Agentic AI

AI agents are transforming software development, science, industry and public administration. Their capabilities are growing rapidly: roughly every six months, the time it takes them to independently perform complex tasks at a human level is halved. They plan, learn from their mistakes and continuously improve.

Whoever masters this technology and its supply chains can accelerate innovation and produce at significantly lower cost. Today, our industry uses black-box models from the US and open-weight models from China. Neither supply chain is entirely reliable anymore.

Europe must not remain dependent in this area. We must develop and control the key building blocks ourselves:

1. Our own powerful core models

Europe needs robust core models with deep domain knowledge and the ability to plan for the long term. These form the basis for specialised agents and industrial value creation. Without our own core models, we remain technologically dependent and cannot control the value chain.

2. Adaptive local agent memory

Agents must continuously learn whilst in operation. This requires an efficient, potentially neural, memory for relevant experiential knowledge – one that is more elegant and powerful than today’s token-based storage systems.

3. Specialised local complementary models

Smaller, specialised models are required for typically European domains, such as plant control, mechanical engineering, automotive, materials science, chemistry, biology, healthcare or law. Companies must be able to adapt base models behind the firewall using their own data, thereby building complementary specialised models with low-cost structures.

4. Secure local running environments

Agents must be able to operate in controllable, local environments. Unfortunately, the closed ecosystems of many US companies force data outflow, non-transparent updates and unclear cost structures. Europe therefore needs open, independently controllable running environments that integrate base models, agent-based memory and specialised models.

Europe must take control of this supply chain for these four modules itself. It is just as crucial for the security and freedom of future generations as it is for military capability or energy policy sovereignty. SOOFI is the flagship project of the Federal Ministry for Economic Affairs and Energy (BMWE), which is systematically building precisely this technological sovereignty and the ecosystem required for it.

March 2026

In psychology, we talk about FOMO, the fear of missing out on something important. With agentic AI, we are on the cusp of the next leap in intelligent technology, one that must not be missed. By equipping large language models with their own tools and allowing them to navigate our digital world independently, we hope to unlock new realms of productivity. In these realms, not only will emails be answered and appointments coordinated entirely automatically, but AI agents will also look after customers, carry out research and develop new products. The very idea of handing these tasks over to an AI is tempting and fires the imagination.

It remains to be seen where and how these expectations will be met. One thing is already clear, however: fundamental security issues remain unresolved when it comes to agent-based AI. For decades, the principle in computer science has been to separate data and instructions in order to minimise the attack surface. AI agents simply throw this principle out the window. They never know for certain whether they are currently reading data or receiving new instructions. A ‘Wait, stop, I’m speaking now!’ is both a quote and a potential instruction. So far, we have not found any reliable mechanisms to prevent this. Thus, a manipulated email, a tampered document or a seemingly harmless website can throw AI agents off balance and trigger harmful actions.

Anyone who lets an AI agent loose on their emails, for example, is like a homeowner who hands a key to a stranger and hopes that the stranger will only water the flowers. The agent has access to sensitive data, can communicate on our behalf and make decisions. We have no guarantee that it will stick to its tasks. Prompt injection – the targeted injection of instructions via manipulated content – can turn a helpful assistant into an accomplice in the blink of an eye, causing damage as an attacker’s extended arm.

These security issues cannot be ignored. Instead of FOMO, we should be guided by conscious deliberation. Which use cases justify a security risk? Where can agents be deployed in such a way that errors remain correctable? What damage are we prepared to accept? None of these questions is easy to answer, and our hopes can quickly be dashed. It will take considerable effort in both research and practice to reconcile the potential and security of agent-based AI. Yet responsible progress also means utilising technology when we have mastered it — and not when we fear missing out on it.

March 2026

Agentic AI refers to systems that autonomously pursue goals and, in doing so, are capable not only of answering individual queries but also of independently planning, prioritising and executing actions. Unlike traditional AI models, which react to inputs, agent-based systems are designed to be capable of taking action.

However, this autonomy significantly increases the attack surface. Traditional AI risks include disinformation, distorted or malicious outputs, and data leaks. Agentic AI adds a crucial dimension: the ability to execute actions. If such systems are embedded, for example, in financial systems, code repositories, cloud platforms, critical infrastructure, military environments or messaging applications, a compromised agent can cause serious damage, including physical consequences. An agent can deploy code, alter configurations, disrupt services, exfiltrate data or initiate transactions – discreetly and on a large scale.

In traditional AI systems, manipulation typically affects the current data processing: a compromised facial recognition system produces incorrect results, whilst a manipulated intrusion detection model fails to detect attacks. An agentic system, on the other hand, is itself an actor in the digital space. If such an agent is compromised, it can act independently, for example by a compromised calendar agent being misused for coordinated phishing campaigns or automatically attacking third-party websites. The compromise thus not only affects the integrity of a model, but creates a new, autonomous attack node within the network.

Manipulating an agent’s context or long-term memory can cause it to pursue adversarial objectives whilst appearing to be compliant with the rules on the surface. Every connected tool or API increases the risk. Persistent memory further exacerbates the problem: Hallucinated content can be stored as ‘facts’ and distort future decisions, whilst covert attack instructions remain in the system and can be activated later.

Autonomous code generation and execution exacerbate traditional software vulnerabilities. When carrying out their tasks, agents may prioritise their predefined objectives over stability and security. Code generated at runtime may contain serious security vulnerabilities that spread rapidly due to the speed of the machines. In multi-agent environments, complex interactions can trigger emerging behavioural patterns, cascade effects or adversarial feedback loops that are difficult to predict or control.

At the same time, if developed responsibly, Agentic AI can significantly strengthen defences. A frequently cited scenario from industrial IoT security is: what happens if an alarm is triggered whilst the administrator is asleep? Agentic AI not only enables attacks to be detected in real time, but also allows immediate countermeasures to be initiated. A security agent can automatically close ports, isolate or shut down vulnerable services, and quarantine compromised systems. This creates an active, adaptive defence layer that operates at machine speed and drastically reduces the time between detection and response.

This dual-use dynamic makes security-by-design absolutely essential. Strict privilege management, strong isolation and clearly defined operational boundaries are essential, particularly in security-critical areas.

The future of agentic AI therefore depends on resilient architectures. Authentication, authorisation, logging and isolation must be fundamental components. The enforcement of the principle of least privilege, sandboxing, transparent logging mechanisms and runtime monitoring are indispensable. Hardware-based trust anchors and cryptographic attestation can further safeguard the integrity of execution.

However, the current market landscape often favours tools that prioritise high autonomy, frequently at the expense of security. In some frameworks, agents are granted far-reaching privileges, including root access to workstations, email accounts or even crypto wallets, to enable maximum functionality with minimal user interaction.

Agentic AI embodies the transition from reactive tools to proactive actors. Its potential is transformative, as are its risks. Trustworthiness must scale with autonomy. The future will belong not to the most powerful agents, but to the safest and most responsible ones. Ultimately, we must prevent agentic AI from mutating into dystopian AI.

March 2026

Agentic AI refers to a class of artificial intelligence systems capable of independently pursuing goals, planning actions and making decisions in order to carry out complex tasks with limited human intervention. This development is underpinned in particular by advances in large language models (LLMs), which are increasingly being integrated with external tools, software environments and data sources. This enables agentic systems, for example, to research information, generate software code, analyse data or coordinate complex digital workflows.

A key feature of modern agent-based systems is that, in addition to a language model, they possess explicit memory structures and an internal state. Whilst classical language models are primarily based on static context windows, a memory allows for the storage, structuring and reuse of relevant information over extended periods of time. An agent’s internal state can contain information about past interactions, intermediate decisions, goals or context, and serves as the basis for consistent action across many interaction steps. In this way, agent-based systems can handle tasks that extend over longer periods of time and require numerous intermediate steps.

Closely linked to this capability is the increasing personalisation of agent-based systems. By drawing on stored interactions, preferences and contextual information, agents can tailor their decisions and actions to individual users, organisations or specific application scenarios. Personalised agent-based systems can, for example, take working habits into account, handle recurring tasks more efficiently, or adapt decision-making processes more closely to individual requirements. As a result, agentic AI is increasingly evolving from a generic assistance system into a long-term learning digital agent that continuously builds up knowledge about its environment and its users.

In research and practice, two fundamental architectural approaches can be distinguished. In so-called single-agent systems, a single agent handles both the planning and execution of tasks. This approach is relatively easy to control, but reaches its limits when dealing with complex problems involving many parallel subtasks. In contrast, multi-agent systems adopt a division-of-labour approach, in which several specialised agents interact with one another. Individual agents can take on different roles, such as planning, information gathering, evaluation or execution. This cooperation allows complex problems to be tackled more efficiently. At the same time, new challenges arise regarding coordination, communication and the consistency of decisions.

The strategic importance of these technologies is growing rapidly on an international scale. International technology companies are currently investing heavily in agentic AI systems, as they are regarded as a key component of future digital infrastructures. Agentic AI has the potential to automate complex digital processes, support knowledge work and enable new forms of collaboration between humans and AI systems.

In addition to industrial applications, agentic systems can also make a significant contribution to the modernisation and streamlining of public administration. By automating administrative processes, enabling the structured analysis of large volumes of documents, or assisting with the processing of standardised enquiries, administrative staff can be relieved of time-consuming routine tasks. At the same time, agentic systems can help to process information more efficiently, support decision-making processes, and improve the quality and speed of public services.

At the same time, scientific research into agent-based architectures is becoming increasingly important. Current work is investigating, amongst other things, adaptive memory systems, structured knowledge representations and learning mechanisms that enable the long-term improvement of agent-based systems. One example of this is the Memory-R1 approach, in which large language models use reinforcement learning to learn how to manage external memory dynamically. In this approach, a specialised ‘memory manager’ decides which information should be stored, updated or discarded, whilst another agent selects relevant entries from memory for the current problem-solving task. Such approaches demonstrate how adaptive memory structures enable long-term context processing and thus represent a key prerequisite for high-performance agent-based systems.

This is why universities and research institutions have a key role to play. They must develop the scientific foundations for agent-based systems, explore new methods and architectures, and, at the same time, train the next generation of specialists. This includes, in particular, degree programmes in the fields of artificial intelligence, autonomous systems and multi-agent technologies, as well as the expansion of relevant academic chairs and research programmes.

To make the most of this technological development, targeted policy and institutional measures are required. These include, in particular, long-term research programmes in the field of agentic AI, the expansion of interdisciplinary research centres, and closer integration between basic research and industrial applications. At the same time, universities should expand their educational programmes in the field of artificial intelligence and autonomous systems to meet the growing demand for highly qualified specialists.

Furthermore, agentic AI is of considerable importance for Europe’s technological sovereignty. Given the heavy investment by international technology conglomerates, it is crucial that Europe builds up its own expertise in the development, evaluation and application of agentic systems. A strong research landscape, open innovation ecosystems and close cooperation between academia, industry and the public sector are key prerequisites for actively shaping technological development whilst ensuring societal values such as transparency, security and accountability.

In the long term, agentic AI thus represents not only a field of technological innovation, but also a strategic issue for the future for business, academia and public institutions.

March 2026