Author: Alexander Ivanyuk, Senior Director, Technology
Agentic AI is different from a normal AI assistant. A normal assistant usually answers a question, summarizes a file, drafts an email or helps a user find information. An AI agent can go further. It can interpret a goal, plan several steps, use tools, call APIs, work with connected data and even take action inside a business process with some degree of autonomy.
That difference is useful, but it also changes the risk. If an AI assistant gives a bad answer, the damage may be limited to that answer. If an agent has access to business systems, the same mistake can become an action: the wrong email is sent, the wrong record is updated, the wrong file is accessed or the wrong workflow is triggered.
This is why safe agentic AI is becoming an important topic for managed service providers (MSPs) and small and medium IT deployments (SMDs). The market is moving quickly. A recent Deloitte survey of 3,235 business and IT leaders found that only 21% of respondents said their organizations had mature governance in place for agentic AI, while 74% expected their companies to use AI agents at least moderately by 2027. The same research said many organizations still lack mature capabilities such as clear boundaries for independent agent decisions, real-time monitoring and audit trails. A Protiviti study also found that more than 68% of organizations expected to have autonomous or semi-autonomous AI agents integrated into core operations by 2026.
For MSPs, this means agentic AI cannot be treated as only another productivity feature. It has to be managed like a new operational layer. For SMDs, the message is simpler: agents can help the business move faster, but only if they are kept inside clear limits.
Why agentic AI needs stronger controls
Agentic AI adds three things that normal AI use usually does not have at the same level: persistence, tool access and action.
Persistence means the agent may continue working through a task instead of answering once and stopping. Tool access means it may call a system, retrieve data, search a knowledge base, connect to an application or use a model context protocol (MCP) server. Action means it may do something that affects the business, not just produce text.
That is where traditional software assumptions start to break down. A normal application usually has fixed functions. An agent may decide which tool to use based on a user request, retrieved context or earlier steps in the task. That flexibility is exactly why agents are useful. It is also why they need guardrails.
Safe agentic AI starts from a simple rule: an agent should never have more freedom than the business can explain, monitor and control. If no one can answer what the agent can see, what it can do, when it must stop, and when a human must approve the next step, then the agent is not ready for serious business use.
Specific attacks on agentic systems are already showing the pattern
Agentic AI risk is no longer only a theoretical discussion. The public cases we see today are not all identical, but they point to the same lesson: when AI can retrieve context, use tools or act through connected systems, the attack surface becomes wider than a normal chatbot.
One important example is EchoLeak, a zero-click vulnerability found by Aim Labs in Microsoft 365 Copilot. The researchers described an attack chain that could automatically exfiltrate sensitive and proprietary information from Microsoft 365 Copilot context without the user needing to click a link or take a specific action. Microsoft later mitigated the issue, and public reporting says there was no evidence of real-world exploitation, but the case is still important because it showed how a connected AI assistant can become a data-exfiltration path when retrieved context, model behavior and output channels interact in the wrong way.
A second pattern is tool poisoning, especially around MCP. Researchers and the OWASP community describe MCP tool poisoning as an indirect prompt injection attack where a malicious MCP server exposes tools that look normal, but their descriptions or responses contain hidden instructions for the model. The user may see a harmless tool name, while the LLM receives instructions that can push it toward unauthorized tool calls, data leakage or policy bypass. This is exactly why MCP servers cannot be treated as simple connectors. They become part of the trust boundary.
Acronis TRU’s research on malicious AI ecosystem components shows a related agentic supply-chain risk: agents and AI tools increasingly rely on external models, skills, plugins and repositories. If those components are malicious or over trusted, the agent can execute attacker-provided functionality under the user’s or organization’s authority.
The important point is not the brand name of the tool, but the failure mode: an agentic system with broad access, weak exposure controls and poor isolation can become a route into files, commands, credentials or connected services. Once an attacker controls the agent or its runtime environment, the agent’s legitimate permissions can be turned against the business.
A fourth pattern is identity and privilege abuse. The OWASP Top 10 for Agentic Applications highlights risks such as agent goal hijacking, tool misuse, identity and privilege abuse, agentic supply-chain vulnerabilities, unexpected code execution, memory or context poisoning and rogue agents. This matters because agentic failures are often not just “bad answers.” They can become bad actions: accessing the wrong data, calling the wrong tool, executing the wrong workflow, or continuing a task after the original business intent has been lost.
