What Are the Risks and Limitations of AI Agents?

The honest answer to "should we deploy agents?" is boring, and that's the point: start supervised, scope the tools tight, and put a human in front of every irreversible action. An agent isn't a smarter chatbot. It's software that takes a goal, plans its own steps, calls tools, and acts on the results — and that autonomy is exactly what turns an ordinary model mistake into a real-world action.

• A chatbot's wrong answer stops at the screen. An agent's wrong answer books, sends, deletes, or publishes. McKinsey's November 2025 survey of 1,993 organisations found 51% of AI users reported at least one negative consequence, with inaccuracy the most common at 30%. The model didn't get worse — the blast radius did. A wrong fact pulled early in a multi-step run shapes every step after it, and the agent can report tidy success it never actually achieved.
• The model can't tell instructions from data — and attackers know it. Indirect prompt injection hides orders in the web pages, emails, and tool results an agent reads. The proof is EchoLeak: one crafted email, zero clicks, and Microsoft 365 Copilot exfiltrated data from OneDrive and SharePoint through its own legitimate tools (CVE-2025-32711, CVSS 9.3). OWASP's December 2025 Top 10 for Agentic Applications catalogues the rest — goal hijack, tool misuse, identity abuse, memory poisoning — and Google found malicious prompt injection in scanned pages up 32% in three months.
• Context is a ceiling, not a detail. Long runs fill the context window with tool results, retries, and corrections until the earliest constraints get crowded out. Add the cost and latency of every extra model call, plus failure traces you can't reliably reproduce, and debugging an agent starts to feel like debugging a colleague's judgment — you can see what it did, but not quite why.
• The controls that work are unglamorous, and that should tell you something. Risk-tiered human approval (drafts run free, refunds and deletions need a real person), least-privilege tool scoping with a separate identity per agent, sandboxed testing, and full tracing. Nothing here is clever. That's the verdict: the teams shipping agents safely aren't the ones with the best models, they're the ones who scoped the blast radius before the demo impressed anyone.

Go deeper

The full piece maps every risk class — reliability, security, operations, governance — with a checklist for deciding whether your task deserves an agent at all, or just a deterministic workflow. Read it here: What Are the Risks and Limitations of AI Agents?

Originally published on Agentic Affairs (https://agentic-affairs.com)