What Makes an AI System an “Agent”
A chatbot answers questions. An agent takes actions. The distinction matters for security because actions have consequences that text responses don’t.
An AI agent has three capabilities that a standard LLM endpoint does not:
- Tool access. The agent can call external APIs, read files, query databases, execute code, send emails, or interact with other systems.
- Autonomous planning. The agent decomposes a goal into sub-tasks and decides the sequence of actions without human approval at each step.
- Multi-step reasoning. The agent chains together observations, decisions, and actions across many turns — using the output of one step as the input to the next.
Each of these capabilities creates an attack surface that doesn’t exist in traditional software or in prompt-response LLM applications.
Why Traditional AppSec Doesn’t Cover This
Application security tools were built for deterministic software. They assume that code follows defined execution paths, that inputs map predictably to outputs, and that access controls are enforced by the application layer.
AI agents break every one of these assumptions:
Non-Deterministic Execution
The same user input can produce different action sequences depending on context, model state, and tool outputs. WAFs and static analysis can’t model an attack surface that changes with every request.
Natural-Language Control Plane
The agent’s behavior is governed by natural language instructions, not compiled code. Prompt injection isn’t SQL injection — it targets the decision-making logic itself, not a data layer.
Implicit Authorization
When an agent calls a tool, it acts on behalf of the user — but the tool sees the agent’s credentials, not the user’s intent. The mapping between “what the user asked for” and “what tools the agent calls” is mediated by a model, not enforced by code.
Action Chains, Not Requests
A single user instruction can trigger dozens of API calls, file reads, and database queries. Security must evaluate the entire chain, not individual requests in isolation.
Four Critical AI Agent Risks
Tool-Access Abuse
An agent authorized to “look up customer orders” is one prompt injection away from “export the entire customer database.” The tool doesn’t know the difference — it receives valid API calls from a trusted service account. The distinction between legitimate and malicious use lives entirely in the agent’s reasoning, which is vulnerable to manipulation.
Autonomous Decision Risk
Agents make decisions without human approval. When those decisions involve real-world actions — sending an email, modifying a patient record, executing a trade — the blast radius of a wrong decision extends beyond the digital system into legal, financial, and physical consequences.
Multi-Step Reasoning Attacks
An attacker doesn’t need to compromise the agent in a single turn. Over a multi-step interaction, they can gradually shift the agent’s context — through carefully chosen questions, tool-output manipulation, or content placed in retrieval sources — until the agent takes an action it would have rejected at the start of the conversation.
Data-Access Overreach
To be useful, agents need access to data. But the line between “read this patient’s chart” and “read all patients’ charts” is a parameter in an API call, not a separate permission. Agents routinely access more data than the task requires because their tool integrations grant broad access and rely on the model to self-limit.
Defenses That Actually Work
Securing AI agents requires controls at three layers:
- Tool-call boundary enforcement. Every tool invocation is validated against an allowlist of permitted operations, argument patterns, and data scopes. The agent can only do what its policy permits, regardless of what its reasoning chain produces. This is the agent equivalent of least-privilege access control.
- Runtime behavioral monitoring. The agent’s action sequence is tracked in real time and compared against behavioral baselines. Anomalous patterns — sudden scope changes, unusual tool sequences, data access beyond the task context — trigger alerts or automatic halts.
- Cryptographic action attestation. Every action the agent takes — every tool call, every decision, every data access — is logged with a cryptographic attestation record. This creates a tamper-evident audit trail that proves what the agent did, when, and based on what instructions.
How GLACIS Secures AI Agents
GLACIS provides the three-layer defense described above as an integrated platform:
- autoredteam probes your agents with adversarial scenarios — tool-escalation attempts, multi-step reasoning attacks, and data-overreach tests — before they reach production.
- Enforce sits at the tool-call boundary, validating every agent action against your security policy in real time.
- Notary attests every action cryptographically, producing the evidence trail that regulators, auditors, and your own security team need.
Mapped to OVERT controls ov-2.1 (runtime behavior logging), ov-3.1 (tool-call attestation), ov-2.2 (scope enforcement), and ov-3.3 (least-privilege validation).
Agent Security Scan
See how GLACIS audits an AI agent’s tool calls, decision chain, and data access in real time.
Book a Live DemoRelated Reading
Secure Your AI Agents
Start with a free behavioral assessment of your agent, or talk to us about runtime monitoring for your production fleet.