Agentic AI in Telecoms: Security Will Determine How Far We Can Take Autonomy

I believe in the potential of Agentic AI and Multi-Agent Systems (MAS) to transform telecommunications. The opportunities are enormous, particularly in network operations, service assurance, security operations and the evolution towards autonomous networks.

But I have a concern that I believe deserves much more attention from the industry.

Are we giving enough consideration to the security implications of agentic systems before we start deploying them at scale?

For me, security is not simply another consideration in the adoption of AI. It is fundamental to making agentic systems viable, particularly in an industry responsible for critical communications infrastructure.

Why agents are different

There is a fundamental difference between traditional software and autonomous AI agents. Agents interpret information, make decisions, interact with other systems, use tools and increasingly execute actions without direct human intervention. Their behaviour is probabilistic, influenced by context, information and interactions with other agents. We cannot always predict precisely how they will behave or what decisions they will make.

Now consider what happens when multiple agents work together.

Imagine an agent identifying a network issue, another analysing the problem, a third recommending a solution and a fourth implementing a configuration change. This is precisely the sort of capability that could make autonomous network operations a reality.

But what happens if the first agent has been compromised? What if the information it passes to the other agents has been manipulated? What if the execution agent acts on a recommendation that is technically valid but operationally dangerous?

A chain of seemingly legitimate decisions could result in a significant network incident.

This is why I believe we need to look beyond conventional AI security and rethink how we establish trust across multi-agent environments.

Pause animation

(opens the full-size diagram in a new tab)

Identity alone does not solve the problem

One area that particularly concerns me is identity.

There is growing discussion around the need to give every AI agent its own identity. I completely agree. However, identity alone does not solve the problem.

Knowing which agent is making a request does not mean that the agent should be permitted to carry it out.

We need to know:

• who created the agent
• on whose behalf it is operating
• what authority has been delegated to it
• what it is attempting to do
• whether that specific action is legitimate

And this becomes even more complicated when one agent delegates work to another. How do we maintain the original authority and permissions throughout that chain? Can an agent inadvertently or deliberately extend its privileges through another agent? How do we establish trust between agents belonging to different organisations or operating across different security domains?

I believe this is one of the most important gaps in current agentic security thinking.

We need to move beyond simply authenticating agents towards establishing verifiable identity, delegated authority and trust at every level of the agent ecosystem.

What this means for CSPs

For Communications Service Providers (CSPs), the implications are particularly significant.

Our networks support financial services, healthcare, emergency services, governments and businesses. Agents will increasingly interact with OSS/BSS, network orchestration, service provisioning, customer systems and security platforms.

The consequences of a compromised or poorly governed agent could extend well beyond an individual application or data breach.

Imagine an agent with privileged access to network configuration systems making an inappropriate change. A compromised security agent suppressing a critical alert. Or a chain of agents inadvertently exposing customer information because permissions and delegated authority have not been properly controlled.

These are not risks we should be trying to address after deployment.

Rethinking security for the agentic era

I believe CSPs need to rethink security for the agentic era.

• Every agent should have its own verifiable identity.
• Permissions must be explicitly delegated, tightly scoped and revocable.
• Agents should not automatically trust other agents.
• Their interactions must be authenticated, and their actions must be monitored.

Most importantly, consequential actions should be checked against independent security policies before execution.

There is a distinction here that I think is fundamental: an AI agent can recommend what should happen, but it should never be the ultimate authority on whether it is permitted to do it.

The security architecture must operate independently of the probabilistic reasoning of the AI model.

This is particularly important when we start giving agents greater autonomy over critical network functions.

Of course, requiring human approval for every action is not the answer either. That would undermine the very efficiency and agility that agentic AI promises. We need risk-based autonomy, allowing low-risk activities to happen independently while ensuring that actions affecting critical infrastructure are subject to much stronger controls.

A commercial opportunity for CSPs

There is also a much bigger opportunity here for the telecommunications industry.

CSPs have spent decades developing trusted connectivity, authentication and identity capabilities. As businesses and consumers increasingly rely on autonomous agents, who will establish the identity and trustworthiness of those agents when they interact across organisations?

Could CSPs become providers of trusted agent identity, authentication, delegated authority and secure agent-to-agent communications?

I think this is a genuinely interesting commercial opportunity. The ability to establish trust between autonomous systems could become an important part of the digital services ecosystem.

But we need to demonstrate that we can secure our own agentic environments first.

There is encouraging work emerging from organisations such as NIST, TM Forum, ETSI, GSMA and ITU. The industry is beginning to recognise that agentic systems require new approaches to identity, authorisation, delegation and security.

However, translating these principles into robust, operational security architectures for telecommunications is still a significant challenge.

Security will determine how far we can take autonomy

My concern is that we could become so focused on the speed of agentic adoption and the operational efficiencies of autonomous networks that we underestimate the security implications.

I would argue that security will ultimately determine how far we can take autonomy.

We should not just be asking how quickly we can make our networks autonomous. We should be asking how securely we can make them autonomous.

For me, identity, trust and security are not features to be added to agentic systems. They are fundamental design principles that must be embedded from the outset, across every agent, every interaction and every action.

Without them, greater autonomy could become a strategic liability rather than the competitive advantage we are all hoping to achieve.

A question for CSP leaders

I’d be interested in the views of CSP leaders, particularly CTOs, CIOs and CISOs.

Are we giving agentic identity, delegated authority and multi-agent security the attention they deserve, or are we moving too quickly towards autonomy?

Further reading and research

For those interested in exploring the subject further, I would recommend looking at the following work:

1. NIST – Agentic AI and Identity (2026): The emerging thinking on agent identity, authentication, delegated authority and enterprise IAM.
2. NIST NCCoE – Identity and Authorization of Software Agents (2026): Practical approaches to agent identification, authorisation and accountability.
3. TM Forum GB1087 – Agentic Interaction Security in Telecommunications (2026): Particularly relevant to agent interactions across telecommunications domains.
4. TM Forum IG1463 – Security Considerations for Agentic AI in Autonomous Networks: Telecommunications-specific security considerations for agentic architectures.
5. Google Research – Securing Multi-Agent Systems (2026): Research into multi-agent security, prompt hardening and residual attack risks.
6. ETSI – AI in the Evolution of Autonomous Networks: The security implications of increasing network autonomy.
7. GSMA Intelligence – Identity for AI Agents (2026): The potential role of operators in the emerging agent identity ecosystem.
8. ITU – Trust and Identity for Humans and Agentic AI (2026): The international standards direction for trusted interactions between humans and autonomous agents.

These provide a useful starting point for a much wider discussion about how we build secure and trustworthy autonomous networks.