Putting AI agents to work safely: what the NCSC now advises

What happened

On 20 August 2026, the National Cyber Security Centre (NCSC) published “Managing the cyber risk of agentic AI”, a blog by one of its principal security architects.¹ It is aimed at the people designing and operating environments in which AI agents have significant autonomy, from tools that suggest actions to agents that act on live systems with little human involvement.

The NCSC presents this as interim advice. It says it is working with partners to “develop formal guidance which will build upon, and ultimately supersede, this blog.”¹

Why it matters

Most organisations’ experience of AI so far has been with assistants that answer questions. Agents are different: they take actions, use tools and access systems. That changes the risk. As the NCSC puts it, agents “may interpret instructions and goals in literal or unexpected ways”, and the more autonomy they have, the greater the impact if one “accesses information it should not” or acts outside its intended scope.¹

Two points in the advice deserve particular attention from leaders.

Model safeguards are not enough. The NCSC is clear that the protections built into AI models can be bypassed and should not be relied on alone. Careful prompting is also insufficient on its own; it needs to be combined with technical and operational controls.¹

You must be able to stop it. The advice is blunt: “you should always be able to ‘pull the plug’,” including, if necessary, by cutting network access to the agent’s infrastructure.¹

What the NCSC recommends

The blog sets out a practical sequence:¹

1. Assess autonomy, and match controls to how much freedom the agent has and how much risk you will tolerate.
2. Threat model the agent, identify how it could fail, and define “red lines” it must not cross.
3. Layer safeguards, such as classifiers and deterministic checks, wherever the consequences of failure exceed your tolerance.
4. Choose the right oversight model, from a human approving each action to a human monitoring, and combine human oversight with technically enforced controls for high-risk uses.
5. Sandbox agents, with network access denied by default and allowed only where needed.
6. Limit credentials: a unique identity for each agent, minimal permissions and short-lived access.
7. Observe and log agent activity, protect the logs from tampering, and monitor it as part of security operations.
8. Make agent activity attributable, so others can recognise traffic from your agents.
9. Plan an emergency shutdown you can trigger quickly.

What to do now

1. Find your agents. Ask for an inventory of every AI system in your organisation, or in your suppliers’ services, that can take actions rather than only make suggestions.
2. Agree the red lines. For each one, decide what it must never do, who can approve exceptions, and how quickly it can be stopped.
3. Test the off switch. Ask your team to show you, not tell you, how an agent would be halted, and how long it would take.

Questions for your leadership team

1. Which of our AI systems can already act on our systems or data without a human approving each step?
2. If one of them did something we did not intend, how would we find out, and how quickly could we stop it?
3. Are our suppliers deploying agents inside the services we rely on, and what controls have they told us about?

This briefing summarises the sources listed above, with analysis by the editor. Read the original sources before acting on it.