Agentic AI: From Model Risk to Enterprise Risk

A New Risk Profile for a New Kind of System

The shift from AI that produces outputs to AI that takes actions changes the enterprise risk profile. Advisory AI carries model risk, but autonomous AI carries operational risk, cyber risk, regulatory risk, and reputational risk. This convergence creates a new category of systemic risk that traditional enterprise risk management frameworks are not designed to capture. Boards and risk committees that continue to frame agentic AI as a technology investment are misclassifying it.

Two incidents in 2025 demonstrated these risk categories in practice. The GTG-1002 campaign showed cyber risk and operational risk, converging in a single autonomous attack. The EchoLeak vulnerability showed model risk and regulatory risk, converging in a single agentic deployment. Agentic AI amplifies and connects existing risks in ways that traditional governance frameworks cannot contain.

 

The Kroll Findings: The Illusion of Preparedness

The Kroll State of Cyber Resilience 2026 report reveals a stark and dangerous disconnect. While 94% of organizations view cybersecurity as a primary business risk, 72% report frequent misalignment between cybersecurity efforts and broader business priorities. This misalignment is particularly dangerous for agentic AI, where the speed of autonomous action outpaces human response by orders of magnitude.

Attackers are achieving breakout times (the time from initial access to lateral movement) of just 29 minutes. Many chief information security officers (CISOs), however, remain confident in a 24-hour response window. That gap demonstrates a structural vulnerability that agentic AI exploits.

The Kroll report also identifies a critical investment misalignment: 55% of organizations are not increasing (or even cutting) investment in red and purple teaming, precisely as the threat landscape demands more sophisticated testing. For agentic AI this is a regulatory compliance gap, as DORA and other sector-specific regulations require penetration testing mimicking advanced persistent threats, and most firms cannot currently perform such tests for agentic systems.

 

GTG-1002: The Campaign That Changed Everything

In September 2025, Anthropic’s threat intelligence team detected and disrupted the GTG-1002 campaign, the first documented large-scale cyberattack executed with minimal human intervention. A Chinese state-sponsored threat actor used Anthropic’s Claude Code model as an autonomous orchestration engine, targeting about 30 organizations across technology, finance, healthcare, and government.

The attack was unprecedented in its autonomy. AI agents performed 80% to 90% of the entire attack chain: reconnaissance, vulnerability discovery, exploit development, credential harvesting, lateral movement and data classification. Human operators provided only high-level guidance and approved escalation at key decision points.

When 50 or more agents are involved in a breach, determining causality and data lineage becomes nearly impossible from a time perspective, under GDPR’s 72-hour breach notification requirements. Cyber risk and regulatory risk converged in this incident. The traditional incident response playbook, designed for human-speed attacks, is structurally inadequate for machine-speed autonomous campaigns.

GTG-1002 also exposed a critical blind spot in defensive architecture. The attackers used the Model Context Protocol (MCP) to make their agent operate like a legitimate developer or administrator. There were no malicious binaries or noisy malware, just commands issued through legitimate, often privileged interfaces using standard utilities. To a traditional SOC, much of this traffic looked like routine activity. Many organizations worry about insiders like disgruntled employees, but now the inside threat is a highly privileged agent making credible-looking decisions at machine speed.

 

Operational Risk: Cascading Workflow Errors

Within an organization agentic systems form chains, with one agent’s output becoming another’s input. Errors can compound, creating a reliability problem. When Agent A makes an error or acts on hallucinated data, Agent B uses Agent A’s output as input, repeating the error. By Agent C or D, the error has propagated through multiple systems, creating significant business impact.

This failure is particularly insidious because agents often confidently proceed with incorrect information. Traditional systems error out, but agents persist. Research on retrieval-augmented generation systems reveals that beyond approximately 20,000 documents, accuracy degrades significantly as agents lose context. Most enterprise agentic systems exceed this threshold. The result is silent degradation, meaning systems that worked in pilot gradually fail in production, with accumulating errors that are difficult to detect until they surface in a business outcome.

This is operational risk of a new kind, as it is a silent accumulation of compounding errors across interconnected systems, often invisible until the consequences surface in a financial loss, a customer complaint, or a regulatory inquiry.

 

Cyber Risk: The Identity Explosion

In a typical enterprise, non-human identities already outnumber human identities by 10 to 1, and agentic AI multiplies this problem.

Most organizations lack standardized processes for provisioning agent identities with appropriate least-privilege access. Credentials are often static, never rotating, creating persistent attack vectors. When agents are decommissioned, their identities frequently remain active. Ghost agents, deprecated or forgotten agents with valid credentials and no owner, represent a cyber risk that most security teams have not yet quantified. They are invisible attack surfaces, waiting to be discovered by the next GTG-1002.

