Autonomy debt is the security risk that builds when automation expands faster than the controls needed to supervise, correct, and reverse it. In practice, teams let software or AI agents take on more decisions, but they do not add enough logging, approval steps, exception handling, or rollback paths to match that new power.
This matters in cyber security because an agent with access to tickets, accounts, alerts, or production tools can turn a small mistake into a large operational failure. In attacks, adversaries may abuse overprivileged automation, poisoned inputs, or weak approval flows to trigger unwanted actions at scale. In defense, reducing autonomy debt means limiting agent authority, keeping humans in the loop for risky steps, preserving audit trails, and making shutdown or rollback procedures testable before deployment.