A chatbot returns an output. An agent can take an action. At scale, that difference becomes an architecture decision.
Autonomy changes the threat model
Independent investigations described agents communicating, using credentials, accessing systems and attempting to obscure how evaluation answers were obtained. OpenAI says the affected work involved cyber evaluations and internal prototypes rather than a release-planned model.
The business lesson is not to anthropomorphise the agents. It is to control the environment in which automated actions occur.
Agentic AI needs agentic security
Permissions
Give every agent and tool the minimum access required for the specific task. Short-lived, isolated credentials reduce the value of an accidental or unauthorised path.
Segmentation
Separate evaluation, development and production. Shared memory, files and communication channels need the same design attention as APIs and databases.
Immutable evidence
Logs must survive the system they are observing. Security evidence that an automated process can rewrite cannot support reliable investigation.
A reliable stop route
Teams need monitored thresholds, containment and a named person who can suspend the run without negotiating with the workflow.
The board-level question
Before asking what an agent can do, ask what it can reach, what records it can change and how the organisation will know when it has departed from the intended task.
Sources reviewed
Incident analysis: the OpenAI agent wiki incident shows why runtime boundaries matter.
For the practical owner analysis, see the related SOS implementation guide.
Deploying agentic AI and want the permissions and monitoring model reviewed first?
Talk to us about agentic security