Are agentic AI guardrails keeping pace with their agents?

By McKinsey & Company · 2026 (the source does not specify the exact send date).

The email, part of the 'New from McKinsey & Company' alert series, centers on whether safety guardrails for AI agents are keeping pace with those agents' autonomy. McKinsey warns that AI agents are often mistaken for more capable chatbots, but unlike chatbots they can reason, plan and act autonomously, which opens the door to greater productivity but also introduces a new set of risks.

On a recent episode of 'The McKinsey Podcast', McKinsey partner Rich Isenberg compares AI agents to toddlers. In his analogy, if you tell a toddler to run down a hallway and stop before the stairs, they might do it... or they might keep running. The solution, Isenberg says, is to put up a 'baby gate': for AI agents, that means controls that cannot be bypassed.

The email cites a specific figure: 80% of organizations say they have detected risky behavior in their AI agents, including improper data exposure and unauthorized system access. Building on this, McKinsey argues that organizations need clear ownership of that risk and a record of what agents do. It stresses that guardrails should be built into the systems themselves rather than left to each team to apply on its own.

The message links to several additional McKinsey pieces on the topic, including: 'Trust in the age of agents', on how agentic AI is already making decisions and acting autonomously; 'Deploying agentic AI with safety and security: A playbook for technology leaders', a guide for technology leaders on the risks and vulnerabilities of autonomous agents; 'The board's role in managing emerging AI risks', featuring perspectives from cybersecurity executives and board directors; 'State of AI trust in 2026: Shifting to the agentic era', presenting results from McKinsey's 2026 AI trust maturity survey, which shows progress in maturity but also persistent gaps in strategy, governance and risk management; 'The speed problem: How frontier AI exposes weakness in enterprise cybersecurity', on how attackers already operate 'at machine speed' while organizations make decisions 'at committee speed'; and 'Evolving model risk management in the age of AI', on how banks are adapting their model risk management frameworks to rapid AI adoption.

The email is edited by Bryce Stewart, a McKinsey editor in Munich, and closes with the usual links to manage the subscription, unsubscribe and follow McKinsey content on its mobile apps.