Customer experience is entering a new frontier. For years, automation in support meant deploying chatbots that offered scripted answers and could only handle basic inquiries without ever touching a user's account. If a user wanted to move money or change data, they were handed off to a human agent who acted as the authorization gatekeeper.
And then as large language model (LLM)-based chatbots entered the contact center, the primary fear was reputational. Leaders worried about a chatbot "going rogue," hallucinating a policy or using inappropriate language.
However as 2026 unfolds, the risk profile has fundamentally changed. Enterprises are no longer deploying bots that just answer; they’re deploying AI agents that act.
The new generation of agentic AI is being integrated directly into backend systems with the power to issue refunds, change account details, book appointments, and reset passwords. While this promises to collapse Average Handle Time (AHT) and boost resolution rates, it creates a massive, often unsecured attack surface.
This introduces a different risk landscape, one that demands new approaches to trust, oversight and security.
The New Attack Surface: Actions, Not Words
The rise of AI agents is shifting the attack surface in CX from informational to operational. The next wave of CX failures won’t be a chatbot giving a wrong answer. It will be an AI agent with too much access doing the wrong thing —or being manipulated into doing it—likely while leaving a digital trail so murky that security teams won’t know who, or what, pulled the trigger.
Nowhere is that risk more apparent than in account takeover (ATO) fraud. ATO became one of the fastest-growing security threats in 2024, surpassing ransomware as the top enterprise security concern, with 83 percent of organizations experiencing at least one incident, according to Sift.
Losses from ATO fraud are projected to have climbed to $17 billion in 2025 from $13 billion the previous year. That growth is being driven by malicious bot activity, infostealer malware, and increasingly sophisticated AI-driven techniques, indicating the threat from agentic AI adoption.
As Miguel Fornes, Information Security Manager at Surfshark, explained in an interview with CX Today, the leap from chatbots to agentic AI is transformative from a security perspective.
“The main difference is that this critical leap comes from content to consequence. The chatbot makes a mistake and hallucinates… but the agentic AI, if it hallucinates, it can send the money to the wrong person, or it can simply just wipe everything on your computer.”
This transition from words to actions is what makes AI agents both powerful and potentially dangerous. The ability to interact with accounts, execute transactions, and manipulate systems transforms what used to be a largely informational risk into a consequential one.
Where cybercriminals once relied on social engineering to manipulate human agents, now they can exploit AI agents. As Ali Sarrafi, CEO of Kovant told CX Today in an interview:
“Traditional cybersecurity problems have been about bugs in our software… We’re moving towards that these agents will become the new way of doing social engineering against your systems. That is the scary part.”
An agent that can reset credentials, change contact details, or authorize refunds becomes a high-value target. If an attacker can manipulate the inputs, the agent becomes an acceleration layer for fraud.
Sarrafi pointed to the nuances of context and access. Agents may perform the right actions, but in the wrong context:
“A lot of security problems with agents come from the fact that they’re actually performing the right action, but in the wrong context… If you have an agent that’s supposed to book you flights, if it gets access to everything else, it’s not doing the right job. It can mess up your information, mess up your database.”
Prompt injection, where an agent is tricked into executing malicious instructions hidden within a request, further complicates matters. “Unless the actual guardrails are outside the agent itself, you have a risk,” Sarrafi explained.
A recent security flaw identified in Moltbook, a social network built for AI agents, exposed millions of API authentication tokens, email addresses, and private messages because its backend database was misconfigured and left open to the internet. Researchers found that the exposed credentials would have allowed an attacker to take over any AI agent’s identity on Moltbook, demonstrating how agent identities, if not properly protected, can become vectors for account hijacking and unauthorized actions.
Beyond the Breach: Why Data Aggregation Matters
The risk comes as many organizations are rushing to deploy these capabilities with the same loose security architectures they used for informational bots. The prompt box is evolving from a conversational interface to a command line, introducing failure modes that traditional contact center security stacks aren't built to catch, at a time when attackers are getting better at impersonation.
Prompt Injection & Tool Abuse: Bad actors are no longer trying to trick a bot into saying something offensive; they are trying to trick it into executing tools. A well-crafted prompt could convince an agent to bypass authentication steps or process a refund outside of policy limits, effectively social engineering the software.
Over-Permissioned Integrations: In the race to introduce AI features, developers often grant the model broad access to the CRM or billing system rather than scoped, least-privilege access. If an agent only needs to read a balance, but the API token allows it to edit the balance, a compromised or confused agent becomes a dangerous insider threat.
