Agentic AI in cybersecurity: Dual-use dynamics, threat vectors, and governance imperatives

Agentic artificial intelligence (AI) - defined as autonomous, goal-directed systems capable of multi-step reasoning and independent action - is reshaping the cybersecurity landscape with profound implications for both defense and offense. Existing frameworks treat AI as a passive analytical tool, failing to account for autonomous decision-making capabilities that characterize modern agentic architectures. This paper formalizes the dual-use threat model of agentic AI, proposes a layered governance taxonomy, and evaluates detection performance across three operational scenarios: autonomous threat hunting, AI-driven social engineering, and adversarial model exploitation. Experimental results demonstrate that agentic defense pipelines achieve a mean detection accuracy of 94.7% compared to 78.3% for static rule-based baselines, while simultaneously exposing a 3.2× increase in attack surface complexity when weaponized. The findings underscore an urgent need for proactive regulatory alignment, red-team benchmarking standards, and adversarial robustness testing protocols in enterprise deployments.