Security teams are right to question whether AI agents can be trusted, but many are looking for the risk in the wrong place. Current discussions focus heavily on the model: whether it follows instructions, resists prompt injection or generates unsafe output. These are valid concerns, but they do not represent the full risk. In production, an AI agent becomes an API client, an automation user, a non-human identity, a traffic generator and sometimes a decision-making layer between business users and sensitive systems. This is where the next significant failure is likely to occur. A breach may not result from the model “going rogue” but from excessive API access, misuse of tools, unexpected use of trusted tokens or data movement through application paths that were never designed for autonomous behavior. The primary risk lies not only in what the agent says, but in what it is permitted to do.

Full report : Agentic AI’s Next Breach Won’t Start in the Model. It Will Start in the API Path.