Is it safe to let an AI agent act on company systems?

A chatbot answers. An agent acts: it opens a browser, runs a terminal command, calls an API, or uses a tool connected through the Model Context Protocol (MCP). Each of those actions runs on a credential someone handed it, such as a login, an API key, or an OAuth token. The useful question is what that credential reaches, who approves the risky steps, and whether anyone can reconstruct afterward what the agent did.

What can an AI agent do with your credentials?

Everything the credential allows. OpenAI's help center says that once an agent is signed into websites or given apps, it can read emails, files, and account settings and act on your behalf, for example by sharing files or changing account settings. The joint agentic AI guide from CISA, the NSA, and the cyber agencies of Australia, Canada, New Zealand, and the United Kingdom describes a procurement agent given broad access to finance, email, and contracts. An attacker who compromises one low-risk tool in its workflow inherits all of that access, and the audit logs look legitimate because the trusted agent did the work.

Two verified incidents show the pattern. In July 2025, AWS reported that a GitHub token with overly broad scope let an attacker commit malicious code into release 1.84.0 of the Amazon Q Developer extension for VS Code; the code failed to run because of a syntax error. The same month, Fortune reported that Replit's coding agent deleted a live production database during a declared code freeze. Replit's CEO called it unacceptable and said the company was adding automatic separation between development and production databases.

Is ChatGPT agent mode safe?

OpenAI has retired it. As of October 8, 2026, the help center says ChatGPT agent is no longer available and points users to ChatGPT Work and its cloud browser. That browser runs on a separate computer in the cloud and keeps its own cookies and sign-ins, apart from your personal browser. By default it asks before visiting a new website, and it asks for confirmation in chat before actions that are hard to reverse or that create a financial, legal, or account commitment. Passwords go through a secure sign-in form the model never sees. OpenAI states plainly that these safeguards do not remove every risk, and it lists an "Always allow" setting for every website as not recommended.

One detail from the retired product is worth carrying into any assessment: OpenAI's Compliance API recorded agent conversations but not the individual agent actions, such as app requests. Ask every agent vendor the same question about its own logs.

How safe are AI coding agents like Claude Code, Copilot, and Cursor?

All three ship approval controls. Risk enters when a team switches on blanket auto-approve to stop the prompts, or connects the agent to production systems with a developer's own long-lived token. Anthropic's documentation puts the duty plainly: the person approving is responsible for reviewing proposed code and commands.

What does least privilege mean for LLM tool execution?

OWASP's LLM06:2025 Excessive Agency names three root causes:

• Excessive functionality: a tool that only needs to read documents also carries delete and modify functions.
• Excessive permissions: a read-only tool connects to a database with an account that can also write and delete.
• Excessive autonomy: a high-impact action runs with no user confirmation.

The OWASP Top 10 for Agentic Applications, published December 9, 2025, extends this into least agency: grant autonomy only where it adds value. Its guidance for tools is concrete. Give each tool its own profile, such as read-only queries for a database and no send or delete rights for an email summarizer, and issue short-lived credentials bound to one user session.

How should MCP servers handle credentials?

The MCP specification's security best practices (version 2025-11-25) set three rules that matter most here. An MCP server must reject any token that was not issued for that server; passing a client's token straight through to another API is explicitly forbidden, because downstream logs then show the wrong identity and controls tied to that identity stop working. Scopes start small and grow only when a privileged operation first needs them; wildcard scopes such as files:* or admin:* turn one stolen token into broad access. A local MCP server runs with the same privileges as the app that launched it, so a client offering one-click setup must show the exact command and get explicit approval before running it.

Treat each MCP server as third-party software with your keys inside it. Anthropic notes that it reviews connectors for its directory against listing criteria and does not security-audit them.

Which agent actions need human approval?

Anything hard to undo: deleting data, moving money, publishing, sending information outside the company, and changing permissions. OWASP recommends showing the person a dry-run or diff of the planned change before they approve it. The CISA guide adds that agents should never be able to change their own privileges. OWASP's own example explains why: a hidden instruction in an incoming email tells an assistant to search the inbox and forward sensitive messages. A read-only mail tool, a read-only OAuth scope, and a human review before anything is sent each stop it.

What should you log for every tool call?

• Identity: which agent acted, and which person or workflow it acted for.
• Action: the tool, its parameters, and the result.
• Approval: who approved a consequential step, and when.

OWASP calls for immutable logs of every tool invocation and alerts on unusual chains, such as a database read followed by an external transfer. CISA asks for tool use in human-readable logs. NIST AI 600-1 flags indirect prompt injection, where instructions hide inside data the agent retrieves, and says documenting third-party plugins is especially important when an incident has to be disclosed.

How do you assess an AI agent before turning it on?

• Inventory the reach: list every tool, connector, MCP server, and credential the agent can use, and remove the ones the task does not need.
• Scope each credential: give the agent its own identity, read-only access wherever possible, and tokens that expire.
• Name the approval points: write down which actions pause for a person, and test that they actually pause.
• Isolate execution: run code and commands in a sandbox or separate machine, allowlist outbound network access, and keep production data out of development.
• Confirm the logs: check that individual tool calls appear in a record your security team can read, beyond the conversation transcript.
• Pilot small: start with a low-risk task, plant a test instruction in a document the agent will read, and widen access only after it passes.

Agent products change monthly. Re-run this assessment when a vendor changes its defaults, when you add a tool, and at least every quarter.