The Canadian Centre for Cyber Security just co-signed a warning about agentic AI. So did CISA, the NSA, the UK NCSC, and their counterparts in Australia and New Zealand.
On May 1st, all five nations of the Five Eyes alliance jointly published Careful Adoption of Agentic AI Services, a 30-page guidance document on securing agentic AI systems. It's the first time these agencies have issued coordinated policy on a single AI attack surface, and the signal is hard to miss: agentic AI security has moved from an emerging research topic to a national security concern. If you're deploying agents this year, this one's worth your attention.
What the guidance covers
The document groups agentic AI risk into five buckets: privilege escalation, design and configuration failures, behavioral misalignment, structural brittleness, and accountability gaps. If you've been following this space, none of those will surprise you. What's significant is that governments are now saying it out loud, formally, in a coordinated multinational document.
The agencies are also clear that agentic AI doesn't require a whole new security discipline. Their recommendation is to fold these systems into the frameworks you already have, using zero trust, defense in depth, and least privilege. Extend what exists, intentionally, before the agents are running.
The gap between that advice and reality is wide right now. Current research shows 63% of organizations can't enforce purpose limits on their agents, and 60% can't terminate one that misbehaves. Those numbers landing alongside a Five Eyes guidance document says a lot about where we are.
For critical infrastructure, the timing is hard to ignore
Last month a Dragos report documented the first confirmed AI-assisted attack on a municipal water utility, where an adversary used a commercial AI model to navigate SCADA segmentation boundaries on its own. The threat isn't theoretical anymore.
The good news is that the controls the Five Eyes guidance recommends are the same ones we've been writing about for the past month. Least privilege identities. Behavioral monitoring. Audit trails that hold up. Scope boundaries defined before deployment, not after.