Key Cybersecurity Contract Provisions for Securing Agentic AI

The Distinct Security Challenges of Agentic AI

The level of security risk in agentic AI implementations depends on a number of variables, including the sensitivity of the function performed by the agent, the scope of the agent’s permissions, and the degree to which the agent can be configured or constrained by the implementing company. Generally speaking, however, security considerations relevant to agentic deployments include:

• Defining security: Traditional cybersecurity focuses on protecting systems from unauthorized access, including by external threat actors. This risk continues to apply to agentic AI in unique ways; for example, agents may be subject to AI-specific attacks, such as prompt injections that embed malicious instructions in content the agent processes. However, even absent malicious interference, agents may behave in unexpected or harmful ways, disclosing or destroying information inappropriately, making unintended commitments on behalf of users, or otherwise taking actions that diverge from user expectations. This broader conception of security raises novel questions about what constitutes a “security incident,” a product defect, or an inherent technology limitation, and about how responsibility should be allocated among developers, deployers, and users.
• Increased attack surface and speed of attacks: AI agents perceive their environments, process information, and autonomously take actions to achieve specific goals. Agentic AI systems may operate with broad permissions to access files, execute code, send emails, query databases, or invoke other tools. A compromised agent could, therefore, cause damage at machine speed and scale, including by exfiltrating data, deleting files, or modifying systems.
• Supply-chain risks: Agents frequently rely on third-party programs and plugins, such as APIs and model context protocol (MCP) servers. A vulnerability can become an entry point for malicious actors. For example, a compromised plugin could intercept agent communications, manipulate the data the agent relies on, or inject harmful instructions into the agent’s workflow. These risks are compounded when organizations have limited visibility into security practices of third-party data providers, or when integration outpaces traditional vendor due diligence.
• Privilege and permission risks: As with human users, there is a risk that agents can be granted broader access than any single task requires. A malfunctioning or compromised agent could, for example, exfiltrate sensitive data, alter records, or trigger downstream actions well beyond its intended scope.
• Accountability: The opacity of agent reasoning can make it difficult to understand why a particular action was taken and whether the outcome is reliable. Unlike traditional software where logs and audit trails may trace execution paths, an agent’s decision-making may involve complex, non-deterministic reasoning that resists straightforward forensic analysis. When a security incident occurs, organizations may struggle to determine whether the behavior resulted from a malicious attack, a configuration error, flawed training data, or model behavior. The relative novelty of agentic AI compounds these challenges, since it may be harder to identify anomalous activity or distinguish it from legitimate but unexpected behavior.

Regulatory and Other Legal Risks of Agentic AI

As described above, agentic AI systems may introduce significant security risks that differ in kind from those associated with conventional software. These security risks can translate into significant legal exposure. A compromised or malfunctioning agent could trigger data breach notification obligations, regulatory investigations, contractual liability, and third-party claims.

Regulators and government authorities across the globe are paying close attention to agentic AI security. In May 2026, CISA and its Five Eyes partners published joint guidance recommending that organizations incorporate agentic AI-specific risks into standard risk assessment processes. The authoring agencies recommend an incremental deployment approach, beginning with low-risk, non-sensitive use cases, and outline several baseline security measures to guide adoption. Additional standards specific to agentic AI are also emerging, including the National Institute of Standards and Technology (NIST) AI Agent Standards Initiative in February 2026 and the National Cybersecurity Center of Excellence guidance on AI agent identity and authorization. Although these recommendations do not carry the force of law, they identify security risks that could lead to significant legal exposure, which contracts can help anticipate and manage.

In addition to guidance, new laws may implicate agentic AI contracting. The EU AI Act imposes requirements for risk management, data governance, human oversight, and cybersecurity resilience that applies to agentic AI deployed in high-risk areas, such as human resources. In the United States, sector-specific regulators are also focused on AI-related security risks that will, in some cases, apply to agentic AI; for example, the New York Department of Financial Services issued guidance in October 2025 requiring covered entities to address AI use in vendor contracts, specify audit rights, and maintain ongoing risk assessments.

Given these risks and the developing regulatory environment, thoughtful contract terms can allocate responsibility, establish security baselines, create transparency, and provide mechanisms for ongoing governance, helping both customers and providers navigate this evolving landscape.

Key Contractual Provisions for Agentic AI Security

The suggestions below address common provisions in technology transactions involving agentic AI. Implementations vary, and the relevance will depend on the sensitivity of the functions the agent performs, the scope of its permissions, the degree of customization, and the regulatory environment in which the parties operate.

Security Standards and Baseline Controls

A key area for negotiation around agentic AI security standards will likely be what security frameworks apply and how compliance will be demonstrated. Example frameworks include the NIST Cybersecurity Framework AI Profile and the OWASP Top 10 for Agentic Applications. Both frameworks reference supply-chain transparency and visibility into foundation models.

Technical architecture may also play a critical role in cybersecurity risk mitigation. The level of architectural transparency, evidence of controls, and third-party attestations are likely to be negotiated in light of confidentiality, security, and operational constraints. In practice, agentic AI security likely will require a shared responsibility model; the provider and the company each may have control and visibility the other lacks. How that translates to contractual standards will likely depend on the agentic AI service’s use, security risk profile, and industry. Controls will also vary by deployment context. For example, human review may hinder cyber tools that prevent AI-based attacks but be required for tools used to make decisions affecting individual consumers.

Incident Notification and Response

Incident reporting provisions take on heightened importance when agents can cause harm before human operators detect a problem. Parties should consider whether definitions of “cybersecurity incident,” encompass agent-specific events such as prompt injection, memory poisoning, privilege escalation, and behavioral misalignment. Notification timelines may also require negotiation given the speed at which autonomous systems can compound initial compromises and the countervailing needs for reasonable investigation timeframes and accuracy in early reporting. Parties should consider distinguishing events requiring immediate notification from those addressable through periodic reporting.

Audit Rights and Ongoing Assurance

The complexity of agentic AI may require specialized expertise to understand what contractual audit and assurance processes should cover, what permissions an audit would require, and who is qualified to conduct it. For example, guidance from the New York Department of Financial Services (NYDFS) stated that effective audits and monitoring will likely include functionality, operations, security, compliance, and human factors. The NYDFS guidance emphasizes that risk assessments should be ongoing, not one-time onboarding exercises. From a security perspective, ongoing assurance can be challenging because the control surface includes not only code and infrastructure, but also the agent’s permissions, tools, and evolving use over time.

Governance, Human Oversight, and Termination Rights

Because agentic AI systems autonomously decide which actions to take, governance considerations generally include boundaries on agent autonomy, escalation triggers requiring human approval, and kill-switch capabilities. Areas for contract negotiation may include management of model updates, tool integrations, and termination rights. From a security perspective, parties should understand the practical implications of termination rights. For example, discontinuing access may be challenging if the agentic AI has become integrated with other systems or created dependencies during its operations.

Liability Allocation

From a security perspective, liability allocation for agentic AI should account for harm that may result from interacting causes, including model behavior, permission design, and customer deployment choices. That causation analysis may be harder than in traditional software disputes, where parties may more readily distinguish among service outages, security failures, and customer-side misuse. Parties should consider whether standard liability caps, cybersecurity carve-outs, indemnities, insurance requirements, and exclusions are appropriate for the specific agentic AI use cases.

Conclusion

The rapid deployment of agentic AI creates new security risks. Companies that proactively identify security risks and related liability and regulatory implications will be better-positioned to capture productivity benefits while negotiating appropriate terms to manage novel risks.