Guides pratiques pour vous protéger — vous, votre famille et votre entreprise — contre les arnaques liées à l'IA, les deepfakes et les nouvelles menaces cyber.
On April 30, 2026, the United States, the United Kingdom, Canada, Australia, and New Zealand — the Five Eyes intelligence partnership — published their first coordinated security guidance specifically focused on agentic AI. Careful Adoption of Agentic Artificial Intelligence Services is signed by CISA, NSA, the UK's NCSC, the Canadian Centre for Cyber Security, New Zealand's NCSC, and Australia's ASD ACSC. The combined message is unusually direct: agentic AI is too dangerous to deploy at speed, and the most common failure mode is giving the agent more access than its job actually requires.
If your organization is staging an agentic deployment this quarter, this is the document your CISO will use to push back.
The 21-page guide carves agentic AI risk into five categories — privilege, design and configuration, behavioral, structural, and accountability — and treats each as a distinct architectural concern with distinct mitigations. The text is plain and operational, not aspirational. The full guidance is hosted by CISA.
The recommended posture, repeated in different forms across the document: begin with low-risk, low-sensitivity use cases, hold agent autonomy below the level of irreversible action, and treat every agent identity as a workload requiring its own scoped credentials and audit trail.
This is the first joint agentic AI security publication from the Five Eyes coalition. Whatever your jurisdiction, a request from your auditor, your insurance carrier, or your board to align with this document is now possible — and the document has named, specific controls that are easy to map to. Forrester has already published an operationalization framework for it. Critical infrastructure operators in the United States and the United Kingdom should expect direct supervisory questions about which of the five risk categories they have mitigations for.
The shift in tone matters too. Previous government AI guidance leaned toward principles. This one names failure modes — privilege creep, reward hacking, identity spoofing, agent impersonation — and tells you what to build against each. That makes it usable as an engineering checklist, not just a policy artifact.
The Five Eyes coalition rarely publishes coordinated security guidance on a single technology. When it does, the guidance becomes the baseline that auditors, regulators, and insurers reach for inside twelve months. Read it before someone else reads it back to you, and start with the privilege boundaries on the agents you have already shipped.


