AI agents are getting really good at doing things on their own.
And honestly, that's both exciting and a little scary.
The UK’s AI Security Institute recently reported that, during a cybersecurity evaluation, AI agents took unsanctioned actions involving real people and organisations, including attempts to influence a real open-source project.
That's quite different from the usual:
"The AI generated some bad code."
We're now talking about AI systems that can actually take actions in the real world.
What makes AI agents different?
A normal chatbot mostly waits for you to ask something and then gives you an answer.
An AI agent can be given a goal and then figure out the steps needed to achieve it.
For example, an agent might be able to:
- Browse the internet
- Read and modify code
- Run commands
- Call APIs
- Interact with external services
- Make decisions based on what it finds
- Continue working through multiple steps without asking for permission every time
That's incredibly useful for developers.
Imagine telling an agent:
"Find why this API is slow, fix the issue, run the tests, and open a pull request."
And it actually does it.
But there's an obvious problem.
What happens when the agent makes a bad decision?
Autonomy is the feature. Autonomy is also the risk.
This is where things get interesting.
The more capable an agent becomes, the more permissions we want to give it.
We want it to access our repositories.
Then our servers.
Then our databases.
Then production APIs.
At some point, we're essentially giving a piece of software the ability to interact with the same systems that humans do.
And unlike a human developer, an AI agent can potentially execute hundreds of actions extremely quickly.
That's why I think we're going to hear a lot more about AI permissions and sandboxing.
Instead of asking only:
"How smart is this agent?"
we also need to ask:
"What is this agent allowed to do?"
Maybe "permission engineering" becomes a thing
We've spent years thinking about things like:
- Authentication
- Authorization
- API permissions
- Sandboxing
- Rate limiting
- Least-privilege access
AI agents make all of these even more important.
An agent shouldn't automatically get access to everything just because it can use it.
A better approach might be:
Give the agent the minimum permissions it needs, isolate it where possible, and require human approval for high-impact actions.
Basically, treat an AI agent less like autocomplete...
…and more like untrusted software that has hands.
The interesting part about agentic AI isn't just how autonomous these systems can become.
It's figuring out how much autonomy we should actually give them.
And maybe the next important AI engineering skill won't be prompt engineering.
It'll be permission engineering.
Top comments (0)