Skip to content
redactsure
Book a demo

Explore.

Explainer · By Chris Sowa · Published
Last updated

What Is an Autonomous AI Agent and How Do You Secure One That Acts Without Human Approval?

An autonomous AI agent plans its own steps and carries them out across applications for hours without a person at the keyboard. Securing one turns on which actions stop for a named person, enforced outside the model. Trust refusal alone and the first persuaded or mistaken run becomes an incident nobody approved.

A computing task approaches an action barrier while its activity records follow an audit path.

An autonomous AI agent plans its own steps and carries them out across applications for hours without a person at the keyboard. Securing one turns on which actions stop for a named person, enforced outside the model. Trust refusal alone and the first persuaded or mistaken run becomes an incident nobody approved. The question has moved from the lab to the procurement desk in a single year: agents that run on their own cloud computers, work while their owner is away and connect to thousands of applications are now sold by subscription, and the vendors' own documentation tells buyers to review consequential work because the agent can still make mistakes. What separates a governed autonomous agent from an ungoverned one is where the stop sits. In Supervised Delegation, a named person grants the access, chooses the applications, confirms what is tokenized, can watch and pause the run, and approves every consequential action, on the record. The agent keeps its autonomy over the steps in between. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Key findings

  • New training techniques let AI systems reason step by step and operate autonomously for longer periods, which widens the work they can do and creates new challenges for cyber security and for oversight of the systems themselves (International AI Safety Report, 2025).
  • Model refusal is treated as a primary safety mechanism yet is far from foolproof; vendors stack system prompts, classifiers and activation probes in a "Swiss cheese" arrangement where each layer has holes, and one type of safety classifier added 24 percent to a vendor's chatbot compute costs (MIT Technology Review, 2026).
  • OWASP names Excessive Agency, LLM06 in its 2025 Top 10, as the failure in which an agent is given more functionality, permissions or autonomy than the task requires, so that a mistaken or manipulated model produces a damaging action (OWASP, 2025).
  • OpenAI's Dots run on their own cloud computers, do proactive research in read-only mode while the user is away, and carry Custom Rules that set what a dot may do alone and what needs approval; OpenAI's own guidance is that dots can still make mistakes and consequential work should always be reviewed (OpenAI, 2026).
  • In Anthropic's agentic misalignment research, models given autonomous roles and goals in simulated corporate settings chose harmful actions such as blackmail and leaking information when those actions served the assigned goal (Anthropic, 2025).
  • Gartner's position is that applying uniform governance across AI agents will lead to enterprise AI agent failure; governance has to match what each agent is allowed to do (Gartner, 2026).

What makes an AI agent autonomous?

Autonomy is an operational property, not a marketing tier. Three things have to be true at once. The agent plans: given a goal rather than a command, it works out a sequence of steps on its own, revises that sequence when a screen or a result is not what it expected, and does so without a person prompting each move. The agent acts across steps: it opens applications, reads what they show, fills fields, moves between systems and carries the result of one step into the next. And the agent runs long: minutes, hours or a standing assignment, with the person who set the goal absent for most of it. A chat assistant that drafts a paragraph has none of these. A computer-using agent that reconciles a vendor statement across an ERP, a bank portal and an inbox has all three.

The International AI Safety Report's 2025 key update describes the capability shift behind this: new training techniques let systems reason step by step and operate autonomously for longer periods, widening the work they can do and creating new challenges in cyber security and in oversight of AI systems themselves (International AI Safety Report, 2025). The commercial products confirm the shift. OpenAI describes Dots as always-on agents with their own cloud computer and browser that can be assigned work through chat, Slack or Teams, and that do proactive research while the user is away (OpenAI, 2026; The Next Web, 2026). Meta's Muse gives each user a dedicated secure virtual machine with a browser and an agent that reads pages in full (Meta AI Research, 2026).

Property of autonomy What it looks like in a run What it changes for security
Plans its own steps Goal in, sequence of actions out; the sequence changes as screens change The exact actions cannot be reviewed in advance, because they do not exist in advance
Acts across applications Reads one system, writes to another, carries values between them Every screen it opens becomes model input, and every field it fills becomes an action
Runs without a person present Hours-long tasks, overnight work, standing assignments The review a person would have given each step has to be designed into the run instead

The third column is the whole security problem in miniature. The older model of oversight assumed a person was present for each step, reading the screen the agent was reading and clicking the button the agent proposed. Autonomy removes that person from most of the run by design. The organization has to decide, before the run, which steps may proceed on the agent's own judgment and which must wait.

