An LLM agent is a system that uses a large language model to plan and execute multi-step tasks, often by calling tools such as shells, APIs, browsers, or database clients. Unlike a chat-only model, an agent can take actions, remember intermediate results, and choose the next step based on feedback.
In cyber security, that extra agency matters because it can speed up both attacks and defenses. An attacker may use an agent to enumerate hosts, triage files, test credentials, or automate post-exploitation work once a foothold exists. On the defensive side, agents can help with alert correlation, log analysis, and repetitive response steps, but they need strict permission boundaries. If tool access is too broad, a prompt injection, bad instruction, or operator mistake can turn the agent into an unsafe automation layer. Security teams therefore limit privileges, review tool outputs, and monitor every action an agent can trigger.