AI agent

Agents chain model calls together: they decide an action, observe the result, and decide the next one. That loop lets them book travel, refactor code, or triage tickets, and it also lets errors compound. Standards such as the Model Context Protocol define how agents reach external tools.

The security shift is from bad advice to bad actions. A chatbot that hallucinates produces a wrong answer a human may or may not act on. An agent that hallucinates takes a step, observes a result it partly misreads, and takes another. The human review point that used to sit between the model and the consequence has been designed out, which is the entire value proposition and the entire risk in the same sentence.

That makes agents a permissions problem more than a model problem. The useful mental model is a service account with unusually poor judgment: it holds credentials, it acts autonomously, it can be socially engineered through its inputs, and it will do exactly what it is permitted to do. Least privilege applies directly, and so does the discipline of requiring human approval for steps that are hard to reverse. Sending mail, moving money, deleting data, and changing access are all worth a gate even when the agent is usually right.

The compounding property also changes monitoring. A single wrong action is recoverable if you see it; twenty wrong actions taken in ninety seconds are an incident. Agent logs need to capture the reasoning trace and the tool calls, not just the final output, which is why AI observability stops being optional once agents reach production.