These cases explain why safe agentic AI needs more than a model-level safety promise. It needs layered controls around the whole workflow: what context the agent can use, what tools it can call, what data can leave the endpoint, what prompts are blocked, what activity is logged, and when a human must approve the next step.
This is where Acronis GenAI Protection fits directly into the safety story. Acronis addresses the risks through several layers: Visibility to GenAI applications, agents, and MCP servers across centrally managed customer environments; Data Loss Prevention to detect or block sensitive data sent to AI applications; Prompt Injection Protection to detect or block harmful prompts and record events; and a layered AI security engine that scans prompts using predefined attack patterns, keywords, regular expressions, semantic analysis, LLM checks, and similarity search. The Acronis roadmap also includes MCP servers monitoring and control, which is especially relevant as AI agents become more connected and more active.
In practical MSP terms, this means Acronis helps reduce the main failure paths shown by these attacks. If an agent or AI app is used outside policy, usage monitoring helps make that activity visible. If sensitive information is about to be sent to an AI application, DLP can detect or block it. If a prompt or tool response attempts to manipulate the model, prompt injection protection and the AI security engine provide a first line of defense. If usage becomes abnormal or automated, denial-of-wallet monitoring helps surface suspicious consumption. And when agents and MCP servers become part of the customer environment, centralized GenAI management gives MSPs a more practical way to govern what is allowed instead of leaving those decisions scattered across tools and users.
Guardrails: Keeping agents inside safe boundaries
These attack patterns make guardrails much more than a best-practice checklist. Guardrails are the rules that keep an agent inside the intended business use case, even when it sees untrusted content, receives a misleading prompt or connects to tools that can affect real systems. They are not one control. They are a set of boundaries around input, data, tools, actions and outputs.
A practical guardrail may say that an agent can summarize a support ticket but cannot close it. Another may allow an agent to search a knowledge base but not access payroll files. Another may let it draft a customer response but require a human to review the message before it is sent. These are simple examples, but they show the point clearly: safe agentic AI depends on limiting what the agent can do before anything goes wrong.
The most important guardrails usually cover five areas: purpose, data scope, tool scope, action scope and output control. Purpose defines what the agent is supposed to do. Data scope defines what information it is allowed to retrieve. Tool scope defines which applications, APIs, MCP servers, or plugins it may use. Action scope defines whether it is read-only, allowed to write, or allowed to trigger workflows. Output control defines whether the result is shown directly, logged, blocked, rewritten, or sent to a human for approval.
This is also where prompt-injection protection matters. Agents can be manipulated when they process untrusted content, such as documents, web pages, tickets, emails or tool output that contains hidden instructions. The risk is not only that the agent says something wrong. The risk is that it follows the wrong instruction while still appearing to operate normally.
Acronis GenAI Security addresses this through prompt injection protection that can detect potentially harmful prompts, record details in the event log, block them, and notify the end user. It also includes an AI security engine that provides a fast first line of defense using predefined attack patterns, keywords and regular expressions, with additional layers around NLP models, LLM checks, and similarity search for known attack patterns as the technology evolves.
Tenant isolation: One customer's AI should not become another customer's risk
Tenant isolation is especially important for MSPs. An MSP may manage many customer environments, each with different users, policies, data, and risk tolerance. Agentic AI makes that separation even more important because agents may connect to documents, applications, dashboards, ticketing systems or customer-specific knowledge bases. It is a safety boundary that prevents one customer’s agent, tools, data or approvals from becoming another customer’s risk.
In practical terms, tenant isolation means that each customer's AI use must remain inside that customer's boundary. The agent for Customer A should not see Customer B's data. A policy created for one customer should not accidentally apply to another unless the MSP explicitly intends that. Reports, logs and events should be separated clearly enough that the MSP can manage customers at scale without mixing their data or governance decisions.
