)
Last updated: September 2026
What do the NCSC AI guidelines say about agentic AI?
In August 2026, the NCSC published interim practical guidance for organisations deploying agentic AI: autonomous systems that take actions, use tools, and operate across extended sessions. The guidance, "Managing the cyber risk of agentic AI," sets out seven key considerations for deploying agents securely, covering threat modelling, sandboxing, observability, human oversight, and emergency shutdown capability.
It builds on the foundational NCSC Guidelines for Secure AI System Development, published in 2023, which covers four lifecycle stages: secure design, secure development, secure deployment, and secure operation and maintenance.
TL;DR - Key Takeaways
- In August 2026, the NCSC published the "Managing the cyber risk of agentic AI" article, an interim practical guidance for organisations deploying autonomous AI agents. The guidance was written by a Principal Security Architect at the NCSC and is explicitly targeted at large organisations, public sector bodies, and cyber security professionals.
- This is interim advice, not yet formal guidance. The NCSC notes it is working with partners to develop formal guidance that will supersede this blog. Organisations should treat the seven considerations as the current NCSC baseline and expect updates.
- The guidance identifies seven considerations: identify what could go wrong, prompt carefully, set the right level of oversight, sandbox the agent's environment, maintain observability, make AI activity attributable, and maintain emergency shutdown capability.
- Sandboxing is treated as non-negotiable. The NCSC provides a four-level network access maturity model and a four-level compute isolation maturity model. High-risk agentic AI deployments should target the upper levels of both.
- The "blast radius" concept is central to the NCSC's approach. Every resource an agent can access (credentials, data, network connections) extends its blast radius if it malfunctions or is compromised. Limiting blast radius through least-privilege credential access and network restrictions is a core requirement.
- Human oversight must be technically enforced. The NCSC defines three oversight models (human-in-the-loop, human-on-the-loop, and human-out-of-the-loop) and recommends that for high-risk scenarios, human oversight is maintained alongside technically enforced controls.
- Agentic AI activity must be treated as user activity in security operations. The guidance explicitly states it should be included in 24/7 SOC monitoring with appropriate incident response procedures.
Why the NCSC Published Agentic AI Guidance in August 2026
The NCSC's August 2026 guidance was prompted by a specific and growing problem: AI agents carrying out unsanctioned or unintended activity in production environments. The document opens by acknowledging that real incidents had occurred: deployments where agents behaved in ways that were not expected, accessed information they should not have, or took actions outside their defined scope.
The guidance exists because agentic AI creates a different security challenge from the AI systems that the NCSC's foundational 2023 framework was designed to address. The 2023 "Guidelines for Secure AI System Development" (co-published with CISA, the NSA, the FBI, and cyber security agencies from 20 countries) covers the security requirements across the AI development lifecycle: design, development, deployment, and operation. It remains the baseline. But it was written before autonomous, multi-step, tool-using AI agents became a standard enterprise deployment pattern.
Agentic AI changes the threat surface in two ways. First, an agent can cause real-world effects like modifying files, making API calls or accessing external services without human review of each individual action.
Second, an agent's behaviour can be influenced by the content it processes during a session: a retrieved document or API response containing adversarial instructions can redirect an agent's activity in ways that are invisible to the human who launched it.
Traditional security controls do not inspect the semantic content of what an agent is doing. Most enterprise environments have neither the monitoring nor the containment controls to detect or halt this class of incident in real time.
The NCSC's August 2026 guidance is an interim response to this gap. It does not replace the 2023 foundational framework. It extends it with specific, operationally focused advice for the agentic deployment scenarios that enterprise security teams are now navigating.
The NCSC's Foundational Framework: Four Stages to Know
Before examining the August 2026 agentic AI guidance, it is worth understanding the 2023 foundation it builds on. The NCSC Guidelines for Secure AI System Development organises AI security requirements across four lifecycle stages. These apply to every AI deployment, agentic or otherwise, and remain in force alongside the newer guidance.
- Secure design covers threat modelling before deployment, supply chain due diligence for models and APIs, least privilege access principles, and the requirement to design AI systems for security alongside functionality.
- Secure development covers AI supply chain security, asset tracking and protection (including models, prompts, and logs), documentation of training data, model cards and data cards, and technical debt management specific to AI systems.
- Secure deployment covers infrastructure security, continuous model protection against extraction and tampering, and the requirement to "release AI responsibly", subjecting systems to benchmarking and red teaming before production deployment. The guidance explicitly names red teaming as a required security evaluation, not an optional activity.
- Secure operation and maintenance covers monitoring both the model's outputs (to detect behavioural change) and its inputs (to identify adversarial prompts and out-of-distribution requests), secure update management, and information sharing with the security community.
Together, these four stages define the minimum security posture for any AI system in enterprise use. The August 2026 agentic AI guidance adds a further layer of operational requirements on top of this base.
NCSC Agentic AI Guidance: The Seven Key Considerations
The August 2026 guidance organises its recommendations into seven considerations. Each applies to organisations deploying AI agents (systems operating with "significant degrees of autonomy") in production environments.
