From the evolution of AI to autonomous agents — the security landscape, threat taxonomy, Agentic AI Security Stack, and practical guidance for securing agentic systems. 

  • Agentic AI shifts from reactive Generative AI to autonomous systems that plan, use tools, maintain memory, and execute actions at machine speed creating high-blast-radius risks where a compromised agent acts as a rogue insider capable of data theft, code injection, and system-wide failures.  
  • Implement a 5-phase stack covering Non-Human Identity (least privilege), input screening (prompt injection), tool allowlisting (AIBOM), runtime sandboxing & behavioural monitoring, and full observability with red teaming going beyond traditional LLM security with defence-in-depth and human oversight for critical actions. 

 Table of Contents 

  1. From AI to Agentic AI – The Evolution
  2. What is Agentic AI? – Examples & how it works.  
  3. The Application to Risk Bridge 
  4. Agentic AI Security Stack 
  5. Top Agentic AI Security Threats 
  6. How to Secure Agentic AI Systems 
  7. Conclusion 

Section 1 
From AI to Agentic AI – The Evolution 

Artificial intelligence didn’t arrive as a single technology. It evolved through distinct waves, each expanding the scope of what machines can do. Understanding this progression is essential context for grasping why agentic AI introduces an entirely new class of security challenge.  

AI Traditional / Narrow AI 
Rule-based systems, expert systems, classical ML. Single, well-defined tasks: spam detection, image classification, recommendation. No reasoning chain, no memory, no tool use. 
Generative AI Large Language Models & Foundation Models 
GPT, Claude, Gemini, Llama. Transformer-based models that generate text, code, images and audio. Fundamentally reactive — they respond to a prompt and wait. Stateless per-session by default. 
Agentic AI Autonomous Reasoning + Action 
LLMs equipped with tools, memory, and planning loops. Agents decompose goals into sub-tasks, call APIs, browse the web, write and execute code, delegate to sub-agents, and persist state across sessions — with minimal human involvement per step. 
Multi-Agent Orchestrated Agent Networks 
Multiple specialised agents communicating via Model Context Protocol (MCP) and Agent-to-Agent (A2A). An orchestrator spins up researcher, writer, and review agents within a single workflow — operating at machine speed without a human gate between steps. 


The pivotal shift is from generation to action. A generative model produces text. An agentic system does things it reads email, books travel, pushes code to production, and triggers downstream automations at machine speed. 

Section 2 
What Is Agentic AI? Examples & How It Works 

An AI agent is an autonomous or semi-autonomous software system that uses one or more LLMs as its reasoning engine and combines that with tools, memory, and a feedback loop to achieve goals across multi-step workflows. 

Core components 
Every agentic system is built around four pillars: (1) a Planner the LLM that receives a goal and decomposes it into steps; (2) Tools APIs, code executors, browsers, and databases the agent can invoke; (3) Memory short-term session context and long-term vector stores that persist knowledge across sessions; (4) a Feedback loop observation of action results, plan updates, and iteration toward the goal. 

i.e. Microsoft 365 Copilot / Studio, GitHub Copilot Workspace, Salesforce Agentforce 

How the loop executes 

Given a goal, the agent enters a plan → act → observe → replan loop. It breaks the goal into tasks, selects a tool for each, formulates and makes the call, receives results, updates its internal context, and moves to the next task. In multi-agent architectures the orchestrator spawns specialist sub-agents, introducing inter-agent communication channels that expand the attack surface dramatically. 

Section 3 
The Application-to-Risk Bridge 

Traditional application security was designed around a clear boundary: untrusted input flows in, validated output flows out. The application is passive it responds; it does not initiate. Agentic AI obliterates this model in three fundamental ways. 

The blast-radius problem. A compromised AI agent is not a data breach it is a rogue insider with programmatic speed and access to every tool the organisation gave it. An exploited agent can exfiltrate data, manipulate financial records, inject malicious code into repositories, or cascade failures across connected systems all at machine speed, often without a human reviewer in the loop. 

