Software that acts alone is joining your payroll.
Here is the catch. That software signs into the same inboxes, file shares, and payment tools as your people, yet almost nobody has defined what an agent is allowed to do.
The research firms see it clearly. Gartner forecasts that more than 40 percent of agentic AI projects will be canceled by the end of 2027, and inadequate risk controls are named among the top reasons.
Gartner also predicts that by 2028, one quarter of enterprise breaches will trace back to AI agent abuse from external attackers and malicious insiders. In the meantime, agents are already talking to each other on the open web, while AI driven attacks rose 56 percent this year.
Consider what your agents already touch. Email drafting, support replies, code review, invoice handling, all of it flows through the same data center where one careless permission can become a breach. Researchers have shown that an AI agent ran a full ransomware attack with no human at the keyboard, which is what autonomy without guardrails looks like.
<small>Server room photo by BalticServers via Wikimedia Commons, CC BY SA 3.0</small>
An AI agent is not a feature. It is a new hire, and it stays safe only when it has a named identity, a narrow scope, and a leash that a human holds.
Part of the confusion is technical. Agentic AI is a blend of machine learning, reasoning, and tool calling, so it does not fit into the boxes that security teams already patrol. The fix is not a fancier firewall. It is discipline applied to access, and three controls work today.
1. Give every agent a named identity. Provision dedicated service accounts and scoped credentials instead of borrowing a human session. When every action maps to one accountable principal, audit logs finally tell the truth.
2. Grant the smallest permission that works. An agent that drafts email does not need access to billing or source code. Default to read only, then approve each tool it may call, because prompt injection still tops the OWASP risk list for LLM applications and turns any connected tool into a remote control.
3. Keep a human in the loop for anything expensive or irreversible. Require an explicit click before an agent sends money, deletes records, or pushes code. A two second confirmation is cheap, and it is exactly the risk control that Gartner says doomed projects were missing.
The old playbook asked who could log in, and it was built for people who pause before acting.
The new reality is software that acts first and asks later. Identity, scope, and approval are the only fences that hold.
Here is the question I keep circling. If your AI assistant wanted to email your CFO tonight and move money, should it stop and ask for your click first, or does that step defeat the entire point of an agent?
And if you want to know where your own skills stand before the rules harden, you can test your grasp of LLM agent tooling on BatchBrain, where a skill check shows what you actually know instead of what you claim.