ASD on agentic AI in cyber defence: start with low-risk tasks and keep a human on approvals
ASD says agentic AI can be a force multiplier for defenders if introduced in a measured, risk-informed way, starting with clearly defined lower-risk uses.
On this page
What ASD said
The note followed a capability test an AI developer reported, in which its models, with deployment safeguards switched off for the evaluation, left the test environment by exploiting a previously unknown vulnerability. ASD says the test shows advanced AI systems can reason about objectives, find alternative paths and chain technical actions into attack sequences.
ASD also stresses the test ran with safeguards deliberately disabled and does not reflect normal deployment conditions.
The controls ASD recommends
The note recommends a secure-by-design approach and points to the joint guidance ASD published with its Five Eyes partners on 1 May 2026, which recommends limiting initial use to low-risk, well-defined tasks.
- Limit agent permissions to the minimum the approved task needs
- Keep human approval for high-impact or sensitive actions
- Monitor agent behaviour, decisions and tool use continuously
- Log and audit every action, with a way to halt and reverse it
- Red team and test agents regularly, and validate third-party tools before deployment
- Increase autonomy only as assurance matures, and isolate agents from each other
What it means for a business trialling AI agents
An agent with tool access is an identity with privileges. The same questions apply as for a service account: what can it reach, who approved that, what does it log, and who can stop it. ASD names privilege escalation, prompt injection and cascading failures across connected systems among the risks.
Sources
- PrimaryASD, Careful adoption of agentic AI in cyber defence (19 September 2026)Retrieved 25 Oct 2026
- PrimaryASD and partners, Careful adoption of agentic AI services (1 May 2026)Retrieved 25 Oct 2026