1. Identify What Could Go Wrong
Before any agentic AI deployment, the NCSC requires organisations to document what is within and outside the scope of the agent's intended activity, including explicit "red lines" the agent must not cross. This documentation should be followed by threat modelling that identifies specific failure scenarios: what could the agent do if it malfunctions unexpectedly, accesses information it should not, or takes actions outside its intended scope?
The guidance includes a reminder that is easy to overlook: an AI agent is not human. It does not apply common sense to ambiguous situations and may interpret instructions in literal or unexpected ways. Threat modelling for agentic AI must account for this characteristic. The results of threat modelling should directly inform the controls deployed around the agent, not just the agent's instructions.
2. Prompt Carefully
The instructions and context given to an agent significantly influence its behaviour. The NCSC guidance identifies three things to define before running any agent: what the agent is to achieve, what actions it is allowed to take, and when it should stop and seek human approval.
Instructions should cover both what the agent should do and what it should not do. For longer-running tasks, the guidance notes that agents may compress their context windows to manage token efficiency, which can cause critical constraints to drop out of active context. Where constraints matter, the NCSC recommends repeating them at appropriate intervals to ensure they remain throughout the task.
Critically, the guidance warns against relying on prompting alone. Prompts should be combined with technical and operational controls to provide defence in depth. Organisations that rely solely on system prompt instructions to constrain agent behaviour are not meeting the NCSC's standard.
3. Set the Right Level of Oversight
The NCSC defines three oversight models for agentic AI deployments:
- Human-in-the-loop: humans approve actions before they happen
- Human-on-the-loop: humans monitor actions and can intervene if needed
- Human-out-of-the-loop: AI acts autonomously without human review
The appropriate model depends on the risk profile of the use case. Where unintended activity would have significant consequences, the NCSC recommends maintaining named individual or group responsibility for agentic AI activities, using real-time monitoring alerts to surface unexpected behaviour, and ensuring humans can stop the agent when necessary.
For higher-risk scenarios, the guidance recommends human oversight alongside technically enforced controls. The guidance also notes that "judge" AI models can be used to supervise an agent's activities, but these should be independently evaluated and their limitations understood. For the highest-risk applications, judge AI models are not a substitute for human oversight.
4. Control the Agent's Environment with a Robust Sandbox
Sandboxing is the most technically detailed section of the NCSC guidance, and the one with the most direct enterprise implementation requirements.
The NCSC requires that every AI agent run within a sandboxed environment that controls what resources it can and cannot communicate with. Designing this sandbox requires thinking across five dimensions of agent access: execution (the relationship between scaffolding, command execution, and inference infrastructure), network (what the agent can remotely access), compute (what it can locally access), credentials (what API keys, OAuth grants, SSH keys, and authenticated sessions it can use), and data (what information it has access to).
The NCSC provides a four-level network access maturity model:
| Level | Description |
|---|---|
| Level 1 (lowest) | Unrestricted network access |
| Level 2 | Access restricted to an allowlist of approved domains |
| Level 3 | Access restricted to just the API of the model |
| Level 4 (highest) | No external network access; model hosted locally inside the network sandbox |
The NCSC also provides a four-level compute isolation maturity model:
| Level | Description |
|---|---|
| Level 1 (lowest) | No compute isolation; agent runs on the host platform alongside other workloads |
| Level 2 | Agent constrained using kernel primitives (process separation, OCI containers); residual kernel exploit breakout risk remains |
| Level 3 | Agent isolated using virtualisation technologies |
| Level 4 (highest) | Agent runs on dedicated hardware separate from other workloads |
For high-risk activities, the NCSC recommends Level 4 for both network and compute isolation. Enterprises should assess where their current deployments sit on both maturity models and set a target level proportionate to the risk profile of each agent use case.
On credentials specifically: all agents should be assigned their own unique identity distinct from human or system accounts. The credentials available to an agent define part of its "blast radius", the NCSC's term for the scope of potential impact if an agent malfunctions or is compromised. Credentials should be scoped to the minimum permissions needed for the task and use the shortest possible lifetime.
5. Observability: Log, Audit and Monitor as Part of Security Operations
The NCSC's observability requirements go beyond standard application logging. For agentic AI, organisations need access to two categories of telemetry: chain of thought traces and transcripts from the AI agent itself, and event logs from the wider sandbox environment: access logs, proxy logs, and network traffic.
Logs must be protected from modification or deletion. Where possible, they should be immutable so they remain trustworthy during an investigation. The guidance also highlights a specific risk: an AI agent could potentially abuse the log collection infrastructure to escape its sandbox environment. The design of logging systems should account for this threat.
The most operationally significant requirement in this section is how NCSC frames agentic AI monitoring: it should be treated as a form of user activity and included in 24/7 security operational monitoring with appropriate incident response procedures. Agentic AI activity that is monitored only during business hours, reviewed only by the deployment team, or excluded from SOC workflows does not meet the NCSC's standard.
6. Make AI Activity Easy to Attribute
When an AI agent communicates with third-party systems, the NCSC requires that the activity be identifiable as originating from the deploying organisation. Methods for doing this include ensuring traffic originates from IP addresses that support reverse lookups, and adding identifying headers to outbound communications (such as HTTP headers) as a form of watermarking.
