Loading story…
The UK National Cyber Security Centre (NCSC) has issued interim guidance warning organizations to tightly constrain agentic AI systems after incidents in which AI models carried out unintended or unsanctioned actions. The agency said deployments should grant only the minimum autonomy required, use human oversight, and avoid depending solely on built-in model safety features. It urged teams to threat-model agent behavior, understand model safeguards and failure modes, and design response plans before autonomous systems are put into production.
The guidance recommends layered technical controls, including robust sandboxing, strict separation between agent execution and supporting infrastructure, default-deny network access, least-privilege credentials, and distinct identities for each agent. NCSC also called for comprehensive logging and monitoring, clear attribution of AI-originated activity, named human accountability, and an emergency capability to immediately stop autonomous operations. The agency described the advice as an interim measure based on ongoing research, with more formal guidance in development alongside partners.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
On 20 August 2026, the UK National Cyber Security Centre published a blog post with interim practical advice for organizations building or operating agentic AI systems. The guidance urges measures such as limiting autonomy, threat modelling, sandboxing, human oversight, strict credential scoping, monitoring, and emergency shutdown capability, while noting that more formal guidance is still being developed.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK National Cyber Security Centre warned that agentic AI gives attackers an inherent advantage: offensive tasks tend to have technical, measurable objectives, while defensive actions must account for business continuity, governance, risk appetite, and accountability. The NCSC advised organizations to prioritize low-risk AI uses—including summarization, threat-intelligence analysis, and detection support—and to tightly bound automation rather than allow unrestricted autonomous remediation. It recommends evaluating automations for potency, scope, criticality, rollout confidence, and recoverability; NCSC and DCMS are also developing the national-scale **Cyber Shield** agentic cyber-defence ecosystem. Defensive AI must meet much higher reliability thresholds because erroneous actions such as isolating endpoints, killing processes, disabling accounts, or blocking connections can disrupt production without an active intrusion. Microsoft’s automatic attack disruption model reportedly uses incident-level correlation, at least **99% precision** for containment decisions, reversible actions, and exclusions for critical assets; Google SecOps similarly combines adaptive agents with deterministic playbook steps for sensitive operations. Organizations should retain conventional security controls and reserve production-changing AI actions for cases with demonstrably low risk, clear rollback paths, and explicit human control.
Sep 21, 2026
The UK National Cyber Security Centre (NCSC) warned that “shadow AI”—employees using AI tools outside approved organisational systems—can expose sensitive corporate, proprietary and customer data while depriving security teams of visibility and control. Citing Microsoft research, it said **71% of UK employees** have used AI tools not approved by their employer; information submitted to consumer AI services may be retained, stored or used to improve those services, creating breach, intellectual-property and regulatory-compliance risks. The NCSC also cautioned that vulnerable, poorly governed or compromised AI agents could provide attackers with access to the data, services and privileges available to those agents. It advised organisations to reduce rather than expect to eliminate shadow-AI use by fostering open communication, understanding employee requirements, establishing secure-use guardrails, offering usable approved alternatives, and carefully governing agentic AI integrations.
Sep 8, 2026
Security guidance published across multiple outlets warns that **LLM output and agent behavior must be treated as untrusted** throughout the full application pipeline, not just at the model layer. One report details how identity, authorization, context assembly, templating, tokenization, inference, decoding, parsing, policy checks, and downstream actions can each introduce risk, and says incident response should preserve artifacts such as serialized prompts, truncation decisions, model and tokenizer identifiers, decoding settings, parser results, policy decisions, and executed actions. It also highlights prompt-injection scenarios in which attacker-controlled retrieved content can steer a model toward sensitive actions if application controls are weak. Separate guidance for generative UI systems says applications should enforce a strict validation boundary with schema checks, render only approved components from a controlled registry, and route any real-world action through an application-owned action registry with authorization and server-side enforcement. In parallel, the open-source **Hazmat** project aims to contain AI coding agents by isolating them under a separate local account, restricting readable and writable paths, network access, and service access so agents cannot reach secrets such as SSH keys or cloud credentials outside the project workspace. Together, the reports reflect a broader shift toward **execution control, evidence preservation, and sandboxing** as core defenses for AI-enabled applications and coding agents.
Aug 18, 2026