On 1 May, CISA, the NSA, Australia's ASD Cyber Security Centre, the Canadian Centre for Cyber Security, New Zealand's NCSC and the UK's NCSC jointly published Careful Adoption of Agentic AI Services, a 30-page document marking the first time all five Five Eyes nations have issued coordinated guidance on a single AI attack surface. It arrives as agentic systems, tools that can plan, browse, execute code and take action with limited human involvement, move from pilot projects into the kind of production workflows that touch real data and real infrastructure. Coverage from Mayer Brown and Industrial Cyber both flag the same headline detail: the guidance is explicit that it "does not carry the force of law." Nobody is required to implement a single recommendation in it.
What the document actually contains is worth more attention than that caveat suggests. It organises agentic AI risk into five categories - privilege risk, where agents granted overly broad access can cause disproportionate damage before a human notices; design and configuration risk, from weak authentication and poor integration scoping; behavioural risk, where an agent pursues its assigned goal through a method nobody intended; structural risk, where one compromised agent in a multi-agent system propagates bad output downstream; and accountability risk, where a probabilistic reasoning chain is hard to inspect after the fact, and deleted or altered logs are often the first sign anything went wrong at all. Anyone who has read our coverage of Hugging Face's agentic breach or the Cursor DuneSlide flaws will recognise every one of these categories from a real incident, not a hypothetical.
"The most persistent and difficult-to-fix threat"
The guidance's language on prompt injection is unusually blunt for a government document. It describes prompt injection as the most persistent and difficult-to-fix threat facing agentic systems, and explains why in plain terms: large language models cannot reliably distinguish a legitimate system instruction from an adversarial one buried inside a document, email or web page the agent is asked to process. That's precisely the mechanism behind DuneSlide and behind Hugging Face's agent-driven breach, and behind a growing list of incidents where the attacker never touched a credential at all, they just wrote a sentence the agent trusted.
The recommended defence is layered rather than a single control: architectural separation of planning from execution, so an agent that decides what to do isn't the same component with permission to do it; anomaly detection on agent behaviour; and, for anything with real consequence, mandatory human approval before the action executes. The guidance is specific that this last point is not a policy statement to bolt on later. Which actions require human review, it says, is a decision that belongs to system designers and should be architecturally enforced, not left as a checkbox a business user can override under deadline pressure.
Voluntary guidance, live consequences
HiddenLayer's 2026 AI Threat Landscape Report, published in March and based on a survey of 250 IT and security leaders, found that one in eight reported AI security breaches is now linked to agentic systems, and that 31% of organisations could not say with confidence whether they had experienced an AI-related breach in the past year at all. Put those two facts next to a piece of guidance that explicitly disclaims legal force, and the sensible response isn't relief. Voluntary frameworks from exactly this set of agencies have a well-established habit of becoming the baseline regulators, auditors and enterprise customers measure against once something goes wrong, whether or not the word "mandatory" ever attaches to them. We saw the same pattern with cloud security benchmarks a decade ago: guidance first, expectation shortly after, enforcement eventually.
For enterprises already navigating EU AI Act enforcement, which hands the European Commission live supervision and enforcement powers over general-purpose AI providers from 2 August, and a US federal landscape where a June discussion draft for a Great American AI Act is still being fought over in Congress rather than settled into law, this guidance is one of the only concrete, technically detailed reference points currently available for how agentic AI is actually meant to be secured. Waiting for a binding standard to arrive before building these controls is a bet that the next agentic AI incident happens to someone else first.
- Map every agentic AI deployment in your environment against the guidance's five risk categories - privilege, design/configuration, behavioural, structural and accountability - rather than treating "agentic AI risk" as one undifferentiated concern.
- Architecturally separate an agent's planning and reasoning step from its execution permissions, so a manipulated plan cannot directly trigger a high-impact action.
- Define which action classes require mandatory human approval at the design stage, and enforce that requirement in code, not in a policy document a deadline can override.
- Build anomaly detection for agent behaviour specifically, since the guidance and recent incidents alike show that unusual action sequences, not stolen credentials, are often the first and only signal of compromise.
- Treat log integrity for agentic systems as a control in its own right - the guidance flags altered or deleted audit trails as frequently the first evidence an incident occurred.
This is the second piece of once-voluntary agentic AI guidance we've tracked this year turn out to matter more than its non-binding status implied, after the MCP governance patterns enterprises adopted well ahead of any formal mandate. The organisations that come out ahead tend to be the ones that read documents like this as a design spec rather than a compliance footnote. If you're building or scaling an agentic AI deployment and want help mapping it against this framework before a regulator or an incident does it for you, email sales@halfteck.com.