On May 1, the cybersecurity agencies of all five Five Eyes nations — Australia, the United States, the United Kingdom, Canada, and New Zealand — published joint guidance telling organisations exactly how to deploy autonomous AI agents without blowing open their security posture. The document, titled Careful Adoption of Agentic AI Services, is the first coordinated government framework specifically targeting the risks of agentic AI — systems that can plan, decide, and act without a human reviewing every step.
This isn't abstract policy. It's a practical response to a real problem: businesses are deploying AI agents faster than they're securing them. According to Gravitee's State of AI Agent Security 2026 report, 88% of organisations have already experienced a confirmed or suspected AI agent security incident — yet 82% of executives believe their existing policies are sufficient. The gap between confidence and reality is where the damage happens.
What the guidance actually says
The document, co-authored by CISA, the NSA, and the Australian Signals Directorate's Australian Cyber Security Centre (ASD ACSC) alongside their Canadian, New Zealand, and UK counterparts, identifies five broad categories of risk unique to agentic AI.
Privilege risks come first — and for good reason. When an AI agent is granted broad access to systems, a single compromise can cascade far beyond what a typical software vulnerability would cause. The guidance is blunt: never grant agents "broad or unrestricted access, especially to sensitive data or critical systems."
Design and configuration flaws are the second category — poor setup creating security gaps before a system even goes live. Third is behavioural risk: agents pursuing goals in ways their designers never intended. Fourth, structural risk, where interconnected networks of agents can trigger failures that spread across an organisation's systems. And fifth, accountability — agentic systems make decisions through processes that are difficult to inspect and generate logs that are hard to parse.
As CyberScoop reported, the agencies note that when these systems fail, "the consequences can be concrete: altered files, changed access controls and deleted audit trails."
The prompt injection problem nobody has solved
The guidance flags prompt injection — where malicious instructions embedded in data hijack an agent's behaviour — as a particularly stubborn vulnerability. This aligns with what we covered in our earlier analysis of OWASP's agentic AI security framework, which ranked prompt injection as the number-one threat to autonomous AI systems.
The issue is structural: agents need to read external data to be useful, but that data can contain instructions the agent will follow. Some companies have admitted the problem may never be fully solved. The guidance's practical recommendation is layered defence — input validation, output monitoring, and human approval for high-impact actions where "the cost of error is high, such as system resets, network egress or deletion of critical records."
Why this matters more in Australia
The timing of this guidance is particularly pointed for Australian businesses. Deloitte's 2026 State of AI in the Enterprise report found that 69% of Australian organisations are now using autonomous AI agents — but only 22% have advanced governance models in place to manage them. That's a 47-percentage-point gap between adoption and oversight.
This echoes a pattern we've been tracking. KPMG's AI Pulse survey found that while Australian businesses lead on responsible AI intent, they rank last among surveyed nations on AI-driven productivity gains. The governance aspiration exists; the execution doesn't.
"CISA is committed to supporting the US's adoption of AI that includes ensuring it aligns with President Trump's Cyber Strategy for America and is cyber secure," said CISA Acting Director Nick Andersen. "We actively collaborate with government and international partners on shared priorities with AI advancements while addressing cybersecurity challenges and risks."
The Australian dimension goes further. With new Privacy Act amendments requiring AI transparency by December 2026, and APRA already pressing financial institutions on AI governance, the Five Eyes guidance adds a cybersecurity layer on top of the regulatory compliance burden. Businesses deploying AI agents now need to satisfy three overlapping frameworks: privacy law, industry-specific regulation, and this new international cybersecurity standard.
What to actually do with this
The guidance's central message is reassuring in one important way: you don't need an entirely new security discipline. Agentic AI should fold into the cybersecurity frameworks and governance structures you already maintain. Zero trust, defence-in-depth, and least-privilege access all apply.
Here's the practical checklist the guidance recommends:
- Start small. Begin with low-risk, non-sensitive use cases. Don't hand an AI agent the keys to your CRM, finance system, and email on day one.
- Enforce least privilege. Every agent should have the minimum access required for its specific task, with short-lived credentials and encrypted communications.
- Require human sign-off for high-impact actions. System designers — not the agent itself — should determine which actions need human approval.
- Give agents verified identities. Each agent should carry cryptographically secured credentials, not shared API keys. (Gravitee's report found only 21.9% of organisations treat AI agents as independent identity entities.)
- Monitor continuously. Red-team your agents. Verify third-party components. Log everything and make sure those logs are actually parseable.
What to watch
This guidance is explicitly a first step. The agencies acknowledge that security practices haven't caught up with agentic AI, and they're calling for more research and collaboration. Expect follow-up documents with more specific technical controls as the field matures.
The more immediate question is whether Australian regulators will reference this guidance in enforcement. The ASD co-authored it, which gives it weight. If APRA or the OAIC start pointing to this document as a baseline expectation — the way they've adopted the Essential Eight for broader cybersecurity — then "we didn't know" stops being a defensible position for any business running AI agents.
For the 69% of Australian businesses already using autonomous agents, the grace period for figuring out governance just got shorter.
Sources
- Careful Adoption of Agentic AI Services — CISA
- CISA, US and International Partners Release Guide to Secure Adoption of Agentic AI — CISA Press Release
- US government, allies publish guidance on how to safely deploy AI agents — CyberScoop
- US and allies urge 'careful adoption' of AI agents — Cybersecurity Dive
- State of AI Agent Security 2026 Report — Gravitee
- Australian organisations lag global peers in realising AI's transformational potential — Deloitte Australia
