There are two documents. Engaging with artificial intelligence came from the ASD's Australian Cyber Security Centre in January 2024, covers using AI securely, and says your AI needs the same controls as everything else, starting with the Essential Eight. Careful adoption of agentic AI services landed on 1 May 2026, written with CISA, the NSA and agencies from the UK, Canada and New Zealand, and covers AI that takes actions. If you are running agents, the second one is yours, and its bottom line is blunt: assume they will behave unexpectedly.

Which one is written for you

The two documents have different audiences, and it is worth checking which you are.

The 2024 paper is marked for small and medium business as well as large organisations and government. It assumes AI systems that receive an input and return an output. If you are configuring AI inside HubSpot, Microsoft or Google, this is your document.

The 2026 paper is marked for large organisations, infrastructure and government. Do not let that put you off if you run a 90 person business with agents in production. The audience label reflects where the authoring agencies started, not where the risk lives. The content is about systems that act on your behalf, and a support triage agent with a CRM token has the same shape of problem whether you are a bank or not.

Most businesses need both. The 2024 questions are your baseline. The 2026 risks are what you add the moment anything you run stops answering and starts doing.

The 2024 baseline: five threats and twelve questions

The older paper names five threats, each with a real case study, which is more useful than the abstract lists that dominate this topic.

Data poisoning, manipulating training data so a model learns wrong patterns, illustrated with Microsoft's Tay chatbot in 2016. Input manipulation, meaning prompt injection and adversarial examples, illustrated with the "Do Anything Now" jailbreak. Hallucinations, with the 2023 Southern District of New York legal filing found to contain at least six fabricated cases. Privacy and intellectual property, what your people paste in and where it ends up. And model stealing, including prompting a model into revealing memorised training data.

Its practical core is a set of questions. Condensed into something you can run this week:

# The question The smallest real answer
1 Have you implemented the cyber frameworks for your jurisdiction? Essential Eight in place, applied to the AI system too
2 How does it affect privacy and data protection obligations? Know the processing location, whether inputs retrain the model, and what happens to your data when the contract ends
3 Do you enforce multi-factor authentication? Phishing resistant MFA, FIDO2 keys, including on training data repositories
4 How do you manage privileged access? Least privilege, and a countable number of accounts with production access
5 How do you manage backups? Backups of the model and the training data, not just the app
6 Can you trial it first? A trial that tests how it sits with your existing security tooling
7 Is it secure by design, including its supply chain? Vendor transparency about development and testing
8 Do you understand its limits and constraints? Someone can state what it cannot do, in writing
9 Do you have suitably qualified staff? Staff trained on what data must never go in
10 Do you run health checks? Periodic checks for data drift and intended behaviour
11 Do you enforce logging and monitoring? Inputs, outputs, network, endpoints and repository logins, against a known baseline
12 What will you do when something goes wrong? An incident response plan that names AI systems

Two of those are unusually specific and almost nobody does them. Number 11 includes watching for high frequency, repetitive prompts, which the guidance flags as a sign of an automated prompt injection attack. That is a detection rule you can implement this month and it is rarely in anyone's SIEM. Number 5 asks for backups of the model and its training data, where most organisations back up the application and treat the model as the vendor's problem.

Where the Essential Eight actually fits

Worth being precise, because "apply the Essential Eight to AI" gets repeated without much thought.

The Essential Eight are the most effective subset of ASD's broader Strategies to Mitigate Cyber Security Incidents, designed to protect internet connected IT networks. ASD's position across both documents is consistent: treat AI security inside your existing cyber security framework rather than as a separate discipline, because AI systems are IT systems.

So the Essential Eight is the floor. Patching, application control, MFA, restricting admin privileges and backups all apply to the infrastructure your AI runs on and the accounts that reach it. None of them address prompt injection, goal misalignment or an over-privileged agent, because they were never meant to.

If someone tells you your AI is secure because you are at Essential Eight maturity level two, they have answered a different question.

What changes when AI starts taking actions

The 2026 guidance defines agentic AI as systems built from one or more agents that use a model to interpret the state of the world, make decisions and take actions, intended to run without continuous human intervention. Some can spawn their own sub-agents.

The security consequences it sets out fall into five groups, and they are a better checklist than anything else published in Australia right now.

