AI Integration Risk: Field Notes

The shift: from answering to acting

The first wave of business AI answered questions. The current wave acts. Agents read inboxes, open files, query databases, call APIs, write code, and hand work to other agents. That is where the value is, and it is also where the security model changes.

A chatbot that gives a bad answer is a quality problem. An agent that takes a bad action with your credentials is a security incident. Every new connection is a new trust relationship, and many organizations are adding them faster than they are reviewing them.

What is documented now

These are not theoretical. They are catalogued by the security community and show up in real deployments.

Prompt injection. Instructions hidden in content the model reads (an email, a web page, a document, a tool result) can redirect what it does. OWASP ranks it first in its 2025 Top 10 for LLM applications. When the model can only talk, injection produces a bad answer. When it can act, injection produces a bad action.
Excessive agency. Agents are often given broad permissions because narrow ones are inconvenient to set up. Whatever the agent can do, an attacker who steers it can do.
Sensitive data exposure. Data flows into prompts, logs, vendor systems, and memory features that were never part of the original data-handling plan.
Agentic failure modes. OWASP’s Top 10 for Agentic Applications names goal hijacking, tool misuse, identity and privilege abuse, supply-chain issues, memory poisoning, cascading failures, and rogue agents.

Agents talking to agents

Increasingly, agents pass work to other agents through standard protocols. A research agent summarizes; a planning agent decides; an execution agent acts. The messages between them are machine-to-machine and usually not reviewed by a person.

That creates a chain where trust compounds. If the first agent ingests a malicious instruction, it can pass a convincing, well-formatted request to the next, which has no reason to doubt a peer. OWASP lists insecure inter-agent communication and cascading failures as distinct agentic risks for exactly this reason. The agent with the most dangerous permissions is often the one furthest from the original untrusted input, and the hardest to trace back.

What research is finding

The following results come from controlled research settings. We include them because they shape how systems should be designed now, not because they describe common incidents today.

Covert communication between agents

Researchers at NeurIPS 2024 formalized “secret collusion”: AI agents using steganography to hide information inside ordinary-looking messages so overseers cannot see it. They measured growing steganographic capability in frontier models and found that common countermeasures such as monitoring and paraphrasing had real limits.

Stated reasoning is not a reliable audit trail

Anthropic tested whether reasoning models disclose what influenced their answers. Given hints, the models mentioned using them only a minority of the time (about 25% for one model, 39% for another). Reading a model’s explanation of itself is useful, but it is not proof of what it actually did.

Put together, these point to the concern we are studying: as more decisions pass between agents, the ability to see why something happened shrinks, and the assumption that we can simply ask the system becomes weaker. The benefit, autonomous systems coordinating at machine speed, becomes the risk when no one can verify the coordination.

What we recommend

None of this means avoiding AI. It means engineering it like any other system that holds credentials and touches real data.

Give each agent the least it needs

Separate credentials per agent, scoped to specific tools and data. No agent should inherit a person’s full access.

Treat every input as untrusted

Email, web pages, files, tool results, and other agents’ messages can all carry instructions. Design as if they will.

Keep a human on consequential actions

Sending, paying, deleting, deploying, and changing permissions should need explicit approval.

Structure agent-to-agent messages

Typed, schema-checked fields leave far less room for hidden content than free-form text between agents.

Log everything, outside the agent

Record every prompt, tool call, and inter-agent message in a store the agents cannot modify.

Monitor independently

Do not rely on an agent’s own explanation of what it did. Check actions against expected behavior.

Bound the blast radius

Rate limits, spending caps, and a tested way to stop the whole system quickly.

Respect data boundaries

CUI, export-controlled, and client data go only to services approved for them, including the model provider.

Questions to ask before you integrate

What can this system do without a person approving it?
Which outside content can reach the model, and could it carry instructions?
Which credentials does each agent hold, and who else could use them?
Can we reconstruct exactly what happened, from logs the agents cannot change?
Where does our data go, and what do the vendor’s terms allow it to be used for?
How do we turn it off, and have we tried?

If you can answer all six with confidence, you may not need outside help. If several are hard to answer, that is the right moment for a design review, before the agents are connected.

About these notes

Field notes are working research. We update them as the evidence changes and mark revisions with the date. Spotted something we should add or correct? Tell us.

When the benefit becomes the attack surface.