What Makes An AI Agent Different From A Chatbot, And Why Security Teams Care

When a chatbot gets something wrong, a person usually reads the mistake and decides what to do with it. An AI agent is built to skip that step. It reads a goal, plans a series of steps, calls tools such as email, file storage or a payment system, and acts with whatever access it has been given.

That single difference reshapes the security problem. A harmful answer is still possible, but the bigger worry becomes a harmful action taken with someone else’s authority. This article explains what an agent is made of, where the new openings for attackers sit, and what early government and industry guidance asks organisations to do. If you want a fuller explanation of how agents plan and use tools, start with the AI Agents And Multi-Agent Systems group.

From Answers To Actions

In May 2026, six cyber security agencies from Australia, the United States, Canada, New Zealand and the United Kingdom published joint guidance called “Careful Adoption of Agentic AI Services”.¹ It describes an agentic system as one or more agents that rely on a model, usually a large language model, to interpret the world, decide and act. Around the model sit external tools, external data sources, memory and planning workflows.

The guidance draws the line against ordinary generative AI clearly. Generative AI produces text, images or audio for a person to use. Agentic AI connects that capability to software systems so it can reason, plan and take actions without a human stepping in at each stage.

Why The Attack Surface Grows

Agents inherit every weakness of the model underneath them. The joint guidance gives a plain example: an attacker hides instructions in a phishing email, and an agent that monitors the inbox reads them and downloads malware.¹ The agent did what its text told it to do. The problem is that some of that text came from the attacker.

Each extra component adds another way in. A web search tool pulls third-party text into the model’s context. A memory store can be seeded with false information that resurfaces weeks later. A connector to another agent brings in messages the first agent may trust without checking. The guidance puts it simply: every component widens the attack surface.

OWASP, the open security community best known for its web application Top 10, reached the same view. Its Top 10 for Agentic Applications, published in December 2025 with input from more than 100 experts, describes agents as systems that plan, act and make decisions across complex workflows.² Its first entry, Agent Goal Hijack, rests on a simple observation: agents cannot reliably separate legitimate instructions from content an attacker controls.³

The Shift In Who Holds Authority

A second change is about identity. When a person approves a payment, the audit log shows a person. When an agent does it, the log shows a service account, a token or a delegated user session. If many agents share one key, or one agent holds far more access than its task needs, a single compromise inherits all of it.

The joint guidance describes this as the “confused deputy” pattern. A low-privileged user, or a tampered tool, persuades a high-privileged agent to do something the user could not do directly. Because the action runs under a trusted identity, the logs look normal and detection is delayed.¹

What Early Guidance Asks For

The guidance from governments, OWASP and the large AI developers points in one direction. Google’s paper on secure agents sets out three principles: an agent should have a clearly defined human controller, its powers should be carefully limited, and its actions and planning should be observable.⁴ Google pairs fixed, rule-based controls with defences that rely on model reasoning, aiming to get the strengths of both.

OWASP adds the idea of “least agency”: do not give a system autonomy it does not need, because unnecessary autonomy enlarges the attack surface without adding value.³ The joint government guidance asks organisations to fold agentic AI into their existing security model rather than treat it as a separate discipline, to start with low-risk and non-sensitive tasks, and never to give agents broad or unrestricted access to sensitive data or critical systems.¹

None of these documents is a law. They are guidance. As of October 2026 they give security teams a shared starting point for a first assessment of an agent. The AI Governance And Regulation group covers the frameworks and laws that sit above them.

Questions To Ask Before Deploying An Agent

A short set of questions catches most early mistakes:

• What can this agent read, and could any of that content come from outside the organisation?
• What can it change or send, and could those actions be undone?
• Whose identity does it act under, and is that identity shared with anything else?
• Which actions need a human to approve them, and who decided that?
• Could we reconstruct, from logs, why it did what it did?

The later articles in this group take each question further, beginning with a simple test for spotting the riskiest combinations of access.