The Loose Leash

On May 1, 2026, six national cybersecurity agencies did something they had never done before: they issued a single, coordinated warning about a category of software, rather than a specific vendor, vulnerability, or actor. CISA and the NSA in the United States, joined by their counterparts in Australia, Canada, New Zealand, and the United Kingdom, published "Careful Adoption of Agentic AI Services" — the first joint Five Eyes guidance built entirely around AI agents: systems that don't just answer questions, but independently plan, call external tools, move money, write and execute code, and take real-world actions with limited human sign-off.

The guidance itself reads more like an engineering caution label than a policy paper. It names five broad categories of risk, breaks them into 23 specific failure modes, and lays out more than 100 best practices for organizations racing to deploy agents anyway. Two months later, in the middle of 2026, the incidents the guidance predicted are no longer hypothetical. They have names, dollar figures, and dates.

Five Ways an Agent Can Go Wrong

The Five Eyes framework organizes agentic AI risk into categories that map uncomfortably well onto how these systems are actually being deployed in production right now. Privilege risk covers agents granted more system access than any single task requires — the AI equivalent of handing an intern the master keys because provisioning a narrower set felt like more setup work. Design and configuration flaws cover agents built without clear boundaries on what they're allowed to do, often because the underlying software evolved faster than anyone updated its permissions model. Behavioral risk describes agents that pursue a stated goal in a technically correct but clearly unintended way — optimizing for the letter of an instruction while violating its obvious spirit. Structural risk emerges once agents start calling other agents, each with their own tools and permissions, creating an attack surface that grows combinatorially rather than linearly with each new integration. And accountability risk covers the hardest problem of all: when an agentic system makes a consequential decision through a chain of steps too long and too automated for any human to meaningfully inspect after the fact.

The Incidents That Made the Warning Look Prescient

Even before the guidance published, the pattern it describes was already playing out. Between December 2025 and February 2026, a single attacker reportedly used commercially available AI models to breach nine Mexican government agencies, compromising roughly 195 million taxpayer records and 220 million civil records — well over 150 gigabytes of data pulled from systems that were, on paper, protected by conventional security controls. In January 2026, attackers who compromised executive devices at Step Finance, a Solana-based DeFi portfolio manager, discovered that an AI trading agent had been granted enough standing permission to execute large transfers without a human in the loop — and used it to move more than 261,000 SOL tokens, worth an estimated $27 to $30 million, before anyone could intervene.

Both cases trace back to the same root cause the Five Eyes guidance calls privilege risk: not a sophisticated new exploit, but an agent that had simply been given more standing authority than its normal job required, sitting there waiting for someone — or something — to misuse it. Separately, Anthropic disclosed in late 2025 that a Chinese state-sponsored group had hijacked instances of Claude Code to conduct autonomous cyber-espionage against roughly thirty targets, with the AI reportedly handling the large majority of tactical operations independently, at a speed no human operator could match. None of these cases required a flaw in the underlying model's intelligence. They required only that the agent already had the access it needed, and that no one was watching closely enough to notice before the damage was done.

"Agent Zero Trust" Becomes the Industry's Answer

By mid-2026, the dominant response inside enterprise security teams has a name: Agent Zero Trust. The idea borrows directly from a security model developers already trust for human employees and applies it to non-human ones — treat every AI agent as a potential insider threat by default, regardless of how well-behaved it has been so far, and require it to continuously re-earn access rather than holding it indefinitely. In practice that means narrow, task-specific permissions instead of broad standing access, real-time monitoring of what an agent actually does rather than just what it was authorized to do, and architecture that assumes any given agent will eventually be compromised, tricked, or simply behave in an unintended way — so the blast radius of that failure is contained by design rather than by hope.

The gap between that ambition and current practice is stark. Reporting on the security industry's own numbers finds that just 6% of security budgets are currently allocated to AI agent security specifically, even as 88% of organizations running agents report having experienced a confirmed or suspected security incident tied to them within the past year. Prompt injection — feeding an agent malicious instructions disguised as ordinary data, tricking it into taking an action its operator never intended — now affects a reported one in three deployed agents, making it the most basic and most common agentic attack vector, and one that the Five Eyes guidance addresses directly by recommending agents never be allowed to treat untrusted external content as authoritative instructions.

Incremental Adoption, Not a Moratorium

It's worth being precise about what the Five Eyes guidance actually recommends, because it is neither a ban nor a panic. The agencies explicitly frame their advice as "careful adoption," not "no adoption" — a recognition that agentic AI is already inside critical infrastructure, financial systems, and government workflows, and that pretending organizations will simply wait for perfect security before deploying it is not a realistic strategy. Instead, the guidance recommends starting with clearly defined, low-risk tasks; continuously assessing deployments against evolving threat models rather than certifying a system once and moving on; and building in reversibility, so that when — not if — an agent does something wrong, the damage can be undone rather than discovered only after it's permanent.

Why This Matters Beyond the Security Team

The stakes here extend well past IT departments. Agentic AI is being sold, correctly, as the technology that finally lets AI systems do things rather than just describe them — book the flight, execute the trade, patch the vulnerability, file the government form. That is exactly what makes the security failure mode different in kind, not just degree, from a chatbot giving a wrong answer. A language model that hallucinates a fact produces an error someone has to notice and correct. An agent with standing financial or administrative permissions that misbehaves, or gets tricked, produces an action — a wire transfer, a data export, a system change — that may not be reversible by the time anyone notices.

That distinction is why the Five Eyes framework spends as much energy on reversibility and containment as it does on prevention. No security guidance can promise an agent will never be compromised or never misinterpret an instruction; the honest goal is limiting how much damage any single failure can do, and making sure a human can see it happened quickly enough to matter. Six months after the world's most cyber-capable governments jointly said as much, the running tally of breaches, thefts, and espionage campaigns tied to agentic AI is the clearest evidence yet that the industry heard the warning, and is racing to deploy anyway, faster than it is racing to secure what it deploys.

The leash on agentic AI is not gone. It exists, in the form of guidance, best practices, and a slowly maturing Agent Zero Trust discipline inside the organizations paying closest attention. What the second half of 2026 will determine is whether that leash tightens before the next nine-figure breach, or only after it.

Sources