What happens when AI acts on its own?
AI agents.
Agents read, plan and carry out tasks themselves: write emails, change files, trigger purchases. That is powerful and risky.
In 60 seconds
- Agents plan and act on their own and therefore need guardrails.
- Biggest risk: hidden instructions in emails, websites and documents.
- A human always confirms risky actions.
Legal status: 5 November 2026
Chatbot, assistant or agent?#
The difference lies in the ability to act.
| Chatbot | Assistant | Agent | |
|---|---|---|---|
| Task | Answers questions | Helps within programs (drafts, suggestions) | Pursues a goal over several steps |
| Access | Only the conversation | The user's documents and data | Tools, accounts, programs, internet |
| Who acts | The human | The human, with suggestions from the AI | The AI, sometimes without asking |
| Risk | Wrong answers, data leakage | Additionally access to data | Additionally real actions with consequences |
Conceptually, an agent is a language model connected to tools, memory and a planning loop.
The work loop of an agent.#
Plan, act, read, check: until the goal is reached.
Appointments and tasks
The agent schedules appointments, sorts mailboxes and reminds you of deadlines.
Programming
Coding agents read projects, change files and run tests.
Research
Agents collect sources, compare them and summarise them.
Customer service
Agents handle requests, resolve standard cases and hand over difficult ones.
IT operations
Agents analyse alerts, start checks and suggest measures.
Purchasing and booking
Agents compare offers and place orders. Particularly critical.
The biggest risks.#
Excessive permissions
An agent with too many rights can cause great damage if it makes a mistake or is manipulated.
Indirect prompt injection
An email, website or document contains hidden instructions. The agent reads and follows them without the user noticing.
Questionable tools
Every connected service or extension server is a decision of trust. Unknown sources can siphon off data.
Data leakage through actions
A manipulated agent can send data to strangers in links, images or messages.
Error cascades
A mistake in the first step grows over many automatic follow-up steps. Loops cause costs.
Identity and traceability
Agents need their own accounts with their own permissions and complete logs: who triggered what?
Levels of autonomy.#
How much freedom does the agent get?
| Level | Description | Example | Control |
|---|---|---|---|
| 1. Suggestion | Agent suggests, human carries out | Text draft, code suggestion | Human always acts personally |
| 2. With approval | Agent prepares, human confirms every action | Agent drafts an email, human sends it | Approval per action |
| 3. Limited autonomy | Agent acts within a narrow scope, exceptions go to the human | Sorting tickets, standard replies | Limits, logs, spot checks |
| 4. Largely autonomous | Agent decides and acts independently | Only for low-risk, reversible tasks | Strong monitoring and emergency stop |
Rule of thumb: the harder an action is to undo and the more sensitive the data, the lower the level.
Guardrails for agents.#
7 rules that noticeably reduce the risk.
Minimal permissions
Only the access the task needs. Separate accounts instead of administrator access.
Separate data and instructions
External content is data, not commands. Check input from emails and websites.
Approval when risky
The human confirms payments, deletions, external messages and permission changes.
Sandbox
Run actions in an isolated environment without access to production data.
Limits and budgets
Caps on steps, costs and time so that loops end.
Logs and undo
Log every action traceably and make it reversible where possible.
Check tools
Only connect vetted extensions and data sources, pin versions.
Check: using agents safely.#
6 questions before an agent gets started.
Rough guidance, not an audit. Your selection stays in your browser.
Frequently asked questions.#
What is MCP?
The Model Context Protocol is an open standard that lets AI applications connect tools and data sources. In practice, every connected server is a decision of trust and should be checked like any other software.
May an agent sign contracts or trigger payments?
Technically yes. Legally, the agent's actions are usually attributed to whoever uses it. Such actions need approvals and clear limits. Have them checked legally.
Are agents regulated by the AI Act?
Yes, like other AI systems, according to their purpose: depending on the application, transparency, high-risk or general obligations apply. More under AI regulation.
How do I start safely?
With a low-risk, reversible task at level 1 or 2, separate accounts with minimal permissions and logging. Then expand step by step.
Planning agents?
Tell me which task an agent should take on, and we will add to the content.
Sources and further reading
Was this page helpful?
Found a mistake? Let me know.
Suggested citation: Russo, K.: "AI agents". sicherheitsdenker.de/en/ki-agenten/, as of 6 November 2026.