The intelligence and cybersecurity agencies of the U.S., Australia, Canada, New Zealand and the U.K. have released new guidance on securing agentic artificial intelligence systems used in critical infrastructure and defense environments.
The latest guidance highlights the growing cybersecurity risks tied to agentic AI. As agencies emphasize governance, oversight and continuous risk assessment, these priorities are expected to shape ongoing discussions across the defense and critical infrastructure sectors. Save your seat now for the 2026 Cyber Summit, which will explore the role of AI in cyber defense, post-quantum cryptography, zero trust and other cyber priorities.
What Are the Security Risks of Agentic AI?
The National Security Agency said Thursday the cybersecurity information sheet titled “Careful Adoption of Agentic AI Services” outlines several risks associated with the use of agentic AI.
- Privilege risks
- Design and configuration risks
- Behavior risks
- Structural risks
- Accountability risks
NSA noted that agentic AI systems also inherit risks associated with large language models and contribute to an evolving cybersecurity landscape.
What Are the Best Practices for Securing Agentic AI Tools?
The document outlines best practices across multiple phases of the AI lifecycle:
- Designing secure agents
- Developing secure agents
- Managing third-party components
- Deploying agents securely
- Operating agents securely
According to the guidance, organizations should deploy agentic AI incrementally and continuously assess systems against evolving threat models. The document also highlighted the need for strong governance, rigorous monitoring, explicit accountability and human oversight.
How Does the Guidance Build on Prior AI Cybersecurity Efforts?
The new guidance follows earlier federal and allied efforts to address AI security risks across critical systems.
In 2025, the Cybersecurity and Infrastructure Security Agency and its allied partners issued guidance for critical infrastructure operators deploying AI in operational technology systems.
In a separate cybersecurity information sheet, NSA and international partners also outlined best practices for securing data across the AI lifecycle.
