Securing Agentic AI

At a glance

• Agentic AI shifts risk from harmful outputs (as with chatbots) to harmful actions taken autonomously in your systems.
• Goal hijacking lets an attacker redirect an agent's objectives — often without touching the AI model at all — by poisoning the data or policies it reads.
• Attackers don't need direct access: they can act through indirect prompt injection, hiding instructions in documents, customer profiles or contact forms the agent ingests.
• A hijacked agent becomes a rogue digital insider — and, because it represents your brand, a hijacked agent can become a hijacked organisation.
• The answer is constrained autonomy: secure-by-design agents, humans on the loop, and governing agent instructions with the same rigour as legal or financial documents.
• Every programme needs five controls: least privilege, human-in-the-loop oversight, policy governance, continuous monitoring, and segregation of agent duties.

What is agentic AI?

Generative AI systems — chatbots such as ChatGPT or Gemini — turn human prompts into desired output. Agentic AI takes this further: AI agents that can plan, reason and act autonomously to achieve a goal. Where generative AI is a support tool for a human, an AI agent can operate like a digital employee, using the context available to it and the tools it can access to pursue objectives with limited or no supervision.

Why agentic AI?

Because agents can act independently and proactively, they offer organisations unparalleled efficiency for complex tasks, operating at a velocity that creates significant potential for return on investment. Naturally, that is a highly attractive paradigm — but trusting a system to act on your behalf does not come without risk.

But AI agents come with risks

To deliver impact, an agent needs the freedom to act — and that creates the potential for mistakes if there are not sufficient guardrails or human oversight in place. Imagine an agent deciding that, rather than read a database, it should rewrite it.

A better-documented risk is prompt injection: instructions passed to the agent that cause it to behave in malicious or unexpected ways. For generative AI, prompt injection leads to harmful outputs; for agentic AI, it leads to harmful actions. The problem is compounded because agents proactively ingest data to inform decisions — so a malicious actor doesn't need to touch the agent directly. They can cause harm simply by interfering with the external data an agent uses to make its choices.

From goal hijack to organisation hijack

A rogue agent acting against your goals is bad; it gets worse when that agent represents your organisation and brand and operates contrary to your values. Instead of your agenda, it is now working to someone else's. The risk moves well beyond the financial and operational harm a single hijacked agent can inflict, into reputational damage. This is the worst case: your agent has been hijacked, and so, in turn, has your organisation.

What do you do about this?

Just because an agent can be fully autonomous does not mean it should be. In traditional cybersecurity, users have their privileges restricted to control their access to systems; for agents this goes further, with both their access and their ability to act restricted. OWASP refers to this as "Constrained Autonomy".

In part this requires a secure-by-design approach to the agentic system, ensuring humans are strategically placed on the loop to provide oversight of the agent's actions. Equally crucial is that these systems are carefully governed — treating agent instructions with the same rigour as legal or financial documents, and ensuring human co-pilots have clear decision-making protocols. Whilst agentic AI offers significant potential, it will not be the organisations with the fastest or most capable agents that gain the most value, but those that do not fall foul of the risks because they have the most securely governed systems.

About the collaboration

Traversally provides the governance, leadership and assurance required to turn AI ambition into measurable business value — reducing risk, accelerating adoption, and ensuring AI investments deliver measurable ROI.

Lancaster University is a top-10 UK university and home to world-leading experts in AI and cyber, recognised as an Academic Centre of Excellence in Cyber Security Research.

This whitepaper was supported by the PBIAA CyberFocus project, funded by the Engineering and Physical Sciences Research Council (EPSRC), grant EP/Z536052/1. © 2026 Lancaster University and Traversally.