cyberscoop.comadvisory

CAREFUL ADOPTION OF AGENTIC AI SERVICES FINAL

A joint guidance document from ASD's ACSC, US CISA/NSA, the Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK on securely adopting LLM-based agentic AI systems. It details agentic-specific risk categories — privilege compromise and scope creep, identity spoofing/agent impersonation, confused-deputy attacks, insecure static permission checks, goal misalignment/specification gaming, and deceptive or emergent agent behaviour — with concrete scenarios (a procurement agent with excessive privileges, a support-triage agent with a compromised third-party scheduling component, an update agent tricked into deleting firewall logs). It closes with lifecycle best practices for designing, developing, deploying and operating agents securely, plus recommendations on threat-intel sharing and agent-specific evaluations.