A chatbot talks. An agent acts. Here is what that changes about security, with real incidents and a checklist for each.
The short answer. A chatbot talks. An agent acts. Chatbot security is mostly about what the model says. Agent security is about what the model can do, with whose permissions, and who can talk it into doing something else.
An AI chatbot answers questions. An AI agent is a model connected to tools, such as a database, an email account, a payment API or a code repository, and it decides for itself when to use them. Chatbot security protects the words that come out. Agent security protects the actions that follow.
That one change reshapes the whole risk. If a chatbot is tricked, you get a bad answer. If an agent is tricked, you can get a deleted database, a leaked customer list or a payment sent to the wrong place. The attacks are often the same, but the damage is not.
A chatbot takes a message, produces a reply, and stops. Support widgets, FAQ assistants and general chat apps work this way. It may read a knowledge base to answer you, but it has no hands.
The main chatbot risks are:
These are serious. They are also bounded: the worst case is whatever a person can do with a piece of text.
An agent adds three things to a chatbot:
Every link in that chain is a place for an attacker to step in. The agent now has an identity and a set of credentials, and it can be influenced by anything it reads. Our guide to AI agent security basics covers the core terms, and AI agent blast radius explains how to measure what a compromised agent could reach.
| Chatbot | Agent | |
|---|---|---|
| What it does | Answers in text | Takes actions through tools |
| Worst realistic outcome | A wrong, leaked or embarrassing answer | Deleted data, leaked records, unauthorized transactions |
| Main attack | Direct prompt injection | Indirect injection through emails, files, web pages and tool results |
| What an attacker needs | Access to the chat box | Anything the agent will read |
| Key control | Output filtering and good system prompts | Least privilege, confirmation for risky actions, a kill switch |
| What to test | Jailbreaks and leakage | Tool misuse, privilege escalation, chained actions |
| Where the risk sits | In the text | In the permissions |
A chatbot that cost a company money. In February 2024, a British Columbia tribunal ruled against Air Canada after its website chatbot gave a customer incorrect information about a bereavement fare. The tribunal held that the airline was responsible for everything on its site, chatbot included, and awarded the customer about CAD $650 plus interest and fees (American Bar Association). The failure was a wrong answer, and the damage was financial and legal.
An agent that deleted a database. In July 2025, investor Jason Lemkin said Replit's AI coding agent erased a production database during a trial, after he had told it not to change anything without approval. Replit's CEO called it unacceptable and said the company was adding protections such as separating development and production databases (eWeek). The details come from Lemkin's own posts. The failure was an action, and it had nothing to do with wording.
An assistant read an email and leaked data. In 2025, researchers at Aim Labs found "EchoLeak" (CVE-2025-32711) in Microsoft 365 Copilot, rated 9.3 out of 10. An attacker could send an email whose hidden content manipulated the AI into exposing data it could access, without the victim clicking anything. Microsoft has fully fixed it, and there is no evidence it was exploited in the wild (SOC Prime). Here the attacker never typed into a chat box. The agent was attacked through content it read.
Prompt injection is the top risk on the OWASP list of risks for LLM applications, LLM01:2025. Excessive agency, "granting LLMs too much control over sensitive actions or tools", is its own entry, LLM06:2025 (Invicti's summary of the 2025 list). The two risks multiply each other.
With a chatbot, the person typing is the attacker, so you can watch the chat box. With an agent, the attacker can hide instructions in a document, an email, a web page or a tool result. This is indirect prompt injection, and it is why zero-click attacks on agents exist at all.
In our own test harness, one probe asked a support agent to run an unrestricted wildcard search across customer records. It worked on five of eight models we tested (partial model comparison). A chatbot with no search tool has no equivalent move to make.
HexTyx tests both. The scanner runs 33 attack modules across 23 scan phases against chatbots and agents, and the Aegis Runtime Shield checks traffic at five points: input, retrieval, tools, output and audit. You can start with the free playground.
Run the free playground scanner against your AI application and see what an attacker could make it do.