Plan, remember, call, act

An assistant produces text and stops. An agent does four further things, and each one changes what can go wrong. It plans, breaking a goal into steps it chose itself. It remembers, carrying state between steps and often between sessions. It calls tools, reaching systems that do things: a search, a database query, an email, a payment. And it acts, executing those calls without returning to you between each one.

The underlying model is the same. What changed is that its output is now connected to something. A wrong sentence from an assistant is a wrong sentence. A wrong sentence from an agent can be a sent email, a modified record or a transferred sum, and it arrives at machine speed and machine volume.

Planning: the goal is yours, the steps are not

You state an outcome. The agent decides the route. That is the point of it, and it means you did not approve the individual actions, only the objective. If the route is wrong you find out from the consequences.

The first entry in the OWASP Top 10 for Agentic Applications 2026 is ASI01, Agent Goal Hijack: the agent's objective is altered so that it pursues something other than what you asked for, while continuing to behave like a functioning agent. Because the plan was never yours, a hijacked plan does not look obviously different from a legitimate one.

Memory: yesterday's mistake becomes today's premise

Memory is what makes an agent useful across a task and what turns a single bad input into a durable one. ASI06 is Memory and Context Poisoning: content placed into the agent's memory or retrieved context shapes every later decision that reads it. A fabricated fact accepted on Monday is treated as established on Friday, and nothing in the agent marks it as having been inferred rather than verified.

This is a different shape of problem from a one-off wrong answer. A wrong answer is an event. A poisoned memory is a condition.

Tools: the model can now reach your systems

A tool is a capability the agent can invoke. Whatever the tool can do, the agent can cause to happen. ASI02 is Tool Misuse and Exploitation: using a legitimate tool in a way nobody intended, at a scale nobody anticipated. ASI05 is Unexpected Code Execution, which is what happens when the agent can run code and something in its input persuades it to run the wrong code.

Two more sit alongside. ASI03, Identity and Privilege Abuse, is the consequence of the simplest and most common shortcut in agent deployment: running the agent with the credentials of a person, often a person with broad rights, because it was quicker than provisioning it an identity of its own. Every permission that person holds is now a permission the agent holds, including the ones nobody thought about. ASI04, Agentic Supply Chain Vulnerabilities, covers the components, models and tool integrations the agent pulls in.

Acting: no pause between steps

Autonomy is the whole proposition and the whole exposure. Between deciding and doing there is no person, which is what makes an agent worth having and what makes its errors compound.

Three OWASP entries live here. ASI08, Cascading Failures: one wrong step becomes the input to the next, and an agent does not notice that it has left the sensible region. ASI07, Insecure Inter-Agent Communication, arrives once agents talk to one another, where one agent's output is another's trusted input. ASI10, Rogue Agents, covers agents operating outside governance or oversight, including ones nobody remembers deploying.

The one aimed at you

ASI09 is Human-Agent Trust Exploitation. An agent that reports its own work confidently, in the register of a competent colleague, is easier to approve than to check. Article 14(4) of the EU AI Act requires that people exercising oversight remain aware of automation bias, the particular tendency to over-rely on output from an automated system. Agents are where automation bias becomes expensive, because the reviewer is approving batches of already-completed actions rather than considering one recommendation.

Article 14 also requires the ability to intervene or interrupt through a stop button, so that the system halts in a safe state. For an agent, that requirement has teeth only if someone has worked out what a safe state is mid-task, with three tool calls made and two outstanding. If nobody has answered that question, there is no stop button in any meaningful sense, whatever the interface shows.

As of 24 September 2026.