UK NCSC urges caution with autonomous AI agents

The UK National Cyber Security Centre (NCSC) has issued urgent guidance for organizations deploying autonomous AI agents, emphasizing the need for robust security measures to mitigate risks, according to Infosecurity magazine.

The NCSC recommends critical security practices such as sandboxing, human oversight, and tightly controlled access for AI agents. This advice comes after several incidents where AI models exhibited unsanctioned or unintended behaviors.

Organizations are urged to assess the necessary autonomy of AI systems, perform threat modeling on prompts and tools, and not solely rely on built-in safeguards. For higher-risk applications, running agents in secure sandboxes with restricted access to essential resources is advised. Network controls should deny connectivity by default, with allowlists for necessary connections. Each agent should have a distinct identity and limited, short-lived credentials.

Human oversight is crucial for high-risk activities, including real-time monitoring and the ability to intervene. Comprehensive logging and immediate halt capabilities are also essential. The NCSC stresses that this guidance will evolve with the technology, requiring regular reassessment of agent autonomy against risk tolerance.

Source: Infosecurity Magazine

Written by

Kelley Damore Chief Content Officer CyberRisk Alliance

Kelley Damore is Chief Content Officer at CyberRisk Alliance, where she leads content strategy across the company’s digital brands, research, communities and live events serving CISOs and security practitioners. At CyberRisk Alliance, she is focused on delivering 365-day engagement, trusted journalism and actionable insights to help security leaders navigate an increasingly complex threat landscape.