Internal swarming creates risks that are distinct from external attacks. An enterprise deploying agentic AI for procurement, inventory management, and logistics may find that agents optimize locally while creating global inefficiencies. The procurement agent negotiates favorable terms that the inventory agent cannot accommodate. What’s interesting is that each agent is correct, it is the system that is broken. This operational risk emerges not from a single failure but from the interaction between systems.

 

Reputational Risk: The Untrained Employee and Shadow AI

Low-code and no-code agent builders have democratized agent creation. Non-technical employees can now build autonomous systems without engineering support. The benefits include faster innovation, reduced IT backlog, and empowered business units. There are also risks.

These citizen developers lack security training. They may create agents with excessive permissions and grant them access to sensitive systems, because they do not understand the implications. They deploy prototypes to production without governance review because no process exists to catch them. The shadow AI problem is not new, but agentic AI amplifies it significantly.

Shadow AI’s potential ramifications vary in scope. A shadow AI model that generates poor marketing copy is merely an embarrassment. But a shadow AI agent that deletes customer records, triggers financial transactions, or exposes regulated data is a reputational risk that can erode customer trust and brand value overnight. Boards and risk committees should be aware of this distinction. The untrained employee is no longer just a phishing target; they are the potential operator of a powerful, unmonitored autonomous system.

The CISO’s New Mandate: Translating Technical Risk into Business Language

Top-performing CISOs know how to handle the overlap between technical threats and business risk posed by agentic AI. Translating technical cyber threat information into business risk language is a survival imperative. Risk committees and boards need to understand agentic AI risk in terms they already use, such as:

• Operational Risk: Cascading workflow errors and silent failures in agent logic
• Cyber Risk: Identity explosion, ghost agents, and AI swarming attack vectors
• Model Risk: Hallucinations and bias in agent decision-making
• Regulatory Risk: Noncompliance with the EU’s AI Act, GDPR, DORA, and HIPAA
• Reputational Risk: Shadow AI and rogue agents causing brand damage

The CISO’s mandate is now both to prevent breaches and to ensure resilient autonomy. This means moving beyond traditional perimeter defense to observable autonomy, where every agent action is logged, traced, and accountable. It means extending governance to agent literacy across the entire workforce. Further, it means clarifying governance ownership: asking who owns the risk when an agent acts autonomously. The answer must be a named, accountable human owner for every agent, ensuring that responsibility is never diffused across the network.

 

A Risk-Based Approach: The Governance Framework

To manage these converging risks, organizations must adopt a risk-based approach to agentic AI governance. The framework must address four dimensions:

• Named Human Ownership
  Every agent must have a named human owner accountable for its behavior, responsible for defining its decision boundaries, and serving as the escalation point when outcomes diverge from expectations.
• Zero Trust for Agents
  Every agent should be considered a distinct identity with least-privilege access, regular credential rotation, and no implicit trust based on network location or user delegation.
• Continuous Red Teaming
  Function-call fuzzing and multi-agent scenario testing are needed to identify cascading failures, extending existing cyber assurance programs to cover the agentic attack surface explicitly.
• Strategic Alignment
  Cybersecurity investments should match the most common attack vectors, including identity-based threats and AI swarming scenarios.

 

How Kroll Helps Organizations Adopt Agentic AI Safely

Kroll helps organizations understand, test and govern the enterprise risks created by agentic AI. We bring together cyber risk, operational resilience, regulatory readiness, investigations and board advisory to help clients move from AI experimentation to controlled, defensible adoption.

Our teams can help organizations assess their current exposure to agentic AI and shadow AI, map agent identities and permissions, test autonomous workflows for failure and abuse scenarios, conduct red and purple teaming for AI-enabled threats, design governance and monitoring models, and prepare board-ready reporting that explains agentic AI risk in business terms.

To discuss how your organization can assess and strengthen its agentic AI readiness, contact Kroll’s Cyber and Risk Advisory experts.

 

References

• Kroll State of Cyber Resilience 2026
• GTG-1002 Campaign—SOCRadar Full Analysis
• GTG-1002—SOCFortress Technical Breakdown
• GTG-1002—Control Risks: The Agentic Shift
• GTG-1002—Palo Alto Networks: Crossing the Autonomy Threshold
• CVE-2025-32711 (EchoLeak)—NVD Detail
• EchoLeak—arXiv Research Paper
• EU AI Act—EUR-Lex Full Text
• DORA—Digital Operational Resilience Act
• NIST AI Risk Management Framework
• MIT CISR—Agents of Change: Governing Autonomous AI
• Gartner—Predicts 2025: AI Technologies