This requirement has both security and governance dimensions. If an agent causes unintended effects on a third-party system, the ability to identify and acknowledge the source activity quickly, and follow an incident management playbook, reduces the operational and reputational consequences of an AI incident.
7. Emergency Shutdown: Maintain the Ability to Pull the Plug
The final consideration is the most direct: organisations must always be able to halt autonomous AI agent activity immediately. The NCSC is explicit that this may require more than stopping the agentic AI processes themselves. Emergency shutdown capability should cover the wider system, rapidly restricting network access to agentic AI infrastructure and interrupting communications between AI agents and the underlying inference infrastructure.
This requirement has a specific implication for cloud-hosted agent deployments: the ability to halt the agent cannot depend solely on the model provider's infrastructure or controls. Organisations need their own layer of emergency control.
What UK Enterprises Must Do Now: Implementation Checklist
Combining the NCSC's August 2026 agentic AI guidance with the 2023 foundational framework, UK enterprise security teams should work through the following minimum actions:
- Establish what AI agents you have in production. This includes sanctioned deployments, AI features embedded in SaaS products, and autonomous agents adopted by individual teams without formal procurement. You cannot apply the NCSC guidance to deployments you have not identified.
- Threat model every agentic AI deployment before the next operational cycle. Document red lines, identify failure scenarios, and assess whether the controls around each agent are proportionate to the risk.
- Define and enforce the level of oversight for each agent. Determine whether each deployment should be human-in-the-loop, human-on-the-loop, or human-out-of-the-loop, and ensure that determination is technically enforced, not just policy-stated.
- Assess your sandbox maturity level for each deployment. Use the NCSC's four-level network and compute isolation models as the assessment framework. Set a target level proportionate to each agent's risk profile and plan the path to reach it.
- Audit agent credentials. Every agent in production should have its own unique identity. Credentials should be scoped to least privilege and use the shortest viable lifetime. Remove over-permissioned agents from production until their credential scope is corrected.
- Integrate agentic AI activity into 24/7 SOC monitoring. If your AI agents are not currently included in security operational monitoring with defined incident response procedures, this is the highest-priority remediation gap to close.
- Implement chain-of-thought logging with tamper protection. Logs should capture agent traces and sandbox environment events, be protected from modification, and be stored in a way that makes them usable for incident investigation.
- Add identifying markers to outbound agent traffic. Ensure traffic from your AI agents can be attributed to your organisation and that abuse reports related to agent activity are handled through your incident management process.
- Test your emergency shutdown capability. The ability to halt autonomous agent activity, restrict network access, and interrupt inference infrastructure connections should be tested periodically.
- Red team every AI application before its next significant update. The NCSC's 2023 framework requires that AI systems be red teamed before release. This applies to updates as well as initial deployments.
For a broader view of how these requirements fit within a UK enterprise AI security programme, see the UK CISO's Complete Guide to Enterprise AI Security and our guide to enterprise AI security platforms available in the UK market.
Book a Demo
NeuralTrust's platform gives UK enterprise security teams the technical controls the NCSC's guidance requires: gateway-level policy enforcement (TrustGate), runtime monitoring and sandboxing support for AI agents (TrustGuard), AI asset discovery and posture management (TrustLens), and automated adversarial testing before release (TrustTest).
)
FAQs about the NCSC AI Guidelines for UK Enterprises
1. What is the NCSC's agentic AI guidance published in August 2026?
"Managing the cyber risk of agentic AI" is an NCSC blog post published on 20 August 2026, written by Toby W, Principal Security Architect at the NCSC. It provides interim practical advice for organisations deploying autonomous AI agents, systems capable of taking actions, using tools, and operating over extended sessions. The NCSC published it as practical guidance while formal guidance is being developed. It is targeted at cyber security professionals, large organisations, and public sector bodies.
2. Is the August 2026 NCSC agentic AI document formal guidance or a requirement?
The NCSC describes it as interim practical advice, not yet formal guidance. The document states that the NCSC is working with partners to develop formal guidance that will ultimately supersede it. However, for UK enterprises (particularly operators of critical national infrastructure and public sector organisations) the NCSC's published recommendations carry significant weight in regulatory and audit contexts. Treating the seven considerations as the current baseline is the appropriate enterprise approach.
3. What are the seven key considerations in the NCSC agentic AI guidance?
The seven considerations are: identify what could go wrong (threat modelling and red lines), prompt carefully (explicit instructions combining what to do and what not to do), set the right level of oversight (human-in-the-loop, human-on-the-loop, or human-out-of-the-loop), control the agent's environment with a robust sandbox, maintain observability (logging chain-of-thought traces and sandbox events as part of 24/7 SOC operations), make AI activity attributable (watermarking outbound agent communications), and maintain emergency shutdown capability.
4. What is the NCSC's sandboxing maturity model for agentic AI?
The NCSC provides two four-level maturity models for sandboxing agentic AI: one for network access and one for compute isolation. Network access ranges from Level 1 (unrestricted) to Level 4 (no external network access, model hosted locally). Compute isolