Five Eyes Agencies Issue Joint Guidance on Securing Agentic AI in Critical Infrastructure

The cybersecurity and intelligence agencies of the Five Eyes alliance have, for the first time, issued joint security guidance dedicated entirely to agentic AI — the autonomous systems that can plan, reason, call external tools and take real-world actions with limited human supervision. The message to the critical-infrastructure operators rushing to deploy them is blunt: slow down.

Titled "Careful Adoption of Agentic AI Services," the document was co-authored by six national agencies spanning all five member states: the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA), the Australian Signals Directorate's Australian Cyber Security Centre (ASD ACSC), the Canadian Centre for Cyber Security, New Zealand's National Cyber Security Centre and the United Kingdom's NCSC. It is the first coordinated multi-government security guidance aimed specifically at agentic systems, and it lands as agents are already being wired into energy, water, defense and financial networks.

The guidance's central warning is that agentic AI amplifies an organization's existing weaknesses rather than papering over them. Building an agent, the agencies note, requires stitching together many components, tools and external data sources — producing what the document calls an "interconnected attack surface that malicious actors can exploit." Its headline recommendation reads almost as a design philosophy: organizations should "assume that agentic AI systems may behave unexpectedly and plan deployments accordingly, prioritising resilience, reversibility and risk containment over efficiency gains." In practice, that means starting with narrowly scoped, low-risk tasks and expanding only as controls prove out.

The Risks It Flags

The guide organizes its warnings into five categories — privilege, design and configuration, behavioral, structural and accountability — and from those derives 23 distinct risks paired with more than 100 best practices. The privilege category addresses the danger of agents granted too much access; the behavioral category covers agents that pursue goals in unintended ways; and the structural category flags cascading failures across interconnected networks of agents. Accountability captures a subtler hazard: systems that reach decisions through processes too opaque to inspect after the fact.

Prompt injection receives particular attention. The agencies describe it as the most persistent and difficult-to-fix threat facing agentic deployments, cautioning that current defenses remain immature and that no single control is sufficient. Because agents inherit vulnerabilities from their underlying large language models — susceptibility to prompt injection and data poisoning among them — and then extend the attack surface through external tools, memory and integrations, a single manipulated instruction can potentially redirect an agent authorized to act on live systems.

On identity and permissions, the guidance is prescriptive. Developers are urged to construct each agent as a distinct principal — a cryptographically anchored identity with its own unique keys or certificates — rather than letting agents share credentials or inherit sweeping standing access. It recommends short-lived, temporary credentials over long-lived ones and revoking elevated access the moment a task completes. On supply chain, the agencies acknowledge that third-party components and tools boost flexibility but warn they enlarge the attack surface, and they call for verification and management of every external component an agentic application depends on.

Why It Matters

That six agencies across five governments chose to speak with one voice signals a shift: agentic AI security is now being treated as a national-security concern, not merely an enterprise IT problem. CISA Acting Director Nick Andersen framed the release as part of a broader push to ensure U.S. AI adoption is "cyber secure," and encouraged agentic AI developers, vendors and operators to review the guidance. The Five Eyes rarely coordinate public guidance unless a threat is judged systemic across all their economies.

The underlying worry is that agentic AI represents a genuinely new attack surface. Traditional software fails predictably; an agent with tool access, memory and autonomy can be steered into harmful actions by adversarial input, and it can act at machine speed before a human notices. When such a system sits inside a power grid, a hospital network or a defense supply chain, the gap between a clever prompt-injection attack and physical-world consequences narrows sharply. The guidance's insistence on reversibility over efficiency is, in effect, an admission that the industry does not yet know how to make these systems safe by default.

What to Watch

The near-term question is enforcement. This is guidance, not regulation, and critical-infrastructure operators are under commercial pressure to deploy agents quickly. Watch whether individual agencies — or sector regulators — begin folding these expectations into procurement rules and compliance baselines, and whether vendors ship the per-agent cryptographic identity and short-lived credentialing the document demands. Also worth tracking: how prompt-injection defenses mature, given the agencies' candid admission that today's controls are inadequate, and whether follow-on guidance addresses the multi-agent "structural" risks that remain the least understood corner of the field.