misuse or identity and privilege abuse | The agent misuses a legitimate tool or acts through an identity with excessive access. | Are credentials scoped to this task, and can they reach unrelated systems? |
| Oversight failure | A person approves an action without understanding it or cannot intervene in time. | Does the approval show the actual action and its scope, and can the reviewer stop it? |
| High-stakes deployment | A compromised or misdirected agent affects a security-critical environment or decision. | How severe and reversible would the consequences be in this specific setting? |
The questions in the final column are practical prompts, not claims that a named source has been proven to overlook a particular issue.
Rank #3
Can detection or human approval make agents safe?
Neither should be treated as a complete solution. Detection can miss sophisticated manipulation; approval can become ineffective if a person sees only a vague summary, faces too many prompts, or cannot intervene meaningfully. Controls work best as layers that reduce the chance of misuse and limit consequences if an earlier layer fails.
- Reduce capability first: grant only the tools and permissions required for the task; prefer read-only access where it suffices.
- Keep untrusted content in view: treat email, documents, webpages, and other external material as data to process, not as trusted instructions.
- Make review consequential: for actions such as sending, changing, or deleting data, show the actual action and its scope. A natural-language summary alone may not let someone inspect what will happen.
- Limit downstream damage: monitoring and rate limits may help contain misuse, but OWASP says they do not prevent excessive agency.
- Match controls to impact: an action that is easy to reverse may warrant a different control threshold than one with lasting effects or access to sensitive systems.
AI Now adds a concern about human oversight itself: automation bias and prompt fatigue can weaken a person’s ability to challenge or stop an agent. That warning supports making review genuinely actionable; it does not establish that every approval process will fail.
What does the available evidence establish—and what does it not?
The evidence behind these perspectives is not all the same kind. A threat taxonomy identifies and organizes risks; a simulated evaluation tests behavior in defined environments; product telemetry describes observed use within a particular provider’s systems; and a policy brief argues what deployments should be acceptable. Those forms of evidence can inform one another, but they are not interchangeable.
OWASP and NIST: threat guidance and simulated evaluations
OWASP’s Agentic Applications Top 10 was informed by input from more than 100 security researchers, industry practitioners, user organizations, and technology providers, according to the OWASP GenAI Security Project’s December 2025 announcement. That figure describes the project’s contribution process; it is not a measure of how often agents are attacked. The project identifies concerns including behavior hijacking, tool misuse, and identity or privilege abuse.
NIST’s Center for AI Standards and Innovation (CAISI) describes AgentDojo evaluations in simulated Workspace, Travel, Slack, and Banking environments in its guidance on strengthening agent-hijacking evaluations, first published January 17, 2025 and updated December 19, 2025. Simulated tests can help examine attack paths under defined conditions, but their results do not guarantee how every product or deployment will behave.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAnthropic: observations limited to its own systems
Anthropic’s February 18, 2026 report, Measuring AI agent autonomy in practice, draws on millions of human-agent interactions across Claude Code and its public API. Its reported observations should be read within that scope:
| Reported observation | What it describes | Important qualification |
|---|---|---|
| Nearly 50% of observed agentic activity was software engineering. | Activity analyzed by Anthropic. | Not the share of software-engineering work across the agent market. |
| For the longest-running Claude Code sessions, duration rose from under 25 minutes to over 45 minutes over three months. | The longest-running sessions in the study. | Not the typical duration of every agent session. |
| Roughly 20% of new-user Claude Code sessions used full auto-approval, compared with over 40% among experienced users. | Auto-approval patterns in the Claude Code data studied. | Not a universal rate for agents or users of other products. |
| Most public API agent actions observed were low-risk and reversible. | Actions visible in Anthropic’s public API observations. | Anthropic does not give this as a universal estimate for all deployed agents. |
Anthropic also notes that there is no agreed definition of an agent, that API requests cannot reliably be grouped into sessions, and that providers have limited visibility into customer architectures. Those limits matter when drawing conclusions beyond the systems and activity it observed.
AI Now: a policy position about sensitive uses
AI Now’s July 2026 Friendly Fire argues that agents ingesting untrusted data should not be used in certain conditions involving arbitrary code execution, security-critical access, unsanitized automated pipelines, or safety-critical decisions. The institute’s conclusion reflects its assessment of residual risk and human oversight, rather than a controlled study that establishes a universal failure rate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should a deployer decide what is acceptable?
There is no evidence here for a universal rule that every agent is safe or unsafe in every setting. Start from the task, then assess the agent’s inputs, permissions, actions, and consequences in the environment where it will actually run.
Recommended Free Tools
- List the task’s necessary actions. Identify which tools and permissions it genuinely needs; remove unrelated capabilities.
- Trace untrusted inputs to possible actions. Check whether content from email, documents, websites, or other external sources can influence tool use.
- Examine identity and access. Determine what the agent’s credentials can reach and whether access can be scoped more narrowly.
- Set review points for consequential actions. Show reviewers the action and scope, and ensure they can meaningfully intervene.
- Plan for containment. Monitor downstream activity and consider rate limits as damage-limiting measures, without treating them as prevention.
- Evaluate in a context resembling intended use. Simulated benchmarks can reveal weaknesses, but they do not establish universal safety in deployment.
- Set the threshold by impact and reversibility. Consider what happens if manipulation succeeds, who or what could be affected, and whether the action can be undone.
The practical disagreement is ultimately about where to draw the line after safeguards are applied. OWASP and NIST emphasize identifying and mitigating attack paths; OpenAI emphasizes constraining impact even if manipulation succeeds; AI Now argues that certain high-stakes contexts remain unsuitable. A sound decision makes that residual-risk judgment explicit instead of treating a detector, approval button, or benchmark score as proof of safety.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