Privilege risks. The guidance calls strict least privilege critical, and describes privilege compromise and scope creep, where an agent accumulates more access than it needs. Its scenario is an organisation that grants a procurement agent broad access to financial systems, email and contract repositories to reduce friction. Also identity spoofing, where an actor impersonates an agent or steals its credentials, since agents authenticate to services and to each other with keys and tokens.

Design and configuration risks. Unvetted third party components carrying excessive privileges into agent workflows. Static permission checks that do not hold as behaviour changes.

Behaviour risks. Goal misalignment, where an agent finds a shortcut that technically meets its objective and creates a vulnerability doing it. Over-optimisation driving unsafe actions when boundaries are not enforced. Deceptive behaviour, including agents that misrepresent what they did. And the line most worth quoting to anyone who thinks a passing test suite settles the matter: agents may change their behaviour when evaluations are underway. That is the exact problem our pre-launch agent testing is built around.

Structural risks. Tool use, where two way integrations let a tool send content back into the model. Third party components, including "squatting", where malicious tools or agents are published under legitimate-looking names. Rogue agents in multi-agent systems causing cascading failures. Insecure agent to agent communication. This is the layer we wrote about in what MCP changes for your CRM, and every hop is a trust boundary.

Accountability risks. Agent actions are opaque and hard to trace, which gets worse when agents initiate secondary tasks. The scenario is several agents collaborating to approve a payment, and an incorrect outcome nobody can attribute.

Note where prompt injection has moved. The 2024 paper describes it as something typed into a prompt. The 2026 paper describes malicious prompts inside phishing emails aimed at an email-monitoring agent. Nobody typed anything. That is the live version of the attack and it is why retrieved content has to be treated as hostile.

The sentence to take away

The 2026 guidance closes by saying that until security practices, evaluation methods and standards mature, organisations should assume agentic AI systems may behave unexpectedly, and should plan deployments prioritising resilience, reversibility and risk containment over efficiency gain.

Read that again if you are being sold an agent on the time it will save. Australia's cyber security agency, jointly with the NSA and CISA, is telling you to trade efficiency for the ability to undo things. That is a defensible position to take into a board conversation.

What we do on client builds

  • Essential Eight first. If MFA and privileged access are not sorted, AI threat modelling is premature.
  • Scope tokens per task. The narrowest credential that does the job, read-only wherever writing is not required. This is the highest value control we apply, and it is the first thing the 2026 guidance calls critical.
  • Retrieved content is untrusted. Anything the system pulls in gets handled as hostile by default, because that is where injection arrives now.
  • Reversibility before autonomy. Anything an agent does should be undoable, and we build the undo before we widen the permissions.
  • Log inputs and outputs, and read them. Including the watch for repetitive high frequency prompts, which the 2024 guidance hands you for free.
  • Name AI systems in the incident response plan. Wrong output is an incident. A plan that only covers outages does not cover the likeliest failure.

The short version

Read both documents. The 2024 one is short, free and written for businesses your size, and its twelve questions are a reasonable audit. Get the Essential Eight underneath, and understand it is a floor that says nothing about AI specific attacks.

Then, if anything you run takes actions rather than just answering, the 1 May 2026 agentic guidance is the current Australian position and almost nobody in the market has read it. Its priorities are least privilege, treating retrieved content as hostile, and building for reversibility before you build for speed.

Frequently asked questions

Is the ACSC guidance mandatory? No. Both documents are guidance. The Essential Eight is mandatory for non-corporate Commonwealth entities and is widely required by contract in the private sector, which is a different route to the same place.

Does Essential Eight compliance mean our AI is secure? No. The Essential Eight protects the infrastructure and accounts around the system. It does not address prompt injection, data poisoning, goal misalignment or over-privileged agents.

Has Australia published guidance on AI agents specifically? Yes. Careful adoption of agentic AI services was published on 1 May 2026 by the ASD's ACSC with CISA, the NSA and agencies from the UK, Canada and New Zealand. It is marked for large organisations and government, but the risks it describes apply to any business running agents.

What is the one control that matters most? For anything that takes actions, least privilege on the credential it holds. It limits the damage of every other failure on the list, it is entirely within your control regardless of what your vendor does, and it is the control the 2026 guidance puts first.

Sources

 

Most AI security problems we are called into are permission problems wearing a costume. If you are not sure what your agents are authorised to do, give us a shout and tell us what's broken.