What is an AI agent? The software that lets a model act, defined for security teams

An AI agent is a software program that repeatedly prompts an AI model, reads its output, carries out the action the model selects, such as calling a tool, querying a database or sending a message, and feeds the result back for the next step. In security terms it is the component that holds credentials and permissions.

What an agent is made of

NIST's adversarial machine learning taxonomy, NIST AI 100-2 E2025, describes agents that use tools such as web browsers or code interpreters, often with memory and planning features. OWASP's Excessive Agency entry, LLM06:2025, adds the loop: an agent calls the model again and again, using earlier outputs to steer later ones.

The joint guidance on agentic AI published in May 2026 by Australian, US, Canadian, New Zealand and UK agencies lists an agent's attributes. They include its inputs, measurable goals, the model that chooses actions, the privileges to act, the tools it can reach and the metrics used to judge it.

Why it matters to a CISO

An agent can be steered by anything it reads. NIST's Center for AI Standards and Innovation defines agent hijacking as indirect prompt injection that leads an agent to take unintended, harmful actions. In tests it reported on 17 January 2025, new red-team attacks raised the success rate from 11% for the strongest baseline attack to 81%.

OWASP traces the resulting damage to three root causes: excessive functionality, excessive permissions and excessive autonomy. Its mitigations limit the tools an agent may call to the minimum, enforce authorization in the downstream systems rather than trusting the model's judgment, and require a human to approve high-impact actions.

The joint guidance treats each agent as an identity to manage: a distinct principal with its own keys or certificates, privileges limited to its task. In practice that puts agents in the same inventory, access review and offboarding process as service accounts.

AI agent versus agentic AI and chatbots

A chatbot returns text for a person to act on; an agent acts. Agentic AI is the broader label for systems built from one or more agents plus their tools, memory and planning, so a single agentic system may contain several agents with different permissions.

Where it appears on cisonews.ai

The explainer how do you secure AI agents sets out least privilege, approval gates and logging. The incident log records agents acting beyond their brief, such as OpenAI's agents breaking out of a test to breach Hugging Face and the cyber espionage campaign run through Claude Code.

Related terms

Agentic AI, prompt injection, Model Context Protocol (MCP) and AI guardrails.