7. Agentic AI

Introduction

Throughout this chapter, we’ve explored the foundations of AI systems, from understanding their core architectures to examining deployment strategies, technical underpinnings, crafting effective prompts, and implementing inference techniques. Now we turn to the most significant development in the 2025/2026 AI landscape: agentic AI is here, and it’s in production.

This isn’t speculation about a future technology. Software engineers use Claude Code and Cursor daily to write production code. Businesses run autonomous workflows through n8n and CrewAI. OpenClaw demonstrates open-source agentic capabilities. The shift from passive tools to proactive agents has already happened – and it fundamentally changes both what AI can do and what can go wrong.

Agentic AI Is Production Reality

Generative AI evolved in stages, and we are firmly in the agentic stage:

• Stage 1: Base Models – LLMs that generate text from prompts. Useful but limited to training data. No ability to verify facts or take actions.

• Stage 2: RAG Systems – LLMs augmented with external knowledge retrieval. Can reference current information. Still reactive – only responds to prompts.

• Stage 3: Agentic AI (Now) – AI systems that pursue goals, make decisions, use tools, and take autonomous action. Can write code, execute commands, browse the web, manage files, and interact with external services – all without human intervention at each step.

The Agent Loop

At the core of every agentic system is a loop: the agent plans what to do, selects and uses tools, observes the results, and decides whether to continue or return a result. This loop is what gives agents their power – and their risk.

graph TB
    subgraph "Trust Boundary: Agent Core"
        A["1. Plan<br/>(Decompose goal into steps)"] --> B["2. Select Tool<br/>(Choose appropriate action)"]
        B --> C["3. Execute Tool<br/>(Take action in the world)"]
        C --> D["4. Observe Result<br/>(Evaluate what happened)"]
        D --> E{"5. Goal Met?"}
        E -->|No| A
    end

    subgraph "Trust Boundary: External World"
        F[API Endpoints]
        G[File System]
        H[Database]
        I[Web Browser]
        J[Code Execution]
    end

    C -.->|"crosses trust boundary"| F
    C -.->|"crosses trust boundary"| G
    C -.->|"crosses trust boundary"| H
    C -.->|"crosses trust boundary"| I
    C -.->|"crosses trust boundary"| J

    E -->|Yes| K[Return Result]

    style A fill:#2d5016,color:#fff
    style B fill:#2d5016,color:#fff
    style C fill:#8b0000,color:#fff
    style D fill:#2d5016,color:#fff
    style F fill:#4a4a4a,color:#fff
    style G fill:#4a4a4a,color:#fff
    style H fill:#4a4a4a,color:#fff
    style I fill:#4a4a4a,color:#fff
    style J fill:#4a4a4a,color:#fff

Notice the red “Execute Tool” step – this is where the agent crosses from its internal reasoning space into the external world. Every tool execution is a trust boundary crossing, and every trust boundary crossing is a potential attack surface.

The Spectrum of Agency

Not every AI-powered system is truly “agentic.” Agency exists on a spectrum, and understanding where a system falls on that spectrum determines its capabilities and its risk profile.

Script vs. Agent: The Critical Distinction

Not an Agent: A Python script that prompts an LLM with “Is this email a phishing attempt? Answer TRUE or FALSE” and routes the email accordingly. This is automation with an LLM component – the script has no agency beyond executing predefined steps.

True Agent: A system that receives “investigate this security alert,” then autonomously decides to check logs, query the SIEM, correlate with threat intelligence, draft a report, and escalate if severity warrants it – choosing its own path based on what it discovers.

Agentic Tools in Production

Agentic AI tools are already part of the daily workflow for millions of professionals. Here’s the current landscape across three categories:

Agentic Workflows: How Agents Work Together

An agentic workflow is a structured series of steps dynamically executed by one or more AI agents. What makes a workflow “agentic” is that AI agents guide the progression rather than following a predetermined path.

Distinguishing Workflow Types

The Three Pillars of Agentic Workflows

1. Planning: The agent breaks down complex tasks into sub-tasks and determines execution order. Attack surface: plan manipulation through crafted inputs can steer the agent toward malicious actions.

2. Tool Utilization: Agents use predefined tools with specific permissions to carry out tasks. Attack surface: tool misuse, permission escalation, and indirect prompt injection through tool outputs.

3. Reflection and Iteration: Agents assess results, adjust plans, and loop until satisfied. Attack surface: poisoned observations can cause agents to take increasingly harmful corrective actions.

Example: Multi-Agent Workflow

Consider a content creation workflow:

1. Manager Agent: Receives the brief, decomposes the task, assigns to specialists
2. Research Agent: Searches for relevant information from multiple sources
3. Writer Agent: Creates draft based on research and brief
4. Editor Agent: Reviews for accuracy and clarity
5. Quality Control Agent: Final check against criteria

Each agent makes independent decisions. The collective workflow adapts based on intermediate results. And each inter-agent communication is a potential injection point – Chapter 2 explores how compromising one agent can cascade through the entire workflow.

Security Implications: Every Capability Is an Attack Surface

This is the critical insight that bridges Chapter 1 to Chapter 2: every agentic capability creates a corresponding attack surface. The same features that make agents powerful make them dangerous when compromised.

The Business Case

The adoption of agentic AI is driven by compelling business outcomes:

• Operational Efficiency: Companies using agentic AI report 20-30% productivity gains in affected workflows
• ROI Timeline: Initial investment typically recovered within 12-18 months
• Market Growth: PwC projects agentic AI could contribute $2.6-$4.4 trillion annually to global GDP by 2030
• Adoption Forecast: Gartner predicts 33% of enterprise software will incorporate agentic capabilities by 2028
• Developer Adoption: Surveys indicate over 60% of professional developers use AI coding assistants daily in 2025

These numbers explain why organizations are adopting agentic tools despite the security implications – the productivity gains are too significant to ignore. The challenge, which we’ll address in Chapters 2 and 3, is how to capture these benefits while managing the expanded attack surface.

Looking Ahead: From Understanding to Security

This section completes Chapter 1 – your foundation in how AI and LLM systems work. You now understand:

• How LLMs generate text, reason through problems, and process multiple modalities
• The landscape of providers, models, and deployment options
• How to communicate effectively with AI through prompt engineering
• How inference works in practice, from API calls through RAG pipelines
• How agentic AI systems plan, act, and iterate autonomously

In Chapter 2, we shift from understanding to attacking. Every concept you’ve learned here has a corresponding vulnerability:

• Prompt engineering becomes prompt injection
• RAG pipelines become data poisoning vectors
• The agent loop becomes an attack surface for indirect manipulation
• Tool use becomes a path to unauthorized system access
• Multi-agent workflows become cascading compromise chains

The foundation you’ve built in this chapter is essential – you can’t effectively attack or defend systems you don’t understand.