Risks of AI Agents in Your Organisation: Things You Might Be Overlooking

Artificial intelligence is moving beyond answering questions and drafting documents.

AI agents can be given an objective, decide which steps are needed, access connected information and use business systems to complete parts of a process. Depending on their configuration, an agent could search documents, update records, send messages, create tasks, prepare reports or trigger automated workflows.

This creates significant opportunities for productivity and automation.

It also introduces a different level of risk.

A traditional AI assistant generally produces information for an employee to review. An AI agent may be allowed to take actions across several systems with limited supervision. A mistake, compromised instruction or excessive permission could therefore create consequences beyond an inaccurate answer.

The National Cyber Security Centre recommends that organisations adopt agentic AI carefully, begin with low-risk uses and apply established cybersecurity controls from the outset.

Here are some of the risks businesses may overlook when introducing AI agents.

What Is an AI Agent?

An AI agent is a system designed to work towards a defined objective rather than respond to only one instruction.

It may be able to:

• Plan a sequence of tasks
• Search connected information
• Select and use software tools
• Make decisions within agreed limits
• Update business systems
• Communicate with employees or customers
• Monitor the results of its actions
• Adjust its next step
• Work with other agents

For example, a customer-service agent might receive an enquiry, search approved product information, check the customer’s records, prepare a response and create a follow-up task.

A finance agent might extract information from an invoice, compare it with a purchase order and send the item for approval.

NIST describes modern agents as systems capable of planning multi-step tasks, using tools, searching databases and making decisions with increasing levels of autonomy.

This autonomy is what makes agents useful, but it is also what separates their risks from those of a conventional chatbot.

1. Giving the Agent Too Much Access

An agent may need access to business information and applications before it can complete useful work.

The easiest approach can be to give it broad access so it does not encounter permission errors. However, this can allow the agent to see or change far more than it genuinely needs.

An overprivileged agent could potentially access:

• Confidential documents
• Employee records
• Customer information
• Financial data
• Shared mailboxes
• SharePoint sites
• Business applications
• Administrative settings
• Files belonging to other departments

If the agent behaves incorrectly or its identity is compromised, those permissions could increase the damage.

How to Reduce the Risk

Apply the principle of least privilege.

The agent should receive only the access required for its specific purpose.

Businesses should:

• Use a separate identity for each important agent
• Avoid shared administrator credentials
• Restrict the agent to approved data sources
• Limit write, delete and administrative permissions
• Use temporary access where possible
• Review access regularly
• Remove access when the agent is retired
• Separate development and production agents

Microsoft recommends reviewing oversharing and applying least-privilege access across SharePoint, OneDrive and other information sources used by Copilot and agents.

2. Existing Data Oversharing Becomes Easier to Exploit

AI agents normally respect the permissions already applied to the user or agent identity.

This does not mean the underlying permissions are correct.

A SharePoint site may have been shared with an entire department several years ago. A former project folder may still be available to employees who no longer need it. An anonymous link may provide access to information that should now be restricted.

Before AI, employees might never have known that the information existed.

An agent can make it much easier to discover, summarise and combine information from several locations.

This can turn an existing permissions problem into a much more visible data-exposure risk.

How to Reduce the Risk

Before connecting an agent to Microsoft 365 or another document platform:

• Review SharePoint and OneDrive permissions
• Identify anonymous and organisation-wide links
• Remove inactive guests
• Review abandoned Teams and sites
• Restrict confidential locations
• Apply sensitivity labels where appropriate
• Confirm that former employees have been removed
• Establish clear ownership for important information

Microsoft’s guidance states that secure and relevant AI responses depend on organisational data being current, properly governed and appropriately shared.

3. Prompt Injection and Agent Goal Hijacking

Prompt injection is an attempt to manipulate an AI system through instructions hidden within content it processes.

The malicious instruction may appear in:

• An email
• A web page
• A document
• An uploaded file
• A support ticket
• A calendar invitation
• A database record
• Information returned by another system

For example, an agent may be asked to review incoming documents and summarise them.

A document could contain hidden instructions telling the agent to ignore its original task, reveal confidential information or use one of its connected tools.

When an agent can take actions, prompt injection can become more serious than simply generating a poor answer. It could redirect the agent’s objective or influence the tools it chooses to use.

OWASP identifies prompt injection, goal hijacking and misuse of connected tools among the leading risks affecting generative and agentic AI applications.

How to Reduce the Risk

Businesses should assume that external content may be untrusted.