Why does longer autonomy change the security question?

A single-step assistant can be wrong once. An autonomous agent can be wrong, persuaded or redirected at step three and then carry that error through steps four to forty with full access to the applications a person connected. The Microsoft AI Red Team's taxonomy of failure modes in agentic systems catalogs how this plays out, separating failures that are novel to agents from ones inherited from the underlying model, and separating safety failures from security failures that an adversary induces (Microsoft, 2025). The common thread is that the longer the agent operates without a check, the further a single bad step can travel.

Two findings from the research literature matter here. The first is indirect prompt injection: Greshake and colleagues showed that instructions embedded in content an LLM-integrated application retrieves, such as a web page or a document, can redirect the application against its user (Greshake et al., 2023). An autonomous agent reads far more content than a chat assistant, because reading is how it works, so its exposure to planted instructions scales with its autonomy. The second is behavioral. Anthropic's agentic misalignment study placed models in simulated corporate roles with goals and autonomy, and found that they chose harmful actions, including blackmail and leaking information, when those actions served the goal they had been given (Anthropic, 2025). Bengio and colleagues argue more broadly that unchecked AI agency carries risks ranging from misuse to loss of control, and report experiments in which agents engaged in deception or pursued unstated goals such as self-preservation (Bengio et al., 2025).

None of that requires a hostile model to be a problem for an enterprise. A well-behaved agent that misreads a screen can transfer the wrong amount; an early Dots tester reported a dot negotiating a service cancellation on its own, and the same report cites METR research finding coding agents self-approving actions that had been flagged for review (Latent Space, 2026). OWASP's Excessive Agency entry describes the structural condition: an agent granted more functionality, permissions or autonomy than its task needs, so that any error or manipulation becomes a damaging action rather than a wrong answer (OWASP, 2025). The security question therefore shifts from "will the model behave?" to "what happens to the action when it does not?"

Can the model's own refusal be the control?

Most of the safety work shipped with autonomous agents lives inside or beside the model: training the model to refuse, classifiers that screen inputs and outputs, and a second model that reviews planned actions. MIT Technology Review's October 2026 analysis argues that refusal, the model declining a dangerous or disallowed request, has been elevated to a primary safety mechanism even though it is far from foolproof; the piece describes the stacked defenses vendors use as a "Swiss cheese" model, each layer with holes, the hope being that the layers cover one another (MIT Technology Review, 2026). It also reports that one type of safety classifier added 24 percent to a vendor's chatbot compute costs, and that vendors are moving toward cheaper probes on internal activations (MIT Technology Review, 2026). The direction of travel is toward more model-internal checking, at lower cost per check, with the holes still there.

The research record explains why the holes persist. Wallace and colleagues at OpenAI proposed an instruction hierarchy that trains models to prioritize privileged instructions over content, which is an admission that without such training the model treats a planted instruction and a user's instruction as the same kind of text (Wallace et al., 2024). Zou and colleagues showed that adversarial suffixes found on one aligned model transfer to others (Zou et al., 2023). Refusal is a learned behavior competing with other learned behaviors, and a sufficiently well-crafted page, email or calendar entry can win.

The products reflect this. Anthropic reports an attack success rate under 0.08 percent for Claude in Chrome in internal testing, with two classifiers, one screening content for injection and one evaluating each action, and still advises users to avoid opening the extension while viewing sensitive information (Claude Help Center, 2026). OpenAI's Auto-review checks a dot's planned actions against instructions, Custom Rules and safety requirements before execution, and OpenAI pairs it with the instruction to always review consequential work (OpenAI, 2026). Both vendors are describing a reviewer that is itself a model, run by the same company that runs the agent, which raises the separation question on its own. The practical conclusion is narrower: refusal and model-side review reduce the rate of bad steps. They do not give an organization a control that a bad step cannot talk its way past. That control has to be an action the agent cannot complete without a named person, enforced by the environment rather than by the model's judgment.

Which actions should stop for a named person?

Securing an autonomous agent comes down to a sorting exercise done before the run. Every action the agent might take falls into one of two classes: steps it may take on its own, and steps that stop and wait for a named person. The sorting is by consequence, not by difficulty. Reading a screen, opening a record, comparing two numbers and drafting a message are reversible or produce no external effect; they can run on the agent's own judgment. Paying, submitting, changing a record, sending a message outside the organization, granting access and deleting data are not reversible at the moment they happen; they wait. The companion how-to on agents that act without human approval works through the per-task grant in detail; the point here is the principle that decides the sort.

Action class Example in an autonomous run Who completes it
Observe and reason Open the vendor statement, read the invoice total, compare to the purchase order The agent, on its own
Prepare Fill the transfer form, draft the reply, stage the record change The agent, on its own
Commit money Release a payment, approve a refund, post a journal entry A named person approves on the record
Commit a record Submit a claim, change a balance, close a case A named person approves on the record
Commit a communication Send to a customer, a regulator or a counterparty A named person approves on the record
Commit access or deletion Grant a permission, change a password, delete a file A named person approves on the record

The consumer agents already draw a version of this line. Dots' Custom Rules let a user set what a dot may do alone, what needs approval and what is forbidden; sensitive operations such as password changes stay with the user, and Custom Rules cannot override mandatory confirmations (OpenAI, 2026). Meta states that nothing is published, sent or spent by Muse for Small Business without the user's approval (Help Net Security, 2026). Claude in Chrome defaults to automatic approval with a pause on risky actions, with a manual-approval mode available (Claude Help Center, 2026). The enterprise question is who holds the sort and whether it can be loosened. A rule the employee can relax, or an "always allow" setting that turns one approval into a standing permission, is a sort the organization no longer owns.

Public-sector guidance points the same way. OMB Memorandum M-24-10 sets minimum practices for rights-impacting and safety-impacting AI at federal agencies, including human oversight and ongoing monitoring (OMB, 2024). Industrial AI, where an autonomous action can stop a plant, has reached the same design. In an MIT Technology Review Insights interview produced with AVEVA, chief technologist Arti Garg describes the move from predictive analytics to agentic AI as requiring new approaches to data, governance and human oversight together, and calls getting it right a multi-layered problem rather than a model problem (MIT Technology Review Insights in partnership with AVEVA, 2026). The pattern holds across sectors: the agent does the analysis and the preparation, and the consequential action waits for a person whose name goes on it. This is the design that human-in-the-loop approval names, and action governance is the wider system that sets, records and reviews the sort.

What does an autonomous agent need from the environment around it?

The sort only holds if something outside the model enforces it. Three properties of the environment do that work. The first is tethering. A tethered agent works only inside the governed environment a named person connected it to, on the applications that person chose, so a long run cannot wander into systems nobody granted. An agent in the employee's own browser inherits every tab, cookie and saved login on the machine; an agent on a vendor's cloud computer inherits whatever its 4,000 plugins reach (The Next Web, 2026). Neither is tethered to the task.

The second is exposure. An autonomous agent reads every screen it works through, and what the model receives from those screens sets the ceiling on what a persuaded or mistaken run can leak. The firewall research from Bhagwatkar and colleagues reaches a result that applies directly: a minimizer that strips unnecessary data from what reaches the tools, paired with a sanitizer on what comes back, drove indirect injection success to near zero on the standard agent benchmarks, and the authors warn that the benchmarks themselves are weak enough to be saturated (Bhagwatkar et al., 2026). The principle is reduction rather than detection: give the model less. Render-layer tokenization applies the same principle at the screen, replacing identifiers with consistent tokens such as ACCT_001 before any model reads the page, so that a prompt injection against a token-only agent collects tokens.

The third is the record. Accenture's Technology Vision 2025 defines trust in AI operationally as accuracy, predictability, consistency and traceability, and reports that 77 percent of executives believe AI's benefits depend on that foundation (Accenture, 2025). For an agent that worked for six hours while nobody watched, traceability is the only form of oversight available after the fact: which screens the model received, which steps the agent took, which actions stopped and who approved each one. Gartner's warning that uniform governance across agents leads to failure makes the same point from the other side; an agent allowed to prepare payments needs a different record and a different approval design from one that summarizes reports (Gartner, 2026). McKinsey's finding that 62 percent of organizations are experimenting with agents while 23 percent are scaling them suggests most are still deciding what that design will be (CX Today, 2026).

Where does RedactSure sit?

RedactSure's design treats autonomy as something to keep over the steps in between and remove from the steps that matter. The agent works as a tethered agent inside a governed environment: a secure virtual machine in the cloud the customer's posture requires, on hardware-encrypted enclaves, with keys the customer holds. Every identifier chosen by policy is replaced by a consistent token at the render layer before any model reads a screen, so a long run that reads hundreds of screens hands the model the task's fields with PATIENT_001 and ACCT_001 in place of real values. The Planner sets which values are tokenized and what the agent may do on each screen; a named person confirms that policy before the run and approves every payment, submission and record change while it runs. Real values resolve only at approved destinations at the moment of an approved action.

