It depends on access and checks. Here is what our tests showed.
The short answer. AI agents are only as secure as the access they are given and the checks around them. In our tests, the same attack that worked against a default setup was stopped by a hardened one. An agent with broad permissions and no approval step is risky. A narrowly scoped one with independent checks is much safer, but never risk-free.
There is no single answer, because "AI agent" covers everything from a read-only assistant to a system that can send email and move money. What matters is what the agent can reach, who can talk to it, and what stops a bad action.
Three things make agents riskier than a plain chatbot:
For the side-by-side, see AI agent vs chatbot security.
HexTyx runs attacks against purpose-built test applications, not customer systems. The pattern is consistent: configuration decides the outcome.
In our support-ticket test, an AI worker processed incoming tickets automatically. A ticket with a hidden instruction told it to forward the contents to an outside address. In the naive configuration, the ticket was forwarded immediately with no human involved. In the hardened configuration, the identical ticket was held for review, even when the worker was triggered by hand. The details are in our zero-click test results.
In our Vault test app (synthetic data, live LLM agent), an injected fake confirmation led the agent to move $5,000. These are lab results, not incidents at a real company.
Outside our lab, researchers found "EchoLeak" (CVE-2025-32711) in Microsoft 365 Copilot in 2025, rated 9.3 out of 10. A crafted email could make the assistant expose data without the victim clicking anything. Microsoft has fixed it, and there is no evidence it was exploited in the wild.
| Factor | Safer | Riskier |
|---|---|---|
| Permissions | Narrow, read-only where possible | One broad key for everything |
| Approval | Human sign-off for risky actions | Acts on its own on anything |
| Untrusted input | Treated as data, not commands | Obeyed as instructions |
| Checks | Enforced in code outside the model | Only a line in the prompt |
| Logging and stop | Every tool call logged, kill switch ready | No record, no way to stop it |
Answer yes or no for your own agent.
Zero or one yes answers suggests a contained setup. Two or three means you should add controls before widening its use. Four or five means the agent can do real damage if it is steered, so narrow its access first. This is a rough screen, not a risk assessment.
Run the free playground scanner against your AI application and see what an attacker could make it do.