Agents can accumulate excessive privileges. They can be manipulated through design flaws or prompt injections.