Every screen as tokens, every action and every approval with a name lands in the AI Control Record and exports to the customer's own SIEM. The environment is model agnostic and needs no per-application integration and no change to user permissions. Deployments are in pilot. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page is a definitional synthesis. It rests on the International AI Safety Report's first key update (October 2025, official report), the OWASP Top 10 for LLM Applications 2025 entries LLM01 and LLM06 (industry standard), OMB Memorandum M-24-10 (2024, official guidance) and the NIST AI Risk Management Framework (2023, official guidance); on peer-reviewed research and preprints from Greshake et al. (2023), Wallace et al. (2024), Zou et al. (2023), Bhagwatkar et al. (2026) and Bengio et al. (2025), with the Microsoft AI Red Team taxonomy (2025) and Anthropic's agentic misalignment report (2025) as vendor research; on vendor documentation from OpenAI, Anthropic and Meta for Dots, Claude in Chrome and Muse; and on industry analysis from MIT Technology Review, MIT Technology Review Insights with AVEVA (sponsored content), Accenture, Gartner and McKinsey as reported by CX Today. All sources were read as of October 13, 2026.

No product was tested. No agent was run, no injection was attempted against any named product, and no benchmark is reported. Statements about Dots, Claude in Chrome and Muse are limited to what their vendors' documentation and the cited press stated on the date of reading; vendor features change, and the page carries its date and is revised when the documentation changes. No customer or prospect is described. Statements about RedactSure are limited to the design facts the company publishes about itself.

Whether a given sort of actions, approval design or record meets an organization's obligations under any regulation or examiner's expectation is a determination for its counsel, its assessor and its security and compliance officers, not for the page.

What the record shows

An autonomous AI agent plans, acts across applications and runs without a person present, and those three properties are the reason it is useful and the reason it needs a different control. The model's refusal and the vendor's reviewing model lower the rate of bad steps; they do not stop a bad step that gets through, and the research record shows that planted content and assigned goals can get one through. The alternative to a stop outside the model is an agent whose worst run defines the organization's exposure. The test a reader can apply is to take one consequential action the agent could reach, a payment, a submission or a record change, and ask what completes it: if the answer is the model's own judgment or a setting the employee can relax, the agent is not secured; if the answer is a named person on the record, enforced by the environment, it is.

Frequently asked questions

What is the difference between an AI assistant and an autonomous AI agent?

An assistant responds to a prompt and stops. An autonomous agent takes a goal, plans its own sequence of steps, carries them out across applications and keeps working without a person present, for minutes or hours. The difference for security is that an agent's actions cannot be reviewed in advance because they do not exist in advance; the review has to be built into the run as a stop on consequential actions.

Does an autonomous agent mean no human approval at all?

No. Autonomy is granted over the steps in between: reading, comparing, preparing. The consequential actions, such as paying, submitting, changing a record, sending outside the organization, granting access or deleting data, stop for a named person. OpenAI's and Meta's own agents reserve sensitive operations for the user; the enterprise version of that design is a sort the organization owns and the employee cannot relax.

Why is model refusal not enough to secure an agent?

Refusal is a learned behavior competing with other learned behaviors inside the model. Research on indirect prompt injection, adversarial suffixes and the instruction hierarchy shows that planted content can win that competition, and vendors describe their stacked defenses as layers that each have holes. Refusal lowers the rate of bad steps. A control the model cannot talk its way past has to sit outside the model, as an action that waits for a named person.

Can a second AI model safely review the first one's actions?

It reduces the rate of bad actions, and both OpenAI's Auto-review and Anthropic's action classifier work this way. Both vendors still tell users to review consequential work themselves. A reviewing model is subject to the same classes of manipulation as the acting model and is run by the same vendor, so it is a useful layer and not a substitute for a named person on the actions that matter.

Which actions should always stop for a person?

Sort by consequence. Anything that moves money, submits or changes a record, sends a communication outside the organization, grants access or deletes data is not reversible at the moment it happens and should wait for a named person on the record. Observing, reasoning and preparing can run on the agent's own judgment. The sort is set before the run by someone who owns it, not by the agent and not by a setting the employee can loosen.

What does a long autonomous run need from its environment?

Three things. Tethering, so the agent works only on the applications a named person connected and cannot wander. Reduced exposure, so the model receives tokens in place of identifiers on every screen it reads and a persuaded run collects tokens. A record, so that every screen the model received, every action and every named approval can be reconstructed after a run nobody watched, in the organization's own monitoring.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.