What Actually Makes a System Agentic
A generative system answers; an agentic one acts. The autonomous loop of observing, deciding, and executing is the precise point where a bad model output turns into a real-world side effect.
By Piotr Zenon Żabrowski · Published · Updated
The shift from generation to action
A standard generative model operates on a query-response pattern. A user submits text, the model processes the input, and it returns a string of text. If the system is mistaken, tricked, or compromised, the worst immediate outcome is a false or malicious sentence on a screen. The failure is confined to the output layer.
An agentic system behaves differently. Instead of just replying, it operates on a continuous plan-act-observe loop. When given a high-level goal, an agent breaks the objective into discrete steps, selects a tool to accomplish the first step, executes it, and reads the result. Based on that observation, it decides what to do next. The system loops autonomously until it determines the goal is complete.
Why the loop expands the threat model
This operational loop fundamentally alters the security baseline. The distinction between generating text and executing a plan is the first thing an engineer must verify before threat-modeling any new feature. You are no longer just assessing what a model might say; you are evaluating what external systems it can reach.
Interconnecting multiple agents, tools, and external services increases the attack surface. Because an agent can act autonomously, an error, deception, or compromise within its loop can cause it to perform an unintended action against an external system. A vulnerability in one component can thus be exploited to manipulate the behavior of the entire pipeline.
- A flawed query-response model drafts a phishing email for an attacker to send.
- A flawed agentic system drafts the email, looks up the target directory, and sends the messages itself through a connected API.
- A flawed query-response model suggests a destructive database command.
- A flawed agentic system executes the command and deletes the records.
Evaluating agentic features
Recognizing an agentic pattern early prevents security teams from applying the wrong controls. Threat-modeling a generative application usually focuses on prompt injection, content filtering, and output encoding. Threat-modeling an agentic application requires examining execution privileges, tool scopes, and state changes. If a feature description implies that the system will decide how to accomplish a task and then take steps to do so, it is agentic, and it requires an architecture that assumes the loop will eventually be compromised.
Related
AI security
How to secure GenAI, LLM and agentic AI systems: current OWASP threat classes, layered controls, agent authority, retrieval isolation and monitoring.
Three layers, three risk profiles
A security review that skips naming its layer — model, service, or agent — ends up testing the wrong attack surface.
Containing compromised agents
An agent will eventually be tricked, mistaken, or hijacked. Five architectural controls decide what it can still do when that happens.
Disclosure as a control
Telling users they're talking to AI, and labeling synthetic audio and video, works as an operational defense against AI-accelerated phishing and fraud.
Where the credential lives
Two shapes of agent isolation, the one that keeps keys out of the process, and the failure both shapes still miss.
AI security assessment
Security assessment of GenAI and LLM systems: prompt injection, tool and agent abuse, data leakage, model supply chain and monitoring gaps.