When the Trigger Pulls Itself: Agentic AI and the End of the Human-in-the-Loop

Weapons have a lineage. The spear stretched the arm. The bow severed the throw from the strike. The rifle moved killing past line of sight, and the bomber moved it past borders. Distance grew. One thing didn't: somewhere in the loop, a person picked the target.

Agentic AI is the first tool I've covered on this beat that is openly trying to break that rule.

I want to be careful here, because 'agentic' has become a marketing word, and most things sold as agents in 2025 are a planner model wrapped around a tool-use loop with a retry counter. That is not Skynet. It is, roughly, cron with vibes. But the security model is genuinely different from a chatbot, and pretending otherwise is how we end up with another decade of treating novel attack surfaces as if they were just web apps with extra steps.

Here is what actually changes when you hand a model a tool belt and a goal.

The authorization boundary moves. With a classic LLM, the dangerous verbs — send email, transfer funds, execute code — live outside the model. With an agent, the model holds the credentials and decides when to fire them. That is not a prompt injection problem dressed up in new clothes. It is a confused-deputy problem at machine speed, and confused deputies are an old, well-understood class of bug. We just never ran one at 200 tokens per second.

The target-selection step disappears. A spear needs a thrower. A drone needs an operator, even if the operator is half a world away. An agent given 'reduce our AWS bill' or 'find leads and close them' selects its own targets inside whatever scope the integration allows. The scope is almost always wider than the operator thinks.

Provenance breaks. When an agent takes an action, the audit trail says the service account did it. The service account was driven by a model. The model was driven by a prompt. The prompt was, increasingly, written by another model. Good luck with incident response.

None of this requires the agent to be smart. It requires the agent to be trusted, networked and fast. We have shipped systems like that before. They were called worms.

The useful question is not whether agentic AI is a weapon. Hammers are weapons. The question is whether the people deploying these systems are modeling them as privileged automation with an unreliable decision core, or as helpful assistants that occasionally hallucinate a wire transfer.

Right now, mostly the second one. That will not survive contact with the first serious incident in the wild.