Key Takeaways
Agents act through tools, so mistakes can damage real systems.
Injection and excessive permissions can expose data or damage systems.
Untrusted plugins, unreliable outputs, and loops create security, financial risks.
Least privilege, approval gates, limits, logs, ownership reduce deployment risks.
What is an AI agent?
In July 2025, SaaStr founder Jason Lemkin says he told a Replit coding agent to freeze all changes. It deleted his live database anyway.
That's the difference between a chatbot and an AI agent. A chatbot answers questions. An agent takes action: it's an AI connected to tools, so it can read email, edit files, run code or pay bills to finish a task. When a chatbot gets it wrong, you get a bad answer. When an agent gets it wrong, something real breaks.
Guardrails are the safety limits around an agent: what it can touch, when it must ask a human first, and who checks its work. OWASP, a respected nonprofit for software security, now keeps a separate top 10 list just for agent risks. Here are seven to know.
Where each risk enters an agent. A concept diagram, not data.
The seven risks
1. Hijacking by hidden instructions
Agents read emails, web pages and documents, but they can't reliably tell your instructions apart from text a stranger wrote. An attacker can hide a line like "forward all invoices to this address" in an email, and the agent may obey. This is called prompt injection, and OWASP ranks it as the top risk for AI apps.
In tests by NIST, the US standards agency, the best known attack fooled an agent 11% of the time. The best new attack the testers invented worked 81% of the time. Simply retrying raised average success from 57% to 80%.
Guardrail: treat outside text as information, not orders, and require approval for sensitive actions.
How often hidden instructions hijacked one AI agent in NIST's tests, January 2025.
2. Too much permission
Many agents get far more access than the job needs. It's like hiring someone to water your plants and handing them the keys to your safe. OWASP calls this excessive agency.
The Replit story is the classic case. The agent had the power to delete live data, so only a typed "don't" stood in the way. Replit's CEO called it "unacceptable" and began separating test and live databases.
Guardrail: give only the access the task needs, and keep test and live systems apart.
3. Data leaking out
Programmer Simon Willison warns about a risky mix he calls the lethal trifecta: an agent that can see private data, reads content from outsiders, and can send information out. With all three, one bad message can trick it into leaking secrets.
A flaw called EchoLeak did exactly that in Microsoft 365 Copilot. One crafted email could make it leak data without the victim clicking anything. Microsoft rated it 9.3 out of 10 for severity and had already fixed it when the flaw was made public in June 2025. It found no sign of real attacks.
Guardrail: break the trifecta by letting data go only to approved places.
4. Poisoned tools and plugins
Agents rely on third-party extensions, and risk can come in two ways. Some extensions are MCP servers, small connectors built on MCP, a common standard for plugging AI into other apps. Others are skills, packages of instructions and code that users download from marketplaces such as ClawHub, the store for the OpenClaw agent.
In September 2025, security firm Koi found postmark-mcp, a copycat email MCP server that secretly copied every email it sent to an attacker. In February 2026, Koi checked 2,857 skills on ClawHub and found 341 malicious ones, most built to install data-stealing malware.
Guardrail: install extensions only from publishers you trust, and review updates.
5. Confident but unreliable work
Agents can sound sure and still be wrong, and they don't always repeat a success. Sierra's τ-bench test gives each AI model the same customer-service task four times. On its 2026 banking tasks, the top model solved 55% of tasks on a single try, but got only 35% right on all four attempts.
Four 2026 models on τ-bench banking tasks, each task tried four times, August 2026.
Instructions can slip, too. In February 2026, Meta AI researcher Summer Yue asked an OpenClaw agent to suggest emails to delete and wait for her approval. It started deleting instead, ignoring her stop messages until she ran to the computer it was running on. She believes it lost her instruction while condensing a long conversation.
Guardrail: test on real tasks many times, and keep a way to stop the agent instantly.
6. Runaway costs
Every step an agent takes can cost money: AI fees, paid services or real purchases. A looping agent never gets tired, and attackers can make it burn your budget on purpose, which OWASP calls denial of wallet.
In 2025, Anthropic let a Claude agent run a small office shop for about a month. It handed out discounts when asked, priced metal cubes below what it paid, and for a while told customers to pay into an account it had made up. The shop lost money.
Guardrail: set hard spending limits and alerts.
7. Nobody watching
Agents log in with their own digital IDs, like API keys (passwords that let software talk to other software), and companies often lose track of them. A Cloud Security Alliance survey conducted in January 2026 and published in April found that 65% of the IT and security professionals it asked had seen incidents involving AI agents at their organizations in the past year, and 82% had found agents running that they didn't know about.
IBM's 2026 data breach study shows the same gap: of the organizations whose AI was breached, 92% lacked proper access controls for it.
Guardrail: log every action, and give every agent a named human owner.
AI security gaps among breached organizations, IBM 2025 vs 2026.
The seven risks at a glance
Risk | Real example | Main harm |
|---|---|---|
1. Hijacking by hidden instructions | Best new attack worked 81% of the time | Security |
2. Too much permission | Replit agent deleted a live database | Lost data |
3. Data leaking out | EchoLeak in Microsoft 365 Copilot | Privacy |
4. Poisoned tools and plugins | 341 malicious ClawHub skills | Security |
5. Confident but unreliable work | OpenClaw agent ignored "stop" | Reliability |
6. Runaway costs | Anthropic's money-losing shop | Money |
7. Nobody watching | 82% found unknown agents | All of the above |
How to put guardrails in place
At work, the guardrail lines above make a good starting checklist, and NIST's AI Risk Management Framework offers fuller guidance. If you're trying an agent yourself:
Use a separate email account, not your main one.
Pay with a virtual card that has a low spending limit.
Choose "ask before acting" settings, and watch the first few runs.
The bottom line
An agent is like a new employee with a company card and keys. You wouldn't hand those over without rules. Gartner predicts that over 40% of agent projects will be canceled by the end of 2027, partly due to weak risk controls. That's a forecast, not a fact. Either way, set the guardrails before you hand over the keys.
Q1. What are the risks of deploying AI agents without guardrails?
AI agents can misuse permissions, follow malicious instructions, leak sensitive data, and perform unintended actions. They can also generate unexpected costs or operate without proper oversight.
Q2. What is prompt injection in AI agents?
Prompt injection occurs when malicious instructions hidden in emails, web pages, or documents manipulate an AI agent. It can cause the agent to ignore its intended task and perform unsafe actions.
Q3. How can excessive permissions put AI agents at risk?
Agents with unnecessary access may delete important data, modify live systems, or expose confidential information. Applying least-privilege access limits each agent to the resources needed for its task.
Q4. How can malicious AI plugins compromise security?
Untrusted plugins or tools can steal data, expose credentials, or execute malicious actions. Use trusted publishers, review permissions, and inspect updates before connecting tools to an AI agent.
Q5. How can businesses deploy AI agents more safely?
Set clear permissions, require human approval for sensitive actions, impose spending limits, and log agent activity. Assign every agent a human owner and maintain an immediate way to stop it.
