As the CEO of Arango, Shekhar Iyer leads the company’s mission to make enterprise AI contextual, scalable and trusted.
Picture this: During a major hurricane, a federal agency uses an AI agent to help coordinate vehicles, personnel and medical supplies for its emergency response. The agent redirects resources based on the latest operational status it can see. But it misses that a bridge has closed and that another response team has already reserved the remaining vehicles. Supplies don’t reach the people who need them.
This is just one example of what can go wrong when using an autonomous agent. An autonomous agent that gives an inaccurate answer creates an information problem. An autonomous agent that acts on an inaccurate answer can create an operational, financial or mission-critical problem.
Autonomous agents can be manipulated, overpowered or misinformed. Even a secure, correctly authorized agent can become a liability when it acts without a current, connected view of the situation.
As AI adoption continues to “move beyond experimentation,” the risks of rogue agents increase.
Three Main Ways Agents Can Go Rogue
From my observations, autonomous agents can go rogue in three main ways.
First, they can be manipulated. For example, as an article in The Hacker News noted, Microsoft detailed a campaign in which attackers used AI-generated executive impersonation, fabricated emails and false invoices to try to request payments. In that situation, employees were the decision-makers, but the incident shows how bad actors can use false context to influence actions. As organizations automate more workflows, bad actors could use the same tactics to deceive an agent.
The second way agents can go rogue is by being overpowered. An agent may have broader access or authority than its assignment requires, which can enable a mistaken or malicious instruction to trigger a payment, expose sensitive information or disrupt an essential system.
Finally, agents can be misinformed. An agent could be properly authenticated, correctly authorized and operating within its guardrails. However, it can still end up acting on incomplete, outdated or disconnected information.
Identity controls, security measures and guardrails are essential to addressing manipulation and excessive authority. In this article, I’m focusing on the third risk: whether an agent has enough current, connected and trustworthy context to understand the consequences of its actions.
Evidence suggests that this isn’t merely a hypothetical risk. Consider a survey of 353 IT professionals published in 2025 by enterprise cybersecurity platform provider SailPoint. Of the respondents, 80% said that “their AI agents have taken unintended actions.” Moreover, 55% identified agents “Making decisions based on inaccurate or unverified data” as a reason why AI agents were a security risk.
When Incomplete Context Turns Into Real-World Consequences—And Why Context Failure Is An Operational Risk
In the hypothetical example I opened with, the agent wasn’t manipulated. Nor did it exceed its authority. It acted on incomplete context, turning a data problem into a real-world consequence.
Leaders shouldn’t focus only on whether an agent has access to data. They should also be concerned with whether or not the agent can connect information that could change its decision. That’s context, which can include:
• The relationships among people, assets, systems and events
• Current operational state
• Historical actions and decisions
• Policies, permissions and constraints
• The source and reliability of the information
• Changes occurring across other systems or workflows
An agent may retrieve every record it was instructed to access and still reach the wrong conclusion if those records do not reveal the relationships and dependencies surrounding the decision.
Companies that thoughtfully build and prioritize autonomous agents, which includes accounting for context, can better protect themselves from operational consequences.
Three Key Reasons Why Agents Act Without The Context They Need
So, why do agents act without the context they need? In my experience, there are three key reasons.
The first key reason is that the agent sees records, but not their relationships. The information an agent needs may be distributed across systems, and understanding the situation can require following connections among people, resources, locations, policies and prior actions. The decision or action depends on an understanding of the relationships among the records—not simply the records themselves.
The next key reason is that the context is outdated, or the source can’t be trusted. Agents operate in environments where permissions, inventory, schedules, threats and operational conditions can change quickly. A response that was accurate several minutes ago may no longer be safe to act on. An agent also needs to know where information came from, when it was updated and whether another source contradicts it. Without that provenance, the agent can’t reliably distinguish current operational truth from stale, incomplete or manipulated information.
Finally, each agent builds its own version of the situation. Organizations may deploy separate agents for security, procurement, logistics, customer support and other functions. If every agent retrieves and interprets context independently, they can end up acting on different versions of the same reality. For example, one agent may reserve a resource while another still considers it available. As autonomous systems multiply, inconsistent context becomes a coordination problem—not merely a retrieval problem.
What Technology Leaders Should Evaluate
Before expanding an agent’s autonomy, leaders should ask several questions:
• “What decisions or actions can this agent take?”
• “What data, relationships, history, policies and operational conditions could change its decision?”
• “How current must that context be?”
• “Can the organization trace where the agent’s evidence came from?”
• “Do multiple agents work from consistent, governed context?”
• “What does the agent do when required information is missing, outdated or contradictory?”
The goal shouldn’t be to give every agent access to everything. Rather, it should be to deliver every agent the relevant context it needs to make a particular decision while preserving security, governance and isolation.
Context Can Be Leverage Or Liability
With the right context, AI applications and agents can create real leverage for companies because they are equipped to make better decisions, take action with greater confidence and operate with less human intervention.
But without current, connected and governed context, that leverage can quickly become a liability. An agent may act without seeing the relationships, changes or constraints that could change the right decision.
That’s why leaders should evaluate more than just model accuracy and access controls. They should also examine whether the data architecture can assemble reliable context at the speed autonomous decisions require.
The most dangerous rogue agent may not be the one that breaks through its guardrails. The most dangerous rogue agent may be the one that follows its instructions, stays within its permissions and confidently takes the wrong action because it can’t see enough of the situation.
Before giving an agent more authority, leaders should ask this fundamental question: Does it have the current, connected and governed context required to use that authority responsibly?
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?