Are agentic AI guardrails keeping pace with the agents?

By McKinsey & Company · 2026 (the source does not specify the exact send date).

The email, part of the 'New from McKinsey & Company' alert series, focuses on whether safety guardrails for AI agents are keeping pace with those agents' growing autonomy. McKinsey warns that AI agents are often mistaken for more capable chatbots, but unlike chatbots they can reason, plan and act autonomously. That opens the door to greater productivity but also brings a new set of risks.

In a recent episode of 'The McKinsey Podcast', McKinsey partner Rich Isenberg compares AI agents to toddlers. In his analogy, if you tell a toddler to run down a hallway and stop before the stairs, they might do it... or they might keep running. The solution, according to Isenberg, is to put up a 'baby gate': for AI agents, that means controls they cannot bypass.

The email cites a specific figure: 80% of organizations say they have seen risky behavior from their AI agents, including improper data exposure and unauthorized access to systems. McKinsey argues that organizations therefore need clear ownership of that risk and a record of what agents do. It also stresses that guardrails should be built into the systems themselves rather than left to each team to apply on its own.

The message links to several other McKinsey pieces on the topic. They include 'Trust in the age of agents', on how agentic AI is already making decisions and acting autonomously; 'Deploying agentic AI with safety and security: A playbook for technology leaders', a guide for technology leaders on the risks and vulnerabilities of autonomous agents; 'The board's role in managing emerging AI risks', with views from cybersecurity executives and board directors; 'State of AI trust in 2026: Shifting to the agentic era', with results from McKinsey's 2026 AI trust maturity survey, which shows gains in maturity but also lasting gaps in strategy, governance and risk management; 'The speed problem: How frontier AI exposes weakness in enterprise cybersecurity', on how attackers already operate 'at machine speed' while organizations decide 'at committee speed'; and 'Evolving model risk management in the age of AI', on how banks are adapting their model risk management frameworks as AI adoption speeds up.

The email is edited by Bryce Stewart, a McKinsey editor in Munich, and closes with the usual links to manage the subscription, unsubscribe and follow McKinsey content on its mobile apps.