Five Eyes to Agentic AI: Assume It Will Misbehave

Five Eyes agencies released their first joint guidance on agentic AI, signaling that these systems are already a security concern in real deployments.

The 30-page guide says organizations should expect unexpected behavior and highlights key risks such as privilege abuse, behavioral drift, interconnected systems, and unclear accountability.

It recommends zero-trust-style controls including short-lived credentials, verified identity, encrypted communications, and the ability to reverse or contain actions.

The agencies also warn that current threat catalogs and testing methods are still incomplete for multi-step autonomous systems, with likely implications for procurement and future policy.