[VoxxedDaysTicino2026] Why Security Matters: The Risks of Agentic AI and How to Mitigate Them
Lecturer
Christoph Bühler is a Research Assistant at the University of St. Gallen, focusing on software engineering, programming languages, system security, and infrastructure as code. His work explores securing AI applications. Relevant links include his LinkedIn profile (https://ch.linkedin.com/in/christoph-b%C3%BChler-a3a262270) and institutional page (https://programming-group.com/members/buehler).
Abstract
This article investigates Christoph Bühler’s discourse on agentic AI security, spotlighting vulnerabilities in tools like Model Context Protocol (MCP). It analyzes risks from function calling, proposes permission-based controls, and evaluates efficiency. Encompassing industry trends, academic citations, and future behavior analysis, it underscores mitigation’s urgency.
The Ascent of Agentic AI and Emerging Vulnerabilities
Christoph traces AI’s rapid evolution, from OpenAI’s valuation surge to widespread developer adoption, as evidenced by surveys and citations of foundational papers. The shift to agentic systems, where LLMs interact via tools and MCP—a JSON-RPC interface—marks a pivotal change. This enables dynamic actions but introduces risks, as agents inherit full user privileges. Real-world incidents, such as database deletions or drive wipes, illustrate how unchecked agents can cause harm. Contexts include the non-deterministic nature of LLMs, complicating safeguards, and prompt injections exploiting natural language weaknesses. The implications are severe, eroding trust and exposing systems to exploits that deterministic tools might prevent.
Permission-Based Controls as a Foundational Mitigation
To address these, Christoph proposes encapsulating MCP servers with permission-based access controls, akin to mobile app permissions. Developers define capabilities—file read/write, network domains—ensuring agents operate within bounds. This deterministic layer confines executions, blocking unauthorized accesses like SSH key theft. The methodology wraps servers in Docker, mapping policies to runtime constraints, with minimal overhead (0.6ms). Contexts involve compatibility with existing MCP implementations, allowing seamless adoption. The implications enhance safety without sacrificing functionality, providing a practical barrier against non-deterministic behaviors.
Extending Mitigation Through Behavior Analysis
Christoph outlines future directions, including runtime isolation for behavior analysis. Agents run unrestricted, with post-execution assessments distinguishing benign from malicious actions. This helps predict risks from prompt-agent interactions, aiding practitioners in safeguarding applications. Contexts draw from malware detection traditions, adapting them to AI’s unique challenges. The implications offer proactive tools for threat anticipation, complementing permission controls in a comprehensive security strategy.
Broader Ramifications for AI Governance
The talk emphasizes confining AI to avert historical errors like viruses. By prioritizing transparency and controls, developers can harness agentic potential responsibly. The contexts reflect industry hype outpacing security, necessitating balanced approaches. The implications advocate for human-centric governance, ensuring AI augments rather than endangers.