Agentic AI Feels Like the Internet in 1998: Powerful, Exciting, and Full of Risks We Don't Yet Understand

The OWASP Top 10 for Agentic Application Security published in 2026 paints a vivid picture of the significant security risks posed by agentic applications. As these systems become more autonomous, it's crucial to start contemplating the vulnerabilities they present. Reflecting on the article, one can't help but draw a parallel to the late 90s when developers were building groundbreaking capabilities without fully grasping the security implications.

In 1998, I was issued an email address that included the last four digits of my social security number - a practice that seems both dangerous and foolish when viewed through a more experienced lens. Thirty years later, it's hard to comprehend how people could have overlooked such risks. This parallels the early days of the internet, where applications often trusted user input, exposed sensitive functions, and made reckless assumptions.

Most of these mistakes weren't due to negligence, but rather the industry's ongoing process of learning where the vulnerabilities lay. Looking back ten years from now, we're likely to view some of the designs from the early days of agentic AI with a similar sense of bewilderment. The thought of granting an agent persistent memory, granting it API access, production credentials, unrestricted internet access, and enabling it to make autonomous decisions based on untrusted external content appears almost incomprehensible today. The common response in 1998 would have been, "We were still learning."