Security and compliance for AI agents

The typical risks of AI agents

The risks of an agent do not arise in the language model alone, but at the point where model output becomes actions in real systems. The OWASP GenAI Security Project lists exactly this point as a risk in its own right in its Top 10 for LLM applications: excessive agency, meaning too much functionality, overly broad permissions and too much autonomy. In practice, we encounter five patterns again and again.

1. Excessive permissions

Agents frequently run under the account of the person who set them up, or under a technical account with full access. The agent can then do everything that person can: read every mailbox, delete every file, prepare every bank transfer. With agents, the principle of least privilege is often the first thing to be sacrificed, because dropping it makes getting started easier.

2. Prompt injection

In a prompt injection, an input contains instructions that the model mistakes for a task. The indirect variant is particularly dangerous: the instruction is hidden in an email, a PDF or a web page that the agent processes as part of its task. Nobody needs access to your systems for this - a crafted message in the inbox is enough. We collect documented cases in our article When AI agents act on their own.

3. Acting without approval

Many agent frameworks execute a tool call as soon as the model generates it. There is no second authority that checks whether this call is permissible at this moment. Where human approvals exist, they quickly become routine when requests are frequent, and lose their protective effect.

4. Data exfiltration

An agent with read access to confidential data and a path to the outside world is a potential channel for data exfiltration. This does not have to be an outgoing email: a link that the agent retrieves, with confidential content embedded in its address, is sufficient. On top of that, data flows to cloud providers whenever documents are sent to external models for processing.

5. Missing logs

After an incident, the same questions always arise: what did the agent do, at whose instigation, on what basis? Chat histories do not answer them. Without an audit trail at the level of each individual action, neither the cause nor the damage can be reliably established.

How AEGIS addresses these risks

None of these measures relies on the model behaving well. That is the decisive difference from safeguards that run in the same process as the agent, such as guardrails in the prompt or an assessment of the output by a second model. The How it works page shows how the authorities interact.

AI agents and the AI Act

The EU AI Act does not regulate "agents" as a technology, but intended purposes. An agent that pre-codes receipts for bookkeeping or answers questions from internal manuals is, as a rule, not a high-risk AI system. An agent that pre-sorts job applications or helps decide on access to essential services may well be.

For high-risk systems, the AI Act requires, among other things, effective human oversight including the ability to bring the system to a safe stop (Article 14), as well as automatically generated logs that deployers must retain (Article 26). The Digital Omnibus Regulation (EU) 2026/1744 postponed the date from which these obligations apply: to 2 December 2027 for systems under Annex III, and to 2 August 2028 for systems in regulated products under Annex I. Independently of this, the prohibitions of certain practices under Article 5 have applied since February 2025.

AEGIS does not establish conformity. It does, however, supply the technical building blocks that conformity work can rely on: limited and documented powers, a check before every execution, a maximum level as an emergency brake and a tamper-evident log. The article What is AI agent governance? provides a detailed overview with sources.

GDPR and data sovereignty

As soon as an agent processes personal data, the GDPR applies - which in a law firm, a tax practice or a medical practice means virtually always. Three obligations are particularly relevant for agents: accountability (Art. 5(2)), that is, being able to demonstrate what happened to which data; data protection by design and by default (Art. 25), that is, default settings that use only as much data as necessary; and security of processing (Art. 32). Where health data is processed on a large scale, a data protection impact assessment under Art. 35 is also required.

If an agent is operated as a cloud service, documents, prompts and results pass to a processor, often with links to third countries. AEGIS runs on your hardware. Models, knowledge base and logs remain within your infrastructure, and you decide whether the system may reach destinations outside your network at all. This considerably simplifies your record of processing activities, your impact assessment and discussions with your data protection authority - data sovereignty in the literal sense.

NIS2 and the NISG 2026

In Austria, the NISG 2026 (Austria's Network and Information Systems Security Act 2026, which transposes NIS2) has applied since 1 October 2026. Entities within its scope, including many healthcare providers of medium size and above, must demonstrate risk management, access control and incident reporting. From this perspective, an agent with access to systems is a privileged account like any other - with the difference that it takes its instructions from texts. Separation of duties, least privilege and a complete log are therefore not optional extras but part of the required measures.

What AEGIS does not do

Honesty is part of security. AEGIS does not prevent incorrect content: if a model summarises a document incorrectly, the summary remains incorrect, even if reading was permitted. AEGIS does not replace legal advice, a data protection impact assessment or training for your team. And an allowlist that is drawn too generously remains too generous. What AEGIS stands for is narrower, and verifiable in return: nothing is executed without a valid approval from the checking authority, and every decision is traceable.