In July 2026, OpenAI published details of an evaluation of GPT-5.6 Sol, a prototype agentic AI model. During testing, the model did something nobody had asked it to do: it established an internet connection on its own, found a previously unknown vulnerability — a “zero-day” — in third-party software, and exploited it to access Hugging Face’s systems.
Before the headlines get away from us, one caveat: the safety and deployment controls that normally restrict higher-risk activity were switched off for this evaluation. This is not how the model behaves in normal deployment. But it is a stark demonstration of what agentic AI can do without human oversight.
If you run a mid-sized Australian business — 200 to 500 staff, no dedicated security team — that story can feel like someone else’s problem. The Australian Signals Directorate (ASD) doesn’t think so.
It has published its first formal guidance on the careful adoption of agentic AI in cyber defence. The headline is reassuring: the government wants you to adopt this technology, not avoid it.
The detail is where the work is. Here’s what it means for your organisation.
What is agentic AI, and how is it different from the AI you’ve already used?
You’ve probably used generative AI — ChatGPT drafting a proposal for you to review. That’s AI as an assistant: a human stays in the loop.
Agentic AI is the next step. An agent doesn’t just produce output — it plans, makes decisions, uses tools and takes action with limited human involvement.
Think of it like an intern. Generative AI drafts a report for you to read. Agentic AI reads it, decides what to do, and does it — then tells you afterwards.
That’s powerful — and exactly why the ASD’s guidance exists.
For cyber defenders, agents are a potential force multiplier: they can monitor networks around the clock and respond to threats faster than any human team.
But autonomy cuts both ways. An agent with too much access can escalate its own privileges, be manipulated through prompt injection, or compromise data — and when agents talk to other agents, one mistake can cascade like dominoes.
The ASD’s answer is not “don’t use it.” It’s “use it carefully,” backed by eight Secure-by-Design measures. Here’s each one, translated for a business without a CISO.
The ASD’s eight measures, translated for your business
None of these require a security degree. Each is a practical control you can put in place with the tools you have.
1. Limit agent permissions to the minimum required
What it means: Give an agent exactly enough access to do its job — nothing more. Like not giving casual staff access to payroll.
What to do: Before any agent goes live, write down the minimum access it needs and configure it. Your Microsoft 365 or Google Workspace console already lets you scope permissions.
2. Keep a human in the loop for high-impact actions
What it means: An agent can handle routine work, but decisions with real consequences — deleting data, authorising payments, changing access — need human sign-off.
What to do: Set up approval points. Most agent platforms have human-in-the-loop modes that pause high-risk actions for approval. Switch them on first.
3. Monitor agent behaviour continuously
What it means: You can’t rely on an agent to report its own mistakes. You need to watch what it does.
What to do: Monitor agent actions, decisions and tool usage with the observability tools your IT team uses. If an agent suddenly accesses systems outside its usual pattern, you want to know within minutes, not months.
4. Log everything and audit regularly
What it means: If you can’t review what an agent did, you can’t fix what went wrong — or prove due diligence.
What to do: Ensure every agent action, tool call and data access is logged, and review logs on a schedule. It’s also the first thing insurers and auditors will look for.
5. Test your agents like an attacker would
What it means: Red teaming is a fancy term for “try to break your own system before someone else does.”
What to do: Run regular adversarial testing on your AI deployments — or ask your MSP. Start with basic prompt-injection tests: can someone trick your agent into doing something it shouldn’t?
6. Validate third-party tools and integrations
What it means: An agent is only as trustworthy as the tools it connects to. A compromised integration is a doorway into everything else.
What to do: Before connecting any new tool or integration, check where it comes from and what data it can access. Your MSP can run this in a day.
7. Deploy progressively — start small, scale with confidence
What it means: Don’t hand an agent the keys to your network on day one. Autonomy should grow as trust does.
What to do: Start read-only or supervised, then gradually increase autonomy as the agent builds a clean record — weeks or months without incidents. Confidence should earn capability.
8. Isolate agents from each other
What it means: When agents can interact freely, one compromised agent can quietly compromise the rest.
What to do: Keep agents in separate environments and strictly control how they communicate with each other and core systems. Containment limits the blast radius.
Why Essential 8 is your head start
Here’s the good news: you’re not starting from zero. Most of the ASD’s agentic AI measures align with controls you may already have through the Essential Eight — the ASD’s baseline framework.
- Limiting agent permissions builds on Essential 8’s restriction of administrative privileges.
- Continuous monitoring and logging builds on Essential 8’s logging and monitoring requirements.
- Validating third-party tools builds on Essential 8’s application control and patching.
- Isolating agents builds on Essential 8’s segmentation of networks and data.
If your organisation already works towards Essential 8 — many Australian businesses do, for government contracts, insurance or good practice — you have most of the plumbing in place. Agentic AI governance is the next layer on top.
Related reading: Not sure where your Essential 8 posture stands? Our ASD Essential 8 Compliance: A Security Checklist walks through the controls step by step.
Defence in depth: layers, not a silver bullet
The ASD is explicit: no single measure is enough. Its recommended approach is defence in depth — overlapping layers across the AI lifecycle: user inputs, tool integrations, data sources, model outputs and agent-to-agent communication.
That’s why human oversight sits at the centre of the guidance. Not oversight as a token checkbox, but clear approval points for higher-risk activities, visibility over what agents are doing, and the ability to review, audit and reverse agent-driven actions. If an agent can be interrupted and halted at any point, a bad outcome stays bad instead of becoming a catastrophe.
There’s one more reason to take this seriously: insurers are reading the same guidance. As agentic AI becomes common, cyber insurers will expect these controls in your security posture — just as they already scrutinise Essential 8.
Related reading: See what Australian cyber insurers are actually demanding in 2026 — and how it connects to your AI adoption plans.
What this means for you on Monday morning
You don’t need to become an AI security expert to act on this. You need a few decisions:
- Identify any AI agents you’re already using — from copilots to customer service bots — and map which measures apply.
- Check whether your Essential 8 controls cover the basics: permissions, logging, monitoring, tool validation.
- Set one rule immediately: no agent gets high-impact access without human approval.
- Talk to your managed services provider about red teaming and agent isolation before you deploy anything new.
The businesses that treat this as urgent will be adopting agentic AI securely over the next 12 months. The ones that wait will be playing expensive catch-up — usually after an incident, not before one.
If you’d like a plain-English walkthrough of where you stand — what the guidance requires, what your Essential 8 work covers, and what to do next — get in touch with Planet6. No jargon, no obligation, just a clear picture.
Frequently asked questions
Is agentic AI safe to use at all?
With the right safeguards, yes — the ASD’s guidance is about careful adoption, not avoidance. The risk isn’t the technology; it’s deploying without permissions limits, monitoring and human oversight.
Do I need to hire a CISO or security team?
Not to start. Most of the eight measures can be implemented with your existing IT team or MSP, building on controls you already have.
What’s the difference between generative AI and agentic AI?
Generative AI produces content for a human to review. Agentic AI plans and takes action on its own — which is exactly why it needs stronger guardrails around permissions, monitoring and oversight.
Where should I start?
Start with the agents you already have. Map their permissions, switch on human approval for high-impact actions, and log everything. Then use the eight measures as a checklist for anything new.
Source: Australian Signals Directorate, “Careful adoption of agentic AI in cyber defence”, published 24 July 2026, cyber.gov.au.