Controls may include:

• Separating instructions from untrusted content
• Restricting which tools the agent can use
• Validating information before it triggers an action
• Requiring approval for sensitive tasks
• Blocking the agent from handling unnecessary external content
• Testing the agent with malicious or misleading instructions
• Monitoring unusual tool use
• Preventing untrusted content from changing core agent rules

Prompt injection cannot be solved by adding one warning to the agent’s instructions. It requires several technical and operational controls working together.

4. Letting Agents Take High-Impact Actions Without Approval

An agent may eventually be capable of:

• Sending emails
• Approving purchases
• Changing customer records
• Creating user accounts
• Removing access
• Updating payment details
• Deleting information
• Publishing content
• Changing security settings

These actions can save time, but they can also cause significant harm when the agent misunderstands the situation.

An inaccurate response can be corrected before it is used.

An automatically sent message, deleted file or changed payment instruction may be much harder to reverse.

How to Reduce the Risk

Use human approval for actions with financial, legal, security or customer consequences.

Approval should normally be required before an agent can:

• Transfer money
• Change supplier bank details
• Delete business data
• Grant privileged access
• Disable a critical account
• Contact large groups of customers
• Publish external content
• Make an employment decision
• Alter a security policy
• Commit the business contractually

The agent can prepare the action and provide supporting information, but an authorised employee should confirm it.

Automation should increase speed without removing accountability.

5. Agents Can Make Mistakes at Greater Speed and Scale

AI systems can produce inaccurate information, misunderstand instructions or make assumptions that are not supported by the available evidence.

When an employee uses AI to draft one email, the error may affect one message.

An autonomous agent could repeat the same mistake across hundreds of records before anyone notices.

For example, an agent might:

• Apply the wrong classification to every new enquiry
• Send incorrect information to several customers
• Create duplicate tasks
• Remove valid records
• Assign inappropriate permissions
• Misinterpret a pricing rule
• Continue repeating an unsuccessful action

The risk is not only that an agent will make a mistake.

It is that automation can make the mistake happen quickly and consistently.

How to Reduce the Risk

Introduce limits around the agent’s activity.

These may include:

• Maximum numbers of actions
• Spending limits
• Recipient restrictions
• Rate limits
• Approved working hours
• Transaction thresholds
• Automatic pauses after repeated failures
• Test environments
• Rollback procedures
• Manual review samples

Businesses should also maintain an emergency method for disabling the agent quickly.

6. Agents May Trust Other Agents or Systems Too Easily

An agent may depend on information returned by another agent, application or external service.

This creates a chain of trust.

For example:

• One agent collects customer information.
• A second agent analyses the information.
• Another agent updates the customer relationship management system.
• A final agent sends an email.

If the first agent provides inaccurate or manipulated information, the error may move through the complete workflow.

In multi-agent systems, it can also become difficult to determine which agent made the original decision.

How to Reduce the Risk

Each stage should validate the information it receives rather than automatically trusting it.

Businesses should document:

• Which agents communicate with each other
• What data they exchange
• Which system is authoritative
• Who owns each part of the workflow
• Where validation takes place
• Which actions require approval
• How failures are handled

Critical information should be checked against a trusted source before an irreversible action occurs.

7. It May Be Difficult to Know Who Is Accountable

An AI agent may involve several parties.

These could include:

Your organisation

• The platform provider
• The model provider
• An IT provider
• A software developer
• A connector supplier
• A data provider
• A third-party application

When something goes wrong, responsibility may not be immediately clear.

Was the problem caused by the agent’s instructions, the AI model, a connected application, incorrect business data or excessive permissions?

The complexity should not remove your organisation’s responsibility.

The ICO states that organisations remain responsible for data protection compliance when they develop, deploy or integrate agentic AI into their systems and processes.

How to Reduce the Risk

Every agent should have an identified business owner.

That person should be responsible for:

• Approving its purpose
• Confirming its information sources
• Reviewing access
• Monitoring performance
• Managing risks
• Approving important changes
• Handling incidents
• Deciding when the agent should be retired

The organisation should also document the responsibilities of its suppliers through suitable contracts and service agreements.

8. Employees May Trust the Agent Too Much

People may assume that an agent is correct because its answers are detailed, confident and professionally written.

Employees may stop checking its work, particularly when it appears to perform reliably most of the time.

This is known as automation bias.

