GCRI · 人工知能と自律システム
エージェント型システム
Agentic AI システム pursue goals by planning and taking actions: calling tools, browsing, writing and running code, or operating other software, sometimes over long tasks with little supervision. Autonomy brings usefulness and new failure modes, from compounding errors to misuse of granted permissions. This page sets out how agents fail, how their actions can be bounded and overseen, and what evidence serves those who build, deploy and govern them.
Agentic systems on the record.
Agentic systems: how the risk develops.
Tool access, delegated authority and safe execution. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Errors compound over steps
Each step in a long task can go wrong, and an early mistake shapes later actions. Small per-step error rates add up over many steps.
Permissions define the blast radius
An agent can only do harm with the access it has been given. Broad credentials, write access and payment rights turn errors or manipulation into real-world consequences.
Untrusted inputs steer behaviour
Agents read web pages, documents and messages that may contain instructions. Prompt injection can redirect an agent to act against its user.
Oversight must be designed in
Humans cannot review every action of a fast agent. Approval steps for consequential actions, logging and the ability to stop and roll back are design choices.
Agent oversight console.
このテーマを追跡するためにチームが使う画面：その指標、状態、決定。名前は例であり、値はイメージです。
Agent oversight console
Agentic systems · Agent sandbox · Session AG-6627
Tool calls
- 10:34情報search(documents) · read-only
- 10:51情報run_model(flood_nowcast) · sandbox
- 10:51ゲートsend_message(external) · needs approval
- 10:53Errorwrite_file(outside workspace) · denied
政策
- 対象範囲
- workspace only
- External actions
- human approval
- Spend limit
- 43 units
- Kill switch
- Armed
Actions by approval class
Agents that act need guardrails in every domain they touch.
Agentic system studies are designed for the Exponential Technology series. The OWASP Top 10 for LLM applications lists failure modes such as excessive agency and prompt injection; the page describes them without exploit detail.
- Incident reports involving agents.
- Designs for oversight and permission scoping.
How agentic systems is modelled, measured and tested.
モデル、その仮定、データ、不確実性を、科学者やエンジニアが確認する形で示します。構造は公表された手法に従っています。描かれた値は例示であり、知見ではありません。
システム・モデル
The couplings between the systems in agentic systems: signs of influence, a reinforcing and a balancing loop, and cross-links where stress jumps.
何を、どの程度うまく測定しているか。
各指標には、その単位、更新頻度、背後にある出典の種類、値が持つことになるエビデンスのラベルが付いています。値は表示しません：プログラムが自らの権限のもとで値を提供します。
| 指標 | 単位 | 周期 | 出典の種類 | ラベル |
|---|---|---|---|---|
| Task success rate on agent benchmarks | percent of tasks completed correctly | per evaluation | Agent benchmark results | 報告値 |
| Actions requiring human approval | percent of consequential actions | per deployment | Deployment configuration | 申告済み |
| Prompt injection success rate | percent of attempts succeeding | per evaluation | Security testing | 観測 |
| Agent incidents | count by severity | 月次 | Incident reports | 報告値 |
| Actions logged and attributable | percent of agent actions | per deployment | Audit logs | 観測 |
| Mean task length before human intervention | steps or minutes | per evaluation | Evaluation logs | 観測 |
エビデンスの出所。
名前の明示された公開データセットと機関の記録。それぞれにライセンス区分があります。合意に基づく出典は、その条件のもとでのみ使用し、再公開することはありません。
| 出典 | 提供するもの | ライセンス区分 |
|---|---|---|
| OWASP Top 10 for LLM Applications and agentic security guidance | Risks such as prompt injection and excessive agency | Open, CC BY-SA 4.0 |
| Published agent benchmarks such as SWE-bench and related suites | Task-based evaluation of agents | Open, licence per benchmark (to check) |
| NIST AI リスクマネジメント・フレームワーク | Practices for governing and measuring AI risk | Public domain, US government |
| AI Incident Database | Reported incidents involving AI システム | Open, licence to check |
| Developer system cards describing agent safeguards | Developer-reported agent evaluations and controls | Public documents, terms per developer |
誰が決め、エビデンスが何に役立つか。
人工知能と自律 システム prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| 誰が決定するか | 質問 | このページが提供するエビデンス |
|---|---|---|
| Deploying organisations | Which actions an agent may take alone and which need approval | Permission patterns; evaluation results |
| Security teams | How to protect agents from manipulation | Injection testing; incident evidence |
| 規制当局 | What oversight to require for autonomous AI actions | Oversight design evidence |
このトピックが生み出す成果物
- Permission and approval design patterns for agents
- Agent evaluation protocols covering long tasks
- Prompt injection test suites for deployments
- Logging and rollback requirements
What designers and evaluators ask.
- What actions can the agent take, with whose authority, and which are reversible?
- How does it behave when instructions are ambiguous, conflicting or malicious?
- Can a human see what it is doing, understand why and stop it in time?
- How do errors compound over long sequences of steps?
How agents fail.
An agent combines a model’s reasoning with permissions in the world. Small errors in early steps can compound across a long task. Agents can misinterpret goals, pursue them in unintended ways or take shortcuts that satisfy a metric but not the intent. Content the agent reads, such as a web page or document, can contain instructions designed to hijack it, an attack known as prompt injection.
The more permissions an agent holds, the larger the potential harm. システム that coordinate several agents add further failure modes, as agents pass errors to each other or interact in unforeseen ways.
Designing for safe execution.
- 01
Least privilege
Granting only the permissions a task needs, with sandboxes and spending or action limits, drawing on サイバーセキュリティと暗号.
- 02
Human oversight points
Requiring confirmation for consequential or irreversible actions. Too many prompts lead to rubber-stamping, so placement matters.
- 03
Task-based evaluation
Testing agents on realistic multi-step tasks in controlled environments, using AI 評価・保証工学. Simulated environments miss some real-world complexity.
- 04
Logging and audit
Recording actions and reasoning traces so incidents can be reconstructed. Traces may not fully reflect how a model reached a decision.
どのように研究され、手法が言えないことは何か。
Where this page’s references lead.
このページの読解の基準となる機関と文書。状態と版は変わります。各リンクは発行機関へ移動します。
質問と回答。
What is an AI agent?
What is prompt injection?
How can agent risk be reduced?
Should agents ever act without human approval?
Can agents be evaluated before deployment?
Does the platform build agents?
このページからエビデンスを提供する。
報告書 is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- メールゲートウェイ GW-GCRIこのページから送信するエビデンス、訂正、事例、手法、レビュー、翻訳、プロファイルへの入力。このページのタグが付いて届くため、担当の編集者が受け取ります。
- Zenodoオープンな寄託寄託してコミュニティに提出するORCID iD を使って Zenodo に自分の記録を公開し、そこから Reports コミュニティに提出してください。キュレーターが審査し、DOI は引き続きあなたのものです。
- 報告書GCRI貢献のすべての方法を見る貢献の種類、それぞれの審査方法、受け取るクレジット、ライセンス、決して受け付けないもの。
個人データ、重要インフラの機微な詳細、共有する権利のないものは決して送らないでください。寄稿は利用前にレビューされます。送付によって著作者としての権利や編集上の権利が生じることはなく、スポンサーシップで調査結果を買うことは決してできません。
手法、データセット、または問いを持ち込んでください。
情報提供と問い合わせは本日から受け付けています。問い合わせには参照番号が付き、次の手順が示されます。申請、支払い、計算資源の割り当て、登録は、担当チーム、規約、審査体制が整ってから開始します。
法的文書。
このサイトの地図、データ、図表は、背景と一般的な情報として示すものです。助言、予報、警報ではありません。情報の限界は免責事項とデータに関する注意事項に記載しています。