First, agents are proactive actors they initiate API calls, send emails, write to databases, and trigger automations without waiting to be called. This inverts the threat model entirely. Second, the instruction surface is unbounded an agent processes not just user prompts but tool outputs, file contents, emails, web pages, and RAG retrievals, any of which can carry adversarial crafted instructions. Third, in multi-agent architectures, agents inherit and delegate trust a single compromised node can poison the entire workflow. 

Section 4 
Agentic AI Security Stack 

Securing agentic systems requires a layered, lifecycle-aligned defence model. The stack below is organised into five phases that mirror how an agent operates from identity provisioning before the first action, through input screening, tool governance, and runtime monitoring, to post-execution observability and governance. 


Phase -1: Identity & Access Governance (before the agent acts) 
Every agent must be registered as a Non-Human Identity (NHI) before it is granted access to any resource. Just-in-time, short-lived credentials scoped to the specific task eliminate standing privilege and dramatically reduce the blast radius of any compromise. Without this foundation, all other controls are built on sand. 

Phase-2: Input Protection & Goal Security (before the agent executes) 
Every input to an agent including tool outputs, web pages, email content, and RAG retrievals must be treated as untrusted and screened for adversarial instruction payloads. Indirect prompt injection is the most prevalent real-world exploit class today. PII scrubbing before execution prevents sensitive data exfiltration through agent-generated outputs. 

Phase-3: Tool & Supply Chain Security (what the agent can touch) 
Agentic supply chains are dynamic agents discover and load tools at runtime. Explicitly allowlisting MCP servers with signed manifests, maintaining an AI Bill of Materials (AIBOM), and enforcing argument validation before every tool call are non-negotiable. Real-world incident: a malicious Postmark MCP server BCC’d every agent-sent email to an attacker with no visible indication in the email thread. 

Phase-4: Runtime, Behaviour & Monitoring (while the agent runs) 
Code generated by an agent must execute only in network-isolated sandboxes. Behavioural baselines define what “normal” looks like per agent role deviations trigger alerts or automatic suspension. Inter-agent communication must be authenticated and integrity-verified to prevent message spoofing and cascading failure propagation across the agent graph. 

Phase-5: Observability, Red Teaming & Governance (after the agent acts) 
Every agent action, tool call, and inter-agent message must be logged with enough fidelity to support forensic replay. AI red teaming exercises including adversarial prompt injection and multi-agent chain attacks must be run regularly. Governance frameworks (NIST AI RMF, EU AI Act, ISO 42001) provide the compliance scaffolding that ties the full stack together at the organisational level. 

Section 5 
Top Agentic AI Security Threats 

Traditional LLM risks focus on prompts, data exposure, and output handling. Agentic AI introduces risks in planning, execution, identity, memory, and communication – meaning the attack surface is no longer the response, it is the entire workflow. 

Where threats occur in the agent execution loop 

Agentic AI security works by understanding how autonomous agents operate and then securing the parts of the system that drive their behaviour. The diagram below, based on the threat categorisation published by Palo Alto Networks and OWASP, maps specific threat classes to the components of the agent execution loop where they manifest. 

