On 1 May 2026, cybersecurity agencies from the United States, Australia, Canada, New Zealand and the United Kingdom jointly published guidance urging organisations to treat autonomous artificial intelligence systems as a core cybersecurity concern. The document, reported by CyberScoop, warns that agentic AI is already being deployed in critical infrastructure and defence sectors with insufficient safeguards.
For any business leader weighing up what to do about AI at work, the timing matters. Agentic AI is no longer a research curiosity. It is software built on large language models that can plan, make decisions and take actions autonomously. To function, it connects to external tools, databases, memory stores and automated workflows, executing multi-step tasks without human review at each stage. That is precisely what makes it useful — and what makes it dangerous.
Refer & earn: 30% of a client’s first month, then 10% of every month after that, for up to 24 months per client. See the partner programme →
Who wrote this, and why it matters
The guidance was co-authored by the U.S. Cybersecurity and Infrastructure Security Agency, the National Security Agency, the Australian Signals Directorate’s Australian Cyber Security Centre, the Canadian Centre for Cyber Security, New Zealand’s National Cyber Security Centre and the United Kingdom’s National Cyber Security Centre. When five national cyber defence bodies put their names to one document, it is not a thought experiment. It is a signal that the threat is real and the clock is running.
The central message is pragmatic rather than alarmist: agentic AI does not require an entirely new security discipline. Organisations should fold these systems into the cybersecurity frameworks and governance structures they already maintain, applying established principles such as zero trust, defence-in-depth and least-privilege access. If your business already has a security framework, the guidance says, extend it. Do not bolt on a separate AI governance silo that nobody owns.
The five risk categories, translated for business
The document identifies five broad categories of risk. Each has a direct operational consequence.
Privilege. When agents are granted too much access, a single compromise can cause far more damage than a typical software vulnerability. An agent with broad permissions is not just a tool; it is a potential insider threat if hijacked. The fix is least-privilege access — give the agent only what it needs for the task at hand.
Design and configuration flaws. Poor setup creates security gaps before a system even goes live. This is the risk that lives in the procurement and deployment phase, not the incident response phase. It is cheaper to fix here.
Behavioural risks. Agents can pursue a goal in ways their designers never intended or predicted. This is not malice; it is the nature of systems that plan. A business that deploys an agent to optimise a process may find it optimising in a direction nobody sanctioned.
Structural risk. Interconnected networks of agents can trigger failures that spread across an organisation’s systems. One agent’s mistake becomes another agent’s input, and the error propagates. This is a systems-design problem, not a model problem.
Accountability. Agentic systems make decisions through processes that are difficult to inspect and generate logs that are hard to parse. When something goes wrong, tracing what happened and why is hard. The agencies note that when these systems fail, the consequences can be concrete: altered files, changed access controls and deleted audit trails. For a regulated business, that is not just an IT headache; it is a compliance and legal exposure.
Prompt injection: the known unknown
The guidance flags prompt injection, where instructions embedded inside data can hijack an agent’s behaviour to perform malicious tasks. This has been a lingering problem with large language models, with some companies admitting that the problem may never be solved. For a business reader, the implication is uncomfortable: you cannot assume a vendor has eliminated this class of attack. You have to design around it.
Identity, credentials and the human sign-off
Identity management gets significant attention throughout the document. The agencies recommend that each agent carry a verified, cryptographically secured identity, use short-lived credentials and encrypt all communications with other agents and services. For high-impact actions, a human should have to sign off. The guidance is explicit that deciding which actions require that approval is a job for system designers, not the agent.
That last point deserves emphasis. It is not enough to say “a human is in the loop.” The loop must be defined by the people accountable for the outcome, before deployment. If you let the agent decide when it needs permission, you have not solved the accountability problem; you have automated it.
The honest admission
The agencies admit the security field has not fully caught up with agentic AI. Some risks unique to these systems are not yet covered by existing frameworks, and the guidance calls for more research and collaboration as the technology takes on a growing number of operational roles.
The document’s closing advice is worth quoting in full: “Until security practices, evaluation methods and standards mature, organisations should assume that agentic AI systems may behave unexpectedly and plan deployments accordingly, prioritising resilience, reversibility and risk containment over efficiency gains.”
That is a direct challenge to the usual business case for AI, which often rests on efficiency gains. The guidance says: not yet. Prioritise resilience, reversibility and risk containment. In plain terms, prefer deployments you can undo, contain and recover from over deployments that are merely faster.
What a business should actually do
If you are deciding what to do about AI at work, the guidance suggests a sequence.
- Inventory your agents. You cannot secure what you have not catalogued. Include any system that plans and acts autonomously, even if it is embedded in a vendor product.
- Map privileges. For each agent, ask what it can access and whether that access is strictly necessary. Apply least-privilege access.
- Define high-impact actions. Decide, as a business, which actions require human sign-off. Write it down. Assign accountability.
- Extend existing frameworks. Do not invent a parallel AI security programme. Fold agentic AI into your current zero trust, defence-in-depth and governance structures.
- Plan for reversibility. Assume the agent may behave unexpectedly. Design deployments so you can roll back, contain damage and recover audit trails.
- Demand identity and encryption. Require verified, cryptographically secured identities, short-lived credentials and encrypted communications between agents and services.
None of this is exotic. It is the same discipline that mature organisations already apply to privileged users and third-party software. The novelty is that the “user” may be a planning system that acts at machine speed.
The bottom line for business readers
The Five Eyes guidance is not a ban on agentic AI. It is a warning against deploying it casually. The agencies are telling organisations that the technology is already in critical infrastructure and defence with insufficient safeguards — and that the rest of us should learn from that, not repeat it.
For a business, the practical takeaway is to slow down the procurement conversation long enough to answer the security questions. The efficiency gains are real, but the guidance is explicit that they should not come first. Resilience, reversibility and risk containment should.
Faida Workforce advises organisations on workforce and technology deployment, including AI governance. We have no role in the guidance described here, and we disclose our commercial interest so you can weigh our perspective accordingly. Our recommendation is the same as the agencies’: treat agentic AI as a core cybersecurity concern, not a productivity shortcut.
This article was produced with the assistance of AI tools. A human editor is accountable for its content.
Sources
30% of their first month, then 10% every month after that
Refer a business to Faida Workforce and you earn 30% of the client’s first paid month, then 10% of every month for up to 24 months per client — rising to 15% from the accrual after you pass 10 active clients. Paid by PayPal, batched on the 1st.
10 Pro clients = $2,598.70 over 24 months — $3,748.13 at the 15% tier.
Figures are potential earnings worked from the published rates, assuming every referred client pays for the whole cap — not a promise, not an average. The $1 trial is never commissionable.
