Cybersecurity traditionally defines an attack surface as the collection of places through which a system can be compromised. Agentic AI introduces another kind: an epistemic attack surface. This consists of the information, context, memory, sources, representations, and communications that shape what an AI system believes about the environment in which it operates.
An attacker may not need to modify code or penetrate infrastructure if they can alter the information from which an autonomous system reasons. Manipulated documents, poisoned memory, deceptive tool outputs, compromised retrieval sources, fabricated identities, or instructions embedded in otherwise legitimate information may change the system's understanding of what is happening and therefore change what it chooses to do.
The significance of this problem grows with autonomy. A manipulated piece of information presented to a chatbot may produce a bad answer. The same information presented to an agent with access to tools and authority may produce a consequential action. Epistemic security therefore becomes part of operational security.
Protecting agentic systems requires asking not only whether the infrastructure is secure, but whether the system's picture of the world can be trusted. What information entered its reasoning? Where did it originate? Has it been independently corroborated? Can external information alter internal instructions or memory? The epistemic attack surface begins wherever information can change behaviour.