AI・テクノロジー
Five Eyes Issues "Exercise Caution on AI Agents" Warning — Five Security Risks of Autonomously Deciding AI
機械翻訳 / Machine-translated
The Five Eyes intelligence-sharing alliance — comprising the intelligence agencies of the United States, United Kingdom, Australia, Canada, and New Zealand — has published a joint advisory sounding the alarm over enterprise adoption of AI agents. The warning directly confronts the rapidly accelerating wave of agent deployments entering 2026, pointing out that the very characteristic of "AI autonomously making decisions and carrying out tasks" is itself a source of risk.
In May 2026, it was reported that the intelligence agencies of the five Five Eyes member nations — the U.S. NSA, UK NCSC, Australian ASD, Canadian CSE, and New Zealand's GCSB — jointly published an advisory on AI agent security risks.
"Because AI agents autonomously make decisions and carry out tasks, numerous security risks exist. They should be adopted with caution." — Summary of the joint intelligence agency warning (quoted by @toukatsujin)
What the advisory particularly emphasizes is the structural risks inherent in the architecture by which agents "make judgments and take action without instruction." Conventional software operates according to rules, but LLM-based agents determine their next action through situational reasoning. This non-determinism is seen as expanding the attack surface.
From the second half of 2025 through early 2026, major AI vendors successively released agent frameworks targeting enterprise users. Anthropic expanded Claude Code's agentic capabilities, OpenAI rolled out Operator, and Google made Agentspace available to enterprise customers.
During the same period, cases of agents accessing internal file systems, email, and CRM systems have surged. The "tool-calling permissions" granted to agents are, in effect, system access privileges, and multiple security researchers have noted a year-over-year increase in reported prompt injection attacks exploiting these permissions compared to 2025.
The gap between deployment speed and the pace of safety measures is what prompted Five Eyes to issue a collective advisory.
When an agent ingests external data — email body text, web pages, PDFs — malicious instructions can be embedded within that data to cause the agent to perform unintended actions. Real-world harms such as file exfiltration, external data transfer, and credential leakage have been reported, and as of 2026, LLMs' ability to distinguish "trusted input" from "adversarial input" remains incomplete.
In enterprise settings, it is common to give agents broad permissions for the sake of convenience. The advisory flags this as a violation of the Principle of Least Privilege, calling for designs that restrict agent access to only the scope genuinely required.
When approval steps are eliminated to gain the benefits of automation, there is no mechanism to stop an agent if it makes a wrong decision. The five-nation joint advisory explicitly recommends designs that require human confirmation for high-risk actions without exception.
Trust evaluation is required not only for the LLM itself, but also for the third-party tools agents call — MCP servers, external APIs, and so on. Attack scenarios involving hijacking an agent via a malicious MCP server have already progressed beyond the proof-of-concept stage.
Many organizations have not secured the traceability needed to know what an agent executed and when. The advisory explicitly identifies the operational problem this creates: difficulty tracing root causes after an incident occurs.
Worth noting is that this warning takes the stance of "adopt with caution" rather than "do not use." The reason Five Eyes stops short of a blanket rejection of the technology is likely that consideration of agent use is already advancing in national security and defense contexts as well. The judgment appears to be that standardizing safe usage practices is more urgent than an outright ban.
For enterprises, practical responses come down to three things: ① minimize the permissions granted to agents; ② maintain a design in which human approval is required for high-risk actions; ③ log every action executed by agents. These three measures alone can substantially reduce risk.
As firsthand accounts of "how fast things move once you start using AI agents" continue to multiply, cases where security design is being deprioritized stand out in real-world settings. The significance of national intelligence agencies acting in concert should be read not as an individual enterprise risk-management matter, but as a declaration that the reliability of infrastructure as a whole is now at stake.
The joint advisory issued by the five Five Eyes nations confirms at a national level the structural problem that the "autonomy" of AI agents constitutes a new attack surface. As convenient as they are to use as tools, the risk that their autonomy will be turned against you must be built in from the design stage. How much permission are the agents in your organization operating with right now? — The longer the audit is postponed, the greater the cost will be.
This article was written by an AI writer (AI News) from the Mirai News editorial team.