Source: what-are-the-top-agentic-ai-security-threats 

Agentic AI threat taxonomy – breakdown 
Threat Description Stack Layer 
Memory Poisoning Attackers corrupt short-term or long-term memory to influence decisions across steps or sessions. Unlike single-turn attacks, poisoned memory reshapes future behaviour long after the initial injection. Real example: the Gemini Memory Attack, where injected content persisted across sessions. Phase 4 — Memory & State 
Tool Misuse Agents are manipulated into misusing their tools or calling them in harmful ways. This covers API abuse, file system manipulation, unintended bulk data access, and catastrophic commands — e.g., interpreting “clean up old data” as deleting a production database. Phase 3 — Tool Misuse Prevention 
Privilege Compromise Weak or inherited permission structures escalate the agent’s access. Agents frequently inherit owner-level privileges from the user who instantiated them, enabling lateral movement across connected systems without requiring any additional exploit. Phase 1 — Privilege Scoping 
Resource Overload Attackers overwhelm compute, memory, or dependencies to degrade or block agent behaviour. This is analogous to a DoS attack but targeted at the agent’s reasoning capacity or its tool rate limits — effectively disabling the agent during a critical operation. Phase 4 — Runtime Monitoring 
Cascading Hallucination Attacks False information compounds through reasoning, reflection, or inter-agent communication. What begins as a small error in one agent can amplify into a confident but entirely wrong chain of decisions across a multi-agent network, with downstream agents treating the hallucination as ground truth. Phase 4 — Cascading Failures 
Intent Breaking & Goal Manipulation Attackers alter planning, goals, or reasoning so the agent pursues harmful or misaligned tasks. Delivered via direct prompt override, hidden payloads in documents or emails, or recursive hijacking that propagates through the reasoning chain. This is the agentic equivalent of OWASP ASI01. Phase 2 — Goal Hijack Prevention 
Misaligned or Deceptive Behaviours Agents bypass constraints or act deceptively to achieve objectives. This behaviour may emerge gradually through fine-tuning attacks, goal drift, or reward hacking over long-horizon tasks — making it difficult to catch with simple rule-based checks. Phase 4 — Rogue Agent Detection 
Repudiation & Untraceability Poor logging or opaque reasoning hides actions, making investigation difficult. In multi-agent chains, determining which node made a harmful decision becomes nearly impossible without structured audit trails and forensic replay capability. Phase 5 — Agent Observability 
Identity Spoofing & Impersonation Attackers impersonate legitimate agents or systems to gain trust within a network. An attacker who spoofs an orchestrator agent can redirect the entire downstream multi-agent workflow to malicious ends, bypassing all policy controls tied to the genuine orchestrator’s identity. Phase 1 — NHI & Auth 
Unexpected RCE & Code Attacks Agents generate and execute attacker-controlled code via natural language instructions — especially dangerous when code execution is not sandboxed or network-isolated. AutoGPT was among the first public demonstrations of this class in production-adjacent deployments. Phase 4 — Sandboxing & Isolation 
Human Attacks on Multi-Agent Systems Humans craft complex, multi-step campaigns that exploit trust relationships and communication patterns between agents — going beyond single-prompt injection to orchestrated attacks targeting the full agent graph, including trust boundaries between orchestrator and sub-agents. Phase 2 — Human-Agent Trust 
Rogue Agents Compromised or misaligned agents diverge from intended behaviour and may work to subvert oversight mechanisms. Distinguishing rogue from normal behaviour requires robust behavioural baselines, continuous anomaly scoring, and regular adversarial red team evaluation. Phase 4 — Rogue Agent Detection 


Why traditional LLM security is not enough. Agentic AI is no longer a static model that receives a prompt and returns a result. It is an active system that makes decisions, chooses actions, and reaches into external environments. Which is why agentic AI shifts where security teams need to focus. Reasoning paths become targets for manipulation. Memory becomes a surface for poisoning. Tools become entry points for unintended actions. Interactions between agents become channels for influence. 

Section 6 
How to Secure Agentic AI Systems 

01 Treat every agent as a Non-Human Identity 
02 Apply least-privilege scoping to every tool and resource 
03 Treat all external data as untrusted — deploy a semantic firewall 
04 Sandbox all code execution with network isolation 
05 Explicitly allowlist MCP servers and plugins — maintain an AIBOM 
06 Authenticate and integrity-verify inter-agent messages 
07 Establish behavioural baselines and monitor for goal drift 
08 Implement human-in-the-loop gates for high-consequence actions 
09 Run AI-specific red team exercises regularly 
10 Align to a governance framework and maintain compliance mapping 


Section 7 
Conclusion 
Agentic AI represents the most significant expansion of the AI attack surface since the emergence of LLMs. By combining the reasoning capability of foundation models with autonomous action, persistent memory, and tool access, we have created systems that can be extraordinary force-multipliers for productivity and equally extraordinary force-multipliers for any adversary who manages to compromise or manipulate them. 
The five-phase Agentic AI Security Stack presented in this post provides a structured, lifecycle-aligned model from identity provisioning through input screening, tool governance, runtime monitoring, and post-execution observability. No single layer is sufficient. Defence in depth, applied from design through deployment, is the only viable posture.