This matters because agentic AI may create new paths between systems. An agent can retrieve data, use tools and call connected services. If tenancy is weak, the risk is not only data exposure. It is also policy confusion. One customer may allow a certain AI app, while another may block it. One may allow browser-only monitoring, while another may want fuller protection. One may permit AI for support workflows, while another may restrict it to internal drafting.
Acronis supports the MSP operating model by making GenAI security part of the management plan assigned to managed devices. When enabled, admins can configure usage monitoring, protection scope, data loss prevention, and prompt injection protection. Usage monitoring also provides partner-level and customer-level visibility through monitoring widgets and a Generative AI security report, which is important when MSPs need to operate across multiple customer environments without losing separation and reporting clarity.
Access control: Agents should only reach what they really need
Access control is the heart of safe agentic AI. The most dangerous agent is not always the smartest one. It is the one with too much access.
An agent that only reads a public FAQ is low risk. An agent that can access customer records, internal documents, email, file storage or ticketing systems needs stronger control. An agent that can update records, send messages, trigger workflows or call write-capable tools needs even more control. The business has to separate "can read" from "can act."
This is also why MCP servers matter in agentic AI security. MCP can make AI systems more useful by giving them a standard way to connect to tools and data. But every MCP server becomes part of the trust boundary. If the server is poorly designed, compromised, over-permissioned, or simply approved without proper review, the agent may gain access to tools the business did not intend to expose.
Access control should answer very concrete questions. Which users can run the agent? Which data can the agent retrieve? Which tools can it call? Is the tool read-only or write-capable? Does the agent inherit the user's permissions, use a service account, or operate under a separate identity? Can it access personal information, customer data, source code, financial records or regulated content? Can it connect to an MCP server? Is that MCP server approved?
These questions are not theoretical. The OWASP GenAI Security Project released its Top 10 for Agentic Applications after input from more than 100 security researchers, practitioners, user organizations, and technology providers. The list highlights risks such as goal hijacking, tool misuse, identity and privilege abuse, memory poisoning, cascading failures and rogue agents. The common thread is clear: when agents can use tools and act across workflows, access control becomes part of the safety model, not just a background IT setting.
Acronis GenAI Security is designed around the same practical risk pattern. It includes GenAI management for applications, agents, and MCP servers through centralized policies, DLP for sensitive and confidential data sharing, prompt injection protection and usage monitoring. The roadmap also includes Acronis DLP plus MCP server protection, which is directly relevant as customers start connecting AI systems to tools and data through MCP.
Figure 3. Read-only agent tasks and action-capable agent tasks carry very different levels of risk
Human approval: Not every action should be automatic
Human approval is not a sign that AI has failed. It is how safe automation works.
The goal is not to put a human in front of every small step. That would make agents useless. The goal is to decide which actions are low risk enough to automate and which actions require review. A support agent may be allowed to search the knowledge base and draft a reply automatically. But sending the reply to a customer, closing the ticket, issuing a refund, deleting a file, changing access rights or updating a contract should require stronger approval.
A good human-approval model depends on risk level. Low-risk actions can be automated. Medium-risk actions can be allowed with logging and review. High-risk actions should require explicit human approval. Critical actions should be blocked or limited to a tightly controlled workflow.
This is especially important for SMDs. Smaller organizations often want AI because teams are stretched and routine work takes too much time. But smaller teams also have less room for mistakes. A bad agent action can affect a customer relationship, create compliance exposure, or cause operational confusion very quickly.
For MSPs, human approval is also part of service design. It helps define which actions the customer wants the MSP to control, which actions the customer wants to approve internally, and which actions should never be automated. That turns agentic AI from a vague promise into a manageable workflow.
Acronis helps here by giving MSPs and customers the controls around the agentic workflow, not just the final output. GenAI Protection can detect or block sensitive data being sent to AI applications, record details in the event log and notify the user. Prompt injection protection can detect or block harmful prompts and notify the user. Usage monitoring and reporting give visibility into patterns over time. These controls help create the safety layer around agentic use cases, including the points where a human needs to review, approve or investigate.
Figure 4. High-risk agent actions should be routed to human review instead of being executed automatically
Monitoring and auditability: Safe agents need accountability
If an agent takes actions, the organization needs a record of what happened. This does not mean exposing every internal model step or overwhelming the customer with logs. It means having enough visibility to answer practical questions after the fact.
