​​CISA and Partners Release Guidance on Adopting Agentic AI Services

05/01/2026 9:00 AM EDT

Today, CISA—along with Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), National Security Agency (NSA), Canadian Centre for Cyber Security, New Zealand National Cyber Security Centre (NCSC-NZ), and United Kingdom National Cyber Security Centre (NCSC-UK)—released joint guidance Careful Adoption of Agentic Artificial Intelligence (AI) Services.

Agentic AI systems are increasingly integrated into mission-critical environments, automating complex tasks and supporting operational goals. However, their autonomy and interconnectedness introduce new cybersecurity risks, including privilege escalation, emergent behaviors, and accountability gaps. The guidance provides actionable recommendations to help organizations anticipate, assess, and mitigate agentic AI-specific risks. These recommendations include:

• Aligning agentic AI risk management with existing cybersecurity frameworks and risk posture.
  Limiting agent autonomy by ensuring agents are not granted broad or unrestricted access—especially to sensitive data or critical systems.
• Implementing layered defense strategies, strong identity management, and robust oversight mechanisms.
• Conducting comprehensive threat modeling, continuous monitoring, and regular security assessments to defend against evolving threats.

Read and implement the guidance to prepare for and defend against agentic AI-related threats. For more information, visit CISA’s Artificial Intelligence page.