Agentic AI

Agentic AI is artificial intelligence that doesn't just generate answers but takes actions: an agent can browse the web, click buttons, fill forms, send messages, move files, and chain those steps together to complete a multi-step task with little or no supervision. The most visible examples are agentic browsers such as Perplexity's Comet and OpenAI's ChatGPT Atlas, along with agent modes in productivity suites, coding tools, and customer-service platforms.

How it works

An agent pairs a large language model with tools — a browser, an email client, APIs, payment flows — and a loop: read the situation, decide the next step, act, repeat. To be useful it typically runs inside the user's authenticated sessions, which means it carries the user's email, single sign-on, and file access wherever it goes. That is also the security problem. The model takes direction not only from its user but, in practice, from everything it reads along the way; instructions hidden in a web page, a document, or a calendar invite can hijack the loop through prompt injection. Unit 42's 2026 in-the-wild research found most such lures use social-engineering framings — fake authority, invented "modes," urgency — aimed at the machine rather than any human. An agent compromised this way is not malware on the endpoint; it is a trusted user doing untrusted things.

How to defend against it

Treat agents as a workforce to govern, not a feature to toggle. Inventory the agents employees already run — unsanctioned ones are shadow AI with hands. Keep high-risk combinations apart: an agent with sensitive-data access should not also ingest untrusted content and communicate externally in the same workflow. Grant least-privilege, auditable credentials rather than the user's full session, and require a human in the loop before an agent sends, pays, shares, or deletes. Then update awareness programs so employees understand their new supervisory role — when the browser works for someone else, the person watching it is the last control standing.