AI Systems Atlas

S-01Why agents are different

/security/chatbot-vs-agent

The same untrusted input, the same model — but one system emits text and the other emits actions.

Step-by-step walkthrough5 steps
  1. Same untrusted input arrives on both sides.
  2. Same class of model processes it.
  3. The chatbot’s blast radius: text a human reads.
  4. The agent’s blast radius: tools with authority.
  5. Side effects are real and often irreversible. Agents differ from chatbots because they possess authority.
Key insight

Security for chatbots is about outputs a human will read. Security for agents is about actions the world will execute. The threat model changes completely.

Failure mode

Treating an agent deployment as “a chatbot with extra features” — the extra features are precisely the attack surface.

Further reading
RelatedIndirect prompt injectionHuman-in-the-loop

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →Tools →Ops →