Artificial intelligence has officially entered its execution phase. After years of experimentation, businesses are rapidly deploying AI not just to analyze data, but to act on it.

At the forefront of this shift are AI agents, autonomous systems designed to execute complex tasks, automate workflows, and interact with other digital systems on our behalf.

Their adoption is accelerating at an incredible pace, with a recent McKinsey study finding that 62% of organizations are already experimenting with them. It’s easy to see why, as Agentic AI offers a relatively straightforward path to embedding powerful automation deep into business processes.

However, as these systems evolve from passive tools into autonomous agents, we are entering a new era of digital risk. The conversation is no longer just about building smarter agents, but whether the entire agent economy can function without a trust layer underneath it. Identity verification has evolved beyond being a basic security feature into the infrastructure that makes autonomous commerce possible at all.

When an AI can access sensitive databases, interact with third-party systems, and execute commands, a critical question emerges: how do you know who, or what, is really on the other end of that API call? Without a robust framework for agent identity and accountability, true agentic commerce will not be possible.

The real-world risks of unchecked AI agents

The appeal of agentic AI is its autonomy, but this is also its greatest risk. An unchecked or compromised AI agent operating within a corporate network can become a powerful vector for malicious activity. These risks are not new, but are a direct extension of existing cyber threats, amplified by the speed and scale of AI.

The most defining threat vector in the era of agentic AI is prompt injection. This is unique to AI agents as it weaponizes the very natural language capabilities that make them so powerful. Unlike traditional cyberattacks that rely on exploiting software bugs or cracking passwords, prompt injection bypasses standard security perimeters by feeding maliciously crafted text directly into an agent's processing stream.

This essentially tricks the AI into overriding its core system instructions and executing the attacker’s commands as if they were legitimate tasks. In an enterprise environment where agents hold permissions to access CRMs, process invoices, or alter databases, a successful injection can instantly turn a helpful digital assistant into an undetected insider threat.

Through prompt injection, agents can be instructed to exfiltrate data or escalate their privileges. An agent designed to access a customer database for legitimate analysis could, if compromised, be instructed to copy and transmit that entire database to an external server. Similarly, privilege escalation becomes a major concern, as an agent with limited permissions could probe the network for vulnerabilities or exploit a flaw to grant itself higher levels of access, effectively becoming a rogue administrator.

AI-to-AI interactions present a new frontier of security risk. As one business’s AI agents begin to interact with agents from partners or customers, the potential for supply-chain compromise grows exponentially. Without a way to verify the identity of the interacting agent, every AI-to-AI connection becomes a potential security blind spot.

Building a framework for agentic trust

In the emerging agent economy, trust hinges on answering three questions, only two of which today's standards meaningfully address: “who is this agent?” (addressed by identity primitives like W3C DIDs, increasingly applied to agents), “does this agent have authorization to spend this money on a user's behalf?” (frameworks such as FIDO Alliance-stewarded standards such as AP2 and Verifiable Intent, contributed by Google and Mastercard), and finally “what is this agent's reputation and track record?”, a question the current standards stack leaves open.

Together, they form the essential trust and payment stack required to move agentic commerce from experimental sandboxes to mainstream, high-value transactions. Zero trust architecture is also more critical than ever for securing systems against agentic threats. An agent's identity must be re-verified for every single transaction or request, and its permissions should be limited to the absolute minimum required for its specific task, based on the principle of least privilege. This means even if a trusted agent is compromised, its ability to cause widespread damage is severely restricted.

This same logic extends well beyond the corporate perimeter, in both directions. On one side, AI agents are beginning to transact on behalf of consumers: booking, buying, paying, returning. On the other, businesses are deploying agents to fulfil those same orders, onboard new customers, automate supply chains, and run entire back-office functions. What's emerging is a new trust triangle between consumers, businesses, and agents, operating simultaneously on both sides of every interaction.

In that world, agent identity becomes a commercial problem as much as a security one. A business needs to know that the agent placing an order holds a valid, scoped mandate from a real human who authorized it to act. But equally, a consumer's agent needs confidence that the business agent fulfilling that order is legitimate, authorized, and traceable. Trust has to flow in both directions, and at machine speed. That's a verification challenge of a fundamentally different order to anything we've dealt with before, and one the industry is only beginning to standardize through frameworks like FIDO's Agentic Payments Protocol. Getting KYA right is foundational to enabling a function agent economy.

Finally, businesses need systems that continuously monitor agent behavior to create a baseline of normal activity, making it possible to spot anomalous actions. If an agent suddenly attempts something outside its regular function, such as accessing a new database, connecting to an unusual IP address, or executing commands at a much higher frequency, this behavior should instantly trigger an alert and, potentially, an automatic suspension of the agent’s permissions.

Trust as a catalyst for innovation

Some technology leaders hold the view that strict security measures are a barrier to innovation, however in reality the opposite is true. By building trust and safeguards into AI agents from the ground up, businesses can innovate without fear. They can confidently deploy agentic solutions to drive efficiency, reduce operational costs, and unlock new revenue streams, all without exposing themselves to the catastrophic risks of uncontrolled autonomy.

The agentic AI era is here, and it has the potential to reshape how enterprises operate. Autonomy without oversight is liability, but autonomy with verified identity, scoped mandates, and continuous trust signals is the foundation of a new commercial layer. As agent architectures mature, trust certification will become a precondition for being transacted with at all. KYA isn't a security cost. It's how you stay in the game.

We feature the best ecommerce platforms.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit