A rogue agent is an autonomous AI agent whose behavior drifts outside its intended scope, policy, or authorization boundaries. Instead of following approved steps, it may choose unsafe tools, access data it should not see, or chain actions in ways the operator never allowed.
In cyber security, this matters because an agent can turn a bad decision into a real system change. A rogue agent may be triggered by prompt injection, manipulated retrieval data, weak permissions, or excessive tool access. Defenders look for runtime controls such as least privilege, approval gates for sensitive actions, action logging, and policy checks that can block execution before damage occurs. The goal is not only to make the model answer safely, but to keep its actions contained even when it behaves unexpectedly.