Agentic AI Should Be Classified High-Risk by Default, Credo AI Research Argues, Citing Prompt Injection and Cascade Failure Exposure

What happened

Why it matters

• ·Organizations that have deployed AI agents without a formal high-risk classification may be operating outside their own AI risk frameworks and, increasingly, outside emerging regulatory expectations under regimes such as the EU AI Act that tie compliance obligations to risk tier.
• ·The prompt injection and data exfiltration findings mean that existing cybersecurity controls designed for human users or traditional software are likely insufficient for agents with broad API access, creating a direct gap in information security programs that security and compliance teams may not yet have assessed.
• ·Cascade failure in multi-agent systems creates an incident response challenge that most current AI incident playbooks do not address: the triggering event may be distant in time and system from the observable harm, making root cause attribution and regulatory disclosure timelines difficult to meet.

Governance controls affected

What to do now

• ☐Conduct an inventory of all deployed AI agents and score each against a formal high-risk classification criteria set, documenting the rationale for any agent not classified as high-risk.
• ☐Map the full permission scope of each agent, including API credentials, data store access, and downstream tool integrations, and compare against your organization's documented security risk appetite to identify overprovisioned agents.
• ☐Commission prompt injection red-teaming specifically against agents with external data inputs such as email, web retrieval, or user-submitted content, using scenarios that test for lateral data access beyond the agent's intended scope.
• ☐Review your AI incident response playbook to determine whether it covers cascade failure scenarios in multi-agent pipelines, including detection lag, cross-agent attribution, and regulatory disclosure timelines for compounding events.
• ☐Establish or update agent-to-agent interaction policies to require explicit trust verification at delegation boundaries, ensuring that an instruction passed from one agent to another cannot silently escalate permissions or expand task scope.

What to watch next

Regulatory bodies including the EU AI Office are expected to issue further guidance on agentic AI risk classification as part of the EU AI Act's general-purpose AI code of practice and high-risk system annexes, with implementation milestones continuing through 2026 and 2027. Singapore's IMDA has already published a model governance framework specifically for agentic AI, and other jurisdictions are likely to follow with more prescriptive requirements around agent access scoping and audit logging. Compliance teams should monitor whether prompt injection and cascade failure are named explicitly in forthcoming sector-specific guidance from financial regulators such as the FSB and national banking supervisors, as those designations would trigger formal control requirements rather than voluntary best practice.