Cheap AI Security Risk: More Agents, Bigger Attack Surface

Cheap AI security risk grows with every agent run that a lower model price makes affordable. A business that once rationed an agent can now run it on every job, for longer, as hundreds of copies side by side, each holding its own access. Each copy can be tricked by a hidden instruction, handed too much access, or caught in a loop that runs up a bill. The price of one run fell. The runs that can go wrong multiplied.

Why a lower price changes the risk

As of October 2026, Anthropic's Claude Sonnet 5.5 lists at $2 per million input tokens and $10 per million output tokens, and Google's Gemini 4 Argon matches it at an introductory rate that Google says rises to $4 and $20. At that price, an agent a business ran on a handful of jobs becomes cheap enough to run on all of them.

Take a home-services company with an agent that books repair visits. It reads the customer's message, looks up the address, checks the technicians' calendar and texts a confirmation. Used by one dispatcher as a helper, it is a convenience. Run on every inbound message, around the clock, it becomes a system with its own access to customers, the calendar and the texting account.

At that scale, errors repeat faster. A hidden instruction planted in one message (an attack called prompt injection) reaches every run that reads it. One bad permission covers thousands of actions, and a small flaw in one tool connection becomes a large incident. Our post on prompt injection explains how those hidden instructions work.

Small failure rates become large numbers

A success rate that sounds excellent turns into a count you have to handle.

Cost per run hides this. The booking agent might cost a few cents a run, and the bill for a million runs might look fine. The wrong texts, the calls they cause and the cleanup are not on it. They belong in the decision, priced by how likely a bad action is and what one costs.

What OWASP's agentic list says gets worse with scale

The OWASP GenAI Security Project published the OWASP Top 10 for Agentic Applications for 2026 on December 9, 2025. The project describes it as a list of the most critical security risks facing autonomous and agentic AI systems. In our reading, five of its ten entries reach further with every extra copy of an agent. In plain terms, the names mean:

• Agent Goal Hijack (ASI01): something the agent reads changes what it is trying to do.
• Tool Misuse & Exploitation (ASI02): the agent uses a legitimate tool in a harmful way.
• Identity & Privilege Abuse (ASI03): the agent's credentials or permissions get used beyond their purpose.
• Cascading Failures (ASI08): one fault spreads through connected agents and systems.
• Rogue Agents (ASI10): an agent acts outside the bounds it was given.

You will also see "excessive agency" in articles about agent risk. That term is LLM06 in OWASP's separate Top 10 for LLM Applications, not an entry on the agentic list. Our post on agentic AI security walks through the four attack surfaces an agent exposes.

Controls belong in the unit cost

Every scaled agent carries the cost of its controls: identity, logging, policy checks, content validation, approval rules, rate limits, monitoring and incident response. They are part of the cost of a safe result, so they belong in the cost per run you compare. A model that is cheap only because nobody priced its controls is cheap on paper. Our post on the true cost of an AI agent shows where those controls sit in a full monthly cost model.

A safe scaling checklist

1. Set budgets at three levels. Per agent, per user and per workflow, for tokens, spend, tool calls and outside actions.
2. Use least privilege and short-lived credentials. Give each agent only the access its task needs, with credentials that expire, so scale does not multiply permanent access.
3. Rate-limit the high-impact actions. Cap the texts, record changes or payments an agent can make per hour, and require approval above your risk threshold.
4. Watch for unusual patterns. Spikes in actions, tool errors, repeated retries and data leaving where it should not.
5. Test the stop at production scale. A kill switch that works on one agent in testing may not stop five hundred copies in production.
6. Count incidents in the cost. Add what failures cost to clean up to your cost per accepted result.

Where human approval stops scaling

Approval above a risk threshold works at small volume and breaks at large volume. Say, for illustration, the booking agent takes 10,000 actions a day and a reviewer spends 30 seconds on each one. That is 300,000 seconds, or about 83 hours of review a day. Nobody reads that much, so approval turns into clicking yes: it looks like oversight and catches little.

So approval has to be saved for the narrow set of actions that cannot be undone, such as a refund, a cancellation or a message to a whole customer list, while automated limits handle the rest. Where that line sits depends on what each action can break, and it moves as volume grows.

Spend is a security signal

A leaked API key, a retry loop or an agent stuck repeating itself can show up first as a bill, which makes the spending cap a security control. An alert tells you the bill is growing, but unless something cuts off the spend, the API keeps serving. Our post on why API spending limits don't stop runaway bills covers how to build a cutoff that stops the spend.

Pairs well with

The Non-Human Identity & Credential Sprawl Gate ($79) grades whether your API keys and agent credentials are owned, scoped, rotated and revocable, and returns GOVERNED, SPRAWLING or UNMANAGED. For an agent that reads customer messages, the Indirect Prompt-Injection Exposure Gate ($79) scores its design against hidden instructions on a 0 to 100 scale, banded CONTAINED, HARDEN or HIGH EXPOSURE. Before an agent texts customers unattended, the Agent Side-Effect & Blast-Radius Checkpoint ($89) prints reversibility and blast radius separately, then reads the action RUN UNATTENDED, RUN WITH APPROVAL or DO NOT AUTOMATE.