If you've shipped an AI agent to production in the last year, you've probably already felt the gap between "this works in the demo" and "this is safe to run unsupervised." Agentic AI systems that plan, call tools, and take actions with minimal human input breaks a lot of assumptions that traditional app security is built on. Here are five mistakes developers keep making, and what to do instead. 1. Treating the agent's credentials like a service account It's tempting to give you...