What agent was used? Which user triggered it? What data did it touch? Which tool did it call? Was sensitive data involved? Was a risky prompt detected? Was anything blocked? Did usage suddenly spike? Did the activity look normal for that customer and that workflow?
Without that visibility, a business may not know whether the agent behaved safely or simply got lucky. And if something goes wrong, the MSP or customer may struggle to reconstruct what happened.
This is where monitoring and anomaly detection become part of the safety model. Acronis GenAI Protection includes usage monitoring that discovers generative AI applications used across customer environments and provides visibility into adoption patterns and usage trends. It also supports centralized reporting through dashboard widgets and a Generative AI Security report at both partner and customer level.
Agentic workflows can also create costs and activity patterns that look different from normal human use. A human may ask ten questions. An agent may run through many steps, call tools, retry actions and generate much higher consumption. Acronis plans to address it in the future releases with monitoring and anomaly detection for suspicious usage patterns, including denial-of-wallet patterns where sustained or automated prompt activity can drive excessive consumption.
How Acronis helps MSPs and SMDs make agentic AI safer
At Acronis, we see safe agentic AI as a layered control problem. The goal is not to block AI or slow customers down. The goal is to make AI visible, governed and protected enough that MSPs and SMDs can use it with confidence.
The first layer is visibility. MSPs need to know which GenAI applications are being used, where usage is happening, and how it changes over time. Acronis usage monitoring helps discover GenAI applications across customer environments and show adoption patterns and trends through dashboard widgets and reports at partner and customer level.
The second layer is policy and management. Agentic AI cannot be governed only by user promises. It needs central policies for GenAI applications, agents, and MCP servers. Acronis GenAI management is built into the familiar management console and is designed to govern and control those components through centralized policies. GenAI Protection can be enabled through a management plan assigned to managed devices, with configurable settings for usage monitoring, protection scope, DLP and prompt injection protection.
The third layer is data protection. Agents are useful because they work with business context. That also means they may touch sensitive information. Acronis GenAI Protection can inspect prompts for sensitive data such as PII and PHI and prevent unauthorized transmission of that information to generative AI applications.
The fourth layer is prompt and intent protection. Agents can be manipulated through direct and indirect prompt injection, jailbreaking, poisoned context or harmful instructions hidden in retrieved content. Acronis prompt injection protection detects and blocks potentially harmful prompts designed to manipulate AI model behavior or compromise application integrity, while the AI security engine adds a fast first line of defense using predefined attack patterns, keywords and regular expressions.
The fifth layer is runtime monitoring and cost protection. Agentic workflows can create abnormal usage, automated prompt loops, and denial-of-wallet patterns. Acronis supports monitoring and anomaly detection for suspicious usage patterns, centralized reporting and active prevention of sustained or automated prompt activity that shows denial-of-wallet characteristics.
Taken together, these layers give MSPs a clearer way to talk to customers about safe agentic AI. Start with visibility. Add central policy. Protect sensitive data. Detect harmful prompts. Watch for abnormal usage. Apply stronger controls as agents become more connected to tools, data and workflows.
Conclusion
Agentic AI can be useful for MSPs and SMDs because it can reduce repetitive work, support technicians, help employees find answers faster, and automate parts of everyday workflows. But the same thing that makes agents useful also makes them risky: they can connect, decide and act.
That is why safe agentic AI needs guardrails, tenant isolation, access control, human approval, monitoring and auditability. These are not abstract security ideas. They are the practical conditions that decide whether agents remain helpful assistants or become unmanaged operational risk.
For MSPs, the opportunity is to help customers adopt agentic AI in a way that is repeatable and manageable across tenants. For SMDs, the value is being able to use AI without giving it unlimited reach into the business. And for Acronis, this is exactly where GenAI Protection fits: bringing visibility, centralized policy, DLP, prompt injection protection, usage monitoring and MCP server protection into a practical control model for real customer environments.
About Acronis
A Swiss company founded in Singapore in 2003, Acronis has 15 offices worldwide and employees in 60+ countries. Acronis Cyber Platform is available in 26 languages in 150 countries and is used by over 21,000 service providers to protect over 750,000 businesses.
.png)
