It would be wrong for business leaders to think of AI agents as autonomous villains or existential threats. They are currently more like teenagers who need guidance in what is and what is not acceptable, rather than being characterised by malicious intent. But what they will do is find the quickest, most direct way to complete a task. In every scenario, they are looking to answer the question: how can I achieve the objective I’ve been given in the most efficient way?

The real risk for businesses is more operational at this stage. Left unmanaged, agents can and will introduce serious risks into the enterprise, exploiting misconfigurations, scavenging credentials, and digging up sensitive data that a human creator never intended for them to see.

Goal-seeking is an intrinsic strength of agent technology. However, when that capability operates outside a framework – when AI agents are left undiscovered and ungoverned – agents can exercise ‘bad behaviour’ like acquiring excessive permissions or taking unintended actions.