It can become dangerous when the agent is used for:

• Financial decisions
• Recruitment
• Legal documents
• Cybersecurity
• Customer complaints
• Compliance
• Health and safety
• Employee performance
• Contractual commitments

Human involvement is only useful when the person genuinely reviews the result.

Automatically clicking Approve does not provide meaningful oversight.

How to Reduce the Risk

Employees should be trained to:

• Check source information
• Question unusual outputs
• Identify assumptions
• Verify names, dates and figures
• Understand the agent’s limitations
• Escalate uncertain decisions
• Avoid treating AI as an authority
• Record corrections and failures

The ICO’s guidance on AI-supported decisions emphasises meaningful human oversight and the ability to challenge significant automated decisions.

9. Shadow AI Agents

Employees may create agents without involving IT, security or data-protection teams.

Modern platforms can make it relatively easy to connect AI to documents, spreadsheets and cloud applications.

An employee may build an agent to solve a genuine problem, but they may not consider:

• Which data it can access
• Whether customer information is involved
• Who can use it
• How actions are logged
• Whether the connector is approved
• What happens when the employee leaves
• Whether the agent creates additional costs
• Whether its output is reliable

The organisation may then have several active agents that nobody centrally manages.

How to Reduce the Risk

Create an agent governance process.

This should define:

• Who may create agents
• Which platforms are approved
• Which connectors are permitted
• What information may be used
• When a risk assessment is required
• Who approves publication
• How agents are registered
• How usage is monitored
• How agents are removed

A central inventory should record every approved business agent.

The process should be proportionate so employees are not encouraged to bypass it because approval is unnecessarily difficult.

10. Third-Party Connectors Can Expand the Risk

Agents become more useful when connected to business applications.

They may connect to:

• Microsoft 365
• Customer relationship management systems
• Accounting platforms
• HR systems
• Ticketing platforms
• Cloud storage
• Databases
• Websites
• Industry-specific applications

Each connector introduces another route through which information and actions can move.

A connector may request broad permissions or be maintained by a supplier whose security controls have not been reviewed.

If the connector is compromised, the agent could be used as a route into several connected systems.

How to Reduce the Risk

Before approving a connector, assess:

• The supplier
• Requested permissions
• Data locations
• Authentication methods
• Encryption
• Logging
• Update processes
• Subcontractors
• Incident-notification arrangements
• What happens when the connector is removed

Only approved connectors should be permitted.

Unused connections and access tokens should be revoked promptly.

11. Agent Identities May Not Be Managed Properly

Agents need identities when accessing systems, just as employees and applications do.

If several agents share one identity, it may be difficult to determine which agent completed an action.

If an agent uses an employee’s identity, activity may appear to have been performed directly by that person.

Long-lived credentials can also remain active after the agent has been abandoned.

NIST is examining standards-based approaches for identifying AI agents, authorising their actions and managing their access securely.

How to Reduce the Risk

Each important agent should have:

• A distinct identity
• A named owner
• Limited permissions
• Secure authentication
• Credential rotation
• Logged activity
• A defined expiry or review date
• An offboarding process

Avoid placing passwords or API keys directly into agent instructions, documents or scripts.

Secrets should be stored using an approved secure credential-management service.

12. Sensitive Information May Enter the Agent’s Memory

Some agents can retain information to support future tasks.

Memory may allow an agent to remember preferences, previous conversations, customer details or completed actions.

This can improve usefulness, but it creates questions about:

• What is being remembered
• Where it is stored
• How long it is retained
• Who can access it
• Whether it contains personal information
• How incorrect information is corrected
• How it is deleted

An agent may also infer sensitive information from several apparently harmless pieces of data.

The ICO highlights data minimisation, excessive processing and unintended use or inference of special-category information as risks requiring careful consideration in agentic systems.

How to Reduce the Risk

Configure memory deliberately rather than accepting the default setting.

Businesses should:

• Store only necessary information
• Define retention periods
• Avoid retaining confidential prompts unnecessarily
• Restrict access to memory records
• Provide deletion procedures
• Review whether personal information is required
• Correct inaccurate stored information
• Include memory in data-protection assessments

An agent should not remember information simply because it might be useful one day.

13. Personal Data and Automated Decisions

Agents may be used to support decisions about customers or employees.

Examples could include:

• Reviewing job applications
• Prioritising customer complaints
• Assessing credit risk
• Recommending disciplinary action
• Identifying suspected fraud
• Evaluating employee performance
• Setting prices
• Determining eligibility

These uses may involve personal data and could have significant effects on individuals.

UK data protection requirements continue to apply where AI uses or creates personal information. Organisations need a lawful basis, suitable transparency, accurate information and processes that allow people to exercise their rights.

How to Reduce the Risk

Before using an agent for decisions affecting individuals:

• Involve the data-protection officer or adviser
• Establish a lawful basis
• Assess whether a DPIA is required
• Explain how the agent is being used
• Test for inaccurate or unfair outcomes
• Provide meaningful human review
• Allow decisions to be challenged
• Minimise the personal data processed
• Review the system regularly

AI should not be given authority over significant decisions simply because it appears efficient.

14. Incomplete Logging and Monitoring

Businesses may log an agent’s final answer but not the steps it took to reach that result.

An agent could use several tools, retrieve multiple documents and make several decisions before completing a task.

Without suitable records, it may be difficult to determine:

• Which information was accessed
• Which tools were used
• What actions were attempted
• Why the agent made a decision
• Which employee approved it
• Whether an instruction was manipulated
• What needs to be reversed

NIST has identified traceability and the ability to reconstruct agent actions as important requirements for trustworthy agentic systems.

How to Reduce the Risk

Logging should record relevant information such as:

• Agent identity
• User identity
• Time and date
• Instruction received
• Information sources accessed
• Tools called
• Actions completed
• Approvals
• Errors
• Configuration changes
• Unusual or blocked behaviour

Logs should be protected against unauthorised alteration and retained for a suitable period.

Someone must also review important alerts. Collecting logs without monitoring them provides limited protection.

15. Unexpected Costs and Runaway Processes

Agents may consume paid AI capacity, call external services or create cloud resources.

A poorly configured agent could repeatedly retry a failing task, generate unnecessary output or trigger several chargeable actions.

Costs may come from:

• Model usage
• Agent messages
• Data processing
• Cloud computing
• Storage
• Premium connectors
• External searches
• API requests
• Additional licences

A small workflow may therefore become expensive when it runs frequently or enters a loop.

How to Reduce the Risk

Apply financial and operational limits.

These may include:

• Usage budgets
• Spending alerts
• Maximum iterations
• API rate limits
• Daily action limits
• Automatic shutdown thresholds
• Restrictions on resource creation
• Cost allocation tags
• Monthly usage reviews

Each agent should have an identified cost owner.

16. Agents May Continue Operating After the Business Changes

An agent may be created for a temporary project and remain active afterwards.

Its original owner may change role or leave the organisation. The systems it uses may change, while its instructions remain the same.

An abandoned agent could continue to:

• Access data
• Hold credentials
• Run scheduled tasks
• Generate costs
• Use outdated information
• Create records
• Communicate with employees
• How to Reduce the Risk

Agents should have a defined lifecycle.

The organisation should record:

• Creation date
• Owner
• Purpose
• Permissions
• Connected services
• Review date
• Expiry date
• Retirement process

Agents should be reviewed when employees leave, suppliers change or business processes are redesigned.

Retiring an agent should include revoking credentials, removing connections, preserving required records and deleting unnecessary data.

17. Updates Can Change Behaviour

AI models, agent platforms and connectors can be updated by their suppliers.

An agent that works correctly today may behave differently after a platform change.

Updates could affect:

• Output quality
• Tool selection
• Security controls
• Supported features
• Prompt interpretation
• Logging
• Cost
• Data handling
• Integration behaviour

The organisation may not control every part of the underlying technology.

How to Reduce the Risk

Important agents should be tested regularly and after significant platform changes.

Businesses should:

• Monitor supplier notices
• Maintain test environments
• Recheck high-risk workflows
• Keep configuration records
• Test fallback procedures
• Review costs after updates
• Confirm that security policies still apply

Critical processes should not depend entirely on undocumented agent behaviour.

18. Poor Incident Response Planning

Many organisations have a plan for compromised employee accounts but not for a compromised or malfunctioning AI agent.

During an incident, the business may need to determine:

• How to stop the agent
• Which credentials to revoke
• What information it accessed
• Which actions need reversing
• Whether personal data was exposed
• Which customers were affected
• Whether another system was compromised
• Whether regulators or insurers must be notified

Without preparation, the agent may continue operating while the investigation begins.

How to Reduce the Risk

Include AI agents in your incident response plan.

The plan should identify:

• Agent owners
• Emergency contacts
• Shutdown procedures
• Credential-revocation steps
• Log locations
• Connected systems
• Data-protection responsibilities
• Customer communication
• Recovery procedures
• Evidence-preservation requirements

The plan should be tested through practical exercises.

How to Introduce AI Agents Safely

Businesses do not need to avoid AI agents completely.

The objective is to introduce them in a controlled way that reflects the potential consequences of their actions.

Start With Low-Risk Tasks

The NCSC recommends starting with tasks that are repetitive, well understood and low risk.

Suitable early uses may include:

• Summarising internal information
• Preparing draft reports
• Creating non-sensitive tasks
• Categorising enquiries for review
• Finding approved policies
• Producing meeting actions
• Preparing draft responses

Avoid beginning with payments, administrator access, employee decisions or irreversible changes.

Define the Agent’s Purpose

Every agent should have a clear and limited objective.

Avoid instructions such as:

“Help manage the business.”

A better purpose might be:

“Search the approved HR policy library and provide employees with draft answers. Do not make employment decisions or access individual personnel records.”

The narrower the purpose, the easier it is to define permissions and measure whether the agent is working correctly.

Complete a Risk Assessment

Before deployment, consider:

• What can the agent access?
• What actions can it take?
• What is the worst realistic outcome?
• Does it process personal data?
• Could it affect customers?
• Could it make financial decisions?
• Which external services are involved?
• How will its activity be monitored?
• Can its actions be reversed?
• How will it be stopped?

Higher-risk agents may require cybersecurity, legal, HR and data-protection input.

Apply Human Approval Where Necessary

Approval gates should be based on the potential consequence rather than how confident the agent appears.

A human should normally approve decisions involving:

• Money
• Contracts
• Customers
• Employees
• Security
• Confidential data
• Deletion
• Publication
• Privileged access

The approver should receive enough information to make a genuine decision.

Test the Agent Adversarially

Do not test only with normal requests.

Try to make the agent fail safely.

Tests may include:

• Misleading documents
• Conflicting instructions
• Malicious links
• Requests outside its purpose
• Missing information
• Unavailable systems
• Excessive workloads
• Duplicate records
• Prompt-injection attempts
• Requests for confidential data

Testing should confirm that the agent refuses or escalates tasks it is not authorised to complete.

Monitor Performance and Security

Regularly review:

• Actions completed
• Errors
• Human corrections
• Approval rates
• Information accessed
• Security alerts
• Unusual activity
• Employee feedback
• Customer complaints
• Costs

The agent should be improved or suspended when its risks exceed its benefits.

Create an AI and Agent Policy

Your policy should explain:

• Which AI tools are approved
• Who may create agents
• What data may be used
• Which connectors are permitted
• When approval is required
• How personal data must be handled
• Who owns each agent
• How incidents are reported
• How agents are monitored
• When they are reviewed and retired

Employees should receive practical examples rather than a policy written entirely in technical or legal language.

AI Agents Need Strong IT Foundations

Agentic AI depends on the security and organisation of the systems around it.

Before introducing agents, businesses should strengthen:

• User identity
• Multi-factor authentication
• Access control
• SharePoint permissions
• Data classification
• Patch management
• Endpoint security
• Backup and recovery
• Monitoring
• IT documentation
• Supplier management
• Incident response

An agent can amplify the strengths of a well-managed environment.

It can also amplify weaknesses that the organisation has ignored.

How Hamilton Group Can Help

Hamilton Group helps businesses introduce artificial intelligence and automation securely and practically.

We can review the systems, information and permissions that an AI agent may access before it is deployed.

Our services can include:

• AI readiness assessments
• Microsoft 365 Copilot and agent guidance
• SharePoint and OneDrive permission reviews
• Microsoft Teams governance
• Multi-factor authentication
• Conditional Access
• Microsoft Purview guidance
• Data-loss prevention
• Sensitivity labels
• Agent access reviews
• Cybersecurity risk assessments
• AI usage policies
• Managed endpoint protection
• Security monitoring
• Incident response planning
• Managed IT support

We can help your organisation identify suitable low-risk use cases, apply appropriate controls and create a clear governance process for new agents.

At Hamilton Group, we aim to make first contact on IT support requests within 15 minutes, helping your employees receive assistance quickly when a technology or security issue occurs.

Call Hamilton Group today on 0330 043 0069 to discuss how your organisation can use AI agents while protecting its systems, information, employees and customers.

This article provides general information and should not be treated as legal or regulatory advice. Organisations should obtain appropriate technical, legal and data-protection guidance for their specific use of AI.