The word that changed the model
"Agentic" is doing a lot of work in current threat discussions, sometimes more than it should. This post tries to separate what the term usefully describes from the hype around it, and to explain why researchers working on Personalized Cognitive Pressure now treat autonomous agents as the most consequential new variable in the stack.
The short version: agentic systems did not make PCP more effective. They made the architecture of PCP — the closed loop — buildable in a way it was not before. That distinction matters, because it tells defenders what to prepare for (an adaptive system) without assuming a result (reliable control of decisions) that has not been demonstrated.
What "agentic" actually means here
For the PCP context, the relevant definition is narrow: an agentic system is one that can pursue a goal over multiple steps, across multiple interactions, with some degree of autonomous decision-making about what to do next — without a human approving every action.
Two features matter most for cognitive pressure:
- ▸Persistent memory. The system remembers prior interactions with a specific user and adapts to them over time. This is what moves an interaction from broadcast toward relationship. A system that forgets you between sessions cannot build the continuity that adaptive pressure requires.
- ▸Autonomous action selection. The system chooses its next move — what to say, when, through which channel — based on its own assessment of progress toward a goal. This is what closes the loop without a human in the middle.
Neither implies consciousness, general intelligence or guaranteed effectiveness. They imply persistence and initiative, which are exactly the properties that make a closed-loop influence system conceivable. A system that is persistent and initiative-taking but unreliable is still a different kind of object than a static campaign, because it can iterate.
Why this is the new variable
The PCP closed loop has six stages: observe, model, generate, expose, measure, adapt. Through 2024, most of these could be done, but they were done by humans or by brittle pipelines that broke across steps. The "adapt" stage in particular — taking measured reactions and updating the approach — was largely manual. A human read the metrics, decided what to change, and wrote the next message. The loop closed, but slowly, and with a human bottleneck at every cycle.
Agentic systems change this in two ways:
- ▸They can close the loop without a human in the middle. An agent that observes a reaction, decides the message changed, generates a new one and sends it is doing the observe-to-adapt cycle autonomously. The loop closes at machine speed rather than human speed, which changes the tempo of adaptation. A target who pushes back can be re-approached with a revised message in minutes, not days.
- ▸They can maintain continuity across sessions. Persistent memory means the system does not reset between interactions. It accumulates context about the target the way a human handler would, not the way a one-shot campaign does. Over time, the system's model of the target improves, and the pressure becomes more tailored without any single message being obviously tailored.
This is why "agentic" is not just a buzzword for PCP researchers. It is the property that turns a collection of capabilities into a system. Without persistence and initiative, you have tools. With them, you have a process.
What the evidence does and does not show
Precision matters here, because the gap between capability and demonstration is the whole question:
- ▸Agentic AI systems exist and are deployed. Autonomous agents that plan, use tools and maintain memory are real and in production for benign tasks — coding assistants, research agents, customer-support agents. The capability to pursue a goal over multiple steps without per-action approval is not speculative.
- ▸Agentic influence systems are not publicly documented. There is no public evidence of an autonomous agent reliably conducting a closed-loop influence operation against a specific real target to a specific decision. The integration is conceivable; the demonstration is not. Documented influence operations still involve humans at several stages.
- ▸Effectiveness is unproven. Even where agents interact with humans persuasively in limited settings, translating that to reliable control of a consequential decision is not established. An agent that holds a helpful conversation is not the same as an agent that reliably moves a decision.
The gap is between "the capability to build such a system" (real) and "a demonstrated system achieving its influence goal" (not shown). That gap is the entire research question, and it should not be collapsed in either direction.
The risks that precede effectiveness
Even an ineffective autonomous influence system creates problems worth taking seriously, because some risks follow from the attempt rather than the success:
- ▸Scale and persistence. A system that runs 24/7, in many languages, against many targets, changes the volume of influence attempts even if any single attempt is weak. Volume has systemic effects: it raises the noise floor of the information environment and depletes the attention available for verification.
- ▸Attribution difficulty. An autonomous agent operating through synthetic personas is harder to attribute to a sponsor than a human-run campaign. The intermediary between sponsor and action is a machine, and machines do not have the investigative footprint that human operators do.
- ▸Escalation dynamics. If multiple actors deploy adaptive influence agents, the information environment becomes an adaptive adversarial system — a kind of arms race in which human attention is the contested resource. Each agent adapts not only to its target but to the other agents, producing dynamics no single actor controls.
- ▸Tempo asymmetry. A system that adapts in minutes outpaces a human review loop that operates in hours or days. This is the speed asymmetry that makes detection, not just prevention, the central defensive problem.
These risks do not require the system to "work" in the strong sense. They follow from the attempt, and they are reasons to prepare before effectiveness is demonstrated.
The defensive reframe
If the threat model is an adaptive closed loop, the defense cannot be a static checklist. It has to be adaptive too:
- ▸Detect the loop, not just the content. A single synthetic message is detectable by content analysis. A persistent, adapting interaction pattern across channels requires behavioral detection — looking for the pattern of adaptation, not just a bad artifact. The signature is that the messaging changes in response to the target's reactions, which is visible only when you correlate over time.
- ▸Protect the decision timing. Because PCP targets decisions, the highest-value defense is around the decision itself: verification protocols, cooling-off periods, independent confirmation for high-consequence choices. Slowing the decision near the moment reduces the value of last-minute pressure more than any content filter would.
- ▸Assume persistence. Defenders should treat a suspicious interaction as potentially part of a longer campaign, not an isolated event. Memory works for the defender too — logging and correlating across time is essential, and an interaction that looks innocuous in isolation may be incriminating in sequence.
- ▸Match tempo where possible. Human review loops lose to machine-speed adaptation. Detection at the signal layer must be as automated as possible, with humans at the judgment layer rather than the triage layer.
The human-in-the-loop question
It is worth pushing back on one assumption: that the threat requires full autonomy. It does not. Many of the properties that make agentic systems consequential — persistence, initiative, machine-speed adaptation — are present even when a human approves the occasional action. A system that adapts autonomously 95% of the time and escalates only the hard 5% to a human is still a closed loop for practical purposes, and it is harder to detect and attribute than a fully manual campaign. The defender should therefore not calibrate to the science-fiction case of a fully autonomous influence agent operating without any human oversight; the realistic case is a mostly-autonomous system with humans at the margins, which retains most of the tempo advantage and most of the attribution difficulty. The threat is the architecture of the loop, not the absence of humans from it, and defenses designed only for the fully autonomous case will miss the realistic one.
Bottom line
Agentic AI did not make Personalized Cognitive Pressure real. It made the architecture of PCP — the closed loop — buildable in a way it was not before, by giving the loop persistence and initiative at machine speed. The system has not been demonstrated; the building blocks have, and the building blocks are deployed for benign purposes. For defenders, that is the right level of concern: take the architecture seriously, build the adaptive defense, and do not wait for a public demonstration to start — because the worst time to build adaptive defenses is after an adaptive adversary is already in the field.