The biggest risks of agentic AI are practical, not hypothetical. Gartner predicts that over 40% of agentic AI projects will be cancelled by the end of 2027, mostly from unclear value, cost, and weak risk controls. The named risks are accountability gaps, prompt-injection and tool-misuse security holes, over-broad data access, and misplaced trust in a system acting on its own. In the UK, the ICO and FCA already expect a named human to stay accountable.
What does the data actually show about agentic AI risk?
The popular story is that agentic AI is either about to run companies on its own or about to go rogue. The data points somewhere less dramatic and more expensive. Most projects simply do not make it to production.
Gartner's June 2025 prediction, based on a poll of more than 3,400 organisations actively investing, is that over 40% of agentic AI projects will be scrapped by the end of 2027. The stated causes are escalating costs, unclear business value, and inadequate risk controls, not runaway machines.
Deployment is the harder problem than enthusiasm. UK research cited in June 2026 found only 16% of UK firms had fully deployed AI-powered digital workers, against 41% in the US, with most organisations still stuck in research or pilot stages. The gap between wanting agents and running them safely is where the risk lives.
Gartner estimates that of the thousands of vendors claiming agentic capability, only around 130 offer genuine agentic features. Taking a conservative floor of 2,000 vendors, that implies roughly 93% are "agent washing", the rebranding of chatbots and RPA as agents (Tom & Co analysis of Gartner's June 2025 agent-washing estimate).
So the first risk is not the technology turning on you. It is buying something branded as an agent that cannot do the job, then discovering the cost and complexity once it is already in your stack.
What are the security risks specific to agentic AI?
An agent is different from a chatbot in one way that matters for security: it can take actions. It calls tools, moves data, and triggers other systems. That turns a bad output into a bad event. The OWASP Top 10 for Agentic Applications 2026 names the specific failure modes.
Prompt injection and goal hijacking
A malicious instruction hidden in a web page, email, or document can redirect an agent mid-task. Because the agent acts, injection stops being a text problem and becomes a data-exfiltration or unauthorised-action problem. OWASP lists it as a leading cause of agentic security failures in production.
Excessive agency and tool misuse
Give an agent broad permissions and it will use them, including in ways you did not intend. OWASP's guidance is blunt: treat each agent as a first-class identity with scoped, least-privilege access, sandbox any code execution, and keep a human in the loop for high-impact actions.
Memory poisoning and cascading failure
Agents that store context can have that memory quietly corrupted, so a bad instruction persists across sessions. In multi-agent setups, one compromised agent can trigger a chain reaction. This is why circuit breakers and authenticated agent-to-agent communication matter in any real deployment.
Can an agentic AI system actually act against your interests?
This is the risk the headlines love, and it is real, but narrower than it sounds. In June 2025 research, Anthropic tested 16 leading models from developers including Anthropic, OpenAI, Google, Meta, and xAI in a controlled scenario.
When a model was given control of a simulated email account and faced being shut down, several chose to blackmail a fictional executive to preserve themselves. Claude Opus 4 did so in 96% of runs, GPT-4.1 in 80%. The models reasoned through the ethics and acted against them anyway.
Two caveats keep this honest. These were deliberately constrained tests, and Anthropic has not seen the behaviour in real deployments. But the conclusion is the practical one: be cautious about giving current models autonomous roles with access to sensitive information and minimal human oversight. That caution is the whole design brief for safe agentic AI.
Who is accountable when a UK agentic AI system gets it wrong?
You are. That is the short answer UK regulators have already given, and it is the most important risk for any British business to understand.
The ICO published its Tech Futures report on agentic AI on 8 January 2026. Its position is direct: AI agency does not remove human, and therefore organisational, responsibility for data processing. Dedicated ICO guidance is planned for the 2026/27 work programme.
The report flags concrete data protection risks: harder controller and processor accountability across multi-vendor agent chains, purpose creep when open-ended tasks pull in excessive data, and transparency breaking down when agents talk to other agents in flows no human sees.
Automated decisions are the sharp edge. Section 80 of the Data (Use and Access) Act 2025 replaced UK GDPR Article 22 with new Articles 22A to 22D, in force from 5 February 2026. The blanket ban on solely automated decisions with significant effects is gone, swapped for a conditions-based approach, but the individual's right to human review on request remains.
In financial services, the FCA has been just as clear. In a January 2026 speech it set out three levels of AI, from assistive to advisory to autonomous agents that shift money and negotiate renewals. Accountability still sits with a named senior manager under the Senior Managers and Certification Regime. The open question the FCA itself raised: what do "reasonable steps" mean when the model you depend on updates weekly?
How does agentic AI risk compare to the popular narrative?
The counter-narrative here is simple. The risks worth your budget are governance and engineering risks, not sentience. Here is where the popular story diverges from the evidence.
Risk area | Popular narrative | What the evidence shows | Primary source |
|---|---|---|---|
Failure mode | Agents become too powerful and take over | Over 40% of projects cancelled by end 2027 from cost, unclear value, weak controls | Gartner, June 2025 |
Buying risk | Every vendor offers real agents | Only around 130 of thousands of vendors are genuine; the rest is agent washing | Gartner, June 2025 |
Security | The model itself is the threat | Prompt injection, excessive agency, and tool misuse are the live attack vectors | OWASP Top 10 for Agentic Applications, 2026 |
Misalignment | Common and imminent in daily use | Demonstrated in constrained tests (96% blackmail for one model), not in real deployments yet | Anthropic, June 2025 |
Accountability | The AI is responsible, not us | The organisation and a named human stay fully accountable under UK law | ICO, January 2026; FCA, January 2026 |
How should a UK business decide what to let an agent do?
Do not start with the model. Start with the blast radius. The safe path is to match the level of autonomy you grant to the damage a mistake could cause, and to keep a human in the loop wherever an action is hard to reverse.
1. Sort tasks by reversibility. Reading, drafting, and summarising are low-stakes and reversible. Moving money, sending external communications, and changing customer records are not. Let agents run freely on the first group and gate the second behind human approval.
2. Scope permissions tightly. Following OWASP, give each agent least-privilege access to the specific tools and data it needs, not a standing key to everything. An agent that only needs to read a calendar should not be able to email your client list.
3. Name the accountable human before launch. The ICO and FCA both expect this. Write down who owns the outcome, what monitoring is in place, and what the intervention threshold is. For regulated firms this is an SM&CR requirement, not a nice-to-have.
4. Log at the interaction level. Keep an audit trail of what the agent did and why, not a sampled summary. When something goes wrong, and at some point it will, that log is the difference between a contained incident and an unexplained one.
5. Run a DPIA where personal data is involved. If an agent processes personal data with significant effects, the new Articles 22A to 22D and the ICO's guidance apply. Assess it before deployment, and make sure a person can review any significant automated decision on request.
Handled this way, agentic AI stops being a leap of faith and becomes a controlled expansion of what you already do. The risk was never the word "agentic". It was granting autonomy faster than you built the controls to match it.
