Joint Guidance From Six Agencies Says Agentic AI System Processes Can Outpace Human Monitoring Capability

Six government agencies co-authored Careful adoption of agentic AI services: the Australian Signals Directorate's Australian Cyber Security Centre, the United States Cybersecurity and Infrastructure Security Agency and National Security Agency, the Canadian Centre for Cyber Security, New Zealand's National Cyber Security Centre and the United Kingdom's National Cyber Security Centre. New Zealand's page for the guidance gives its published date as May 1, 2026. The guidance "primarily focuses on large language model (LLM)-based agentic AI systems." Parts of it follow, not the whole.

What an Agent Is, and Where to Use One

The agencies describe agentic AI systems as composed of one or more agents that fundamentally rely on an AI model, such as an LLM, to interpret and reason about the state of the world, make decisions and take actions. Such systems "are intended to operate without continuous human intervention," and some can create sub-agents to accomplish specific sub-tasks.

The agencies recommend adopting agentic AI with security in mind and never granting it broad or unrestricted access, especially to sensitive data or critical systems. Organizations, they say, "should only use agentic AI for low-risk and non-sensitive tasks."

Some of the Risks the Guidance Names

Under accountability risks, the guidance says agent actions and decision-making processes "can be opaque, making agentic AI systems difficult to understand, monitor and audit." Agents may initiate secondary tasks, spawn sub-agents or follow extended delegation chains "in ways that are not always visible to operators."

Language models, the guidance says, may "hallucinate" plausible-sounding responses when their internal knowledge is insufficient, and that grounded and tool-enabled agents may still rely on that internal knowledge to inform responses. "The system often does not clearly identify this in its output, reducing overall accuracy and reliability."

"Agentic system processes can outpace human monitoring capability, possibly leading to unnoticed malicious behaviour, uncaught hallucinations or other issues," the guidance says under visibility. Tools that perform actions for an agentic system "may operate outside of the system's monitoring boundary, making it difficult to account for tool actions," and malfunctioning tools "could also unintentionally leak data, which may go unnoticed."

The guidance also gives scenario examples. In one, a malicious actor compromises a low-risk tool in a procurement agent's workflow and inherits the agent's excessive privileges. "By executing actions under a trusted agent identity, the system produces audit logs that appear legitimate and delay detection." In another, tightly coupled planning, retrieval and execution agents delegate tasks and select tools without strong validation or guardrails, and a small orchestration flaw increases tool calls and message traffic "until system resources are strained." "Partial failures then lead agents to hallucinated outputs that downstream agents accept as true."

In the procurement scenario the logs appear legitimate. A check that reads only those logs would see nothing wrong.

Some Recommended Practices, and the State of Evaluation

For operating agents, the agencies' recommended practices include monitoring all agent operations, including internal processes, not just the inputs and outputs. They recommend anomaly detection mechanisms that "flag discrepancies between stated intentions and observed behaviours," and "multiple independent monitoring systems that cross-validate agent reports and system logs." Agent outputs, the guidance says, provide "some of the few concrete data points available for monitoring behaviour," and it recommends validating them "by confirming accuracy of critical aspects against multiple sources."

The guidance also recommends that decisions about when human approval is required be determined by system designers or operators, not delegated to the agentic AI system, and that organizations "Quarantine requests to delete logs or audit records until reviewed and approved by a human."

Cross-validating agent reports against system logs is a practice aimed at a failure that reports success.

Many existing evaluation methods for agentic AI security, the guidance says, "are still evolving." They may be sensitive to minor semantic changes, vary by scenario and only partially capture real-world deployment conditions. These limitations, it says, can introduce gaps that overlook critical security issues, "making reliable validation of agent security and system architectures nearly impossible."