The UK National Cyber Security Centre (NCSC) has urged organizations deploying autonomous AI agents to use sandboxing, human oversight and tightly controlled access to limit the impact of unintended or malicious activity.
The agency has published interim practical advice for organizations building or operating agentic AI systems, following several incidents involving AI models carrying out unsanctioned or unintended activity. The NCSC said formal guidance is still being developed and will eventually supersede the blog post published on August 20.
The advice follows earlier NCSC guidance on securing agentic AI use and comes as organizations continue to develop governance frameworks for increasingly autonomous systems.
Sandboxing Limits Agent Access
The NCSC recommended firms first assess how much autonomy a system actually needs and to identify what could go wrong before deployment. Organizations should threat-model the agent's prompts, tools, networks and accessible services, then use the results to determine which additional controls are required.
The agency said organizations should not rely solely on safeguards built into an underlying model or agent framework, as these controls can be bypassed or prove insufficient in higher-risk environments.
For higher-risk deployments, the NCSC recommended running agents in robust sandboxes and restricting access to only the resources required for a task.
The guidance calls for network controls that deny connectivity by default where possible, alongside allowlists or service-aware proxies for required connections.
The agency also advised separating agent execution, supporting infrastructure and inference services where possible. It warned that agents can potentially discover configuration weaknesses or vulnerabilities in their technical controls, creating a risk of sandbox escape.
Oversight and Credentials Need Clear Boundaries
The NCSC recommended each agent should be assigned a distinct identity and its should be limited credentials to those required for the task, with short-lived credentials to be used where possible. It said organizations should consider API keys, OAuth grants, SSH keys and authenticated sessions as part of an agent's potential “blast radius”.
Organizations should also maintain human oversight for higher-risk activity, with named responsibility for agent operations, real-time monitoring and the ability to intervene when unexpected behavior occurs.
Read more on agentic AI security: OWASP Introduces Agentic AI Security Maturity Framework
The NCSC said agent activity should be logged and monitored as part of security operations and incident response. It also advised organizations to ensure they can immediately halt autonomous activity, including restricting network access and communications with model infrastructure when necessary.
The agency said the advice should evolve alongside the technology and that organizations should regularly reassess whether the autonomy granted to agents remains proportionate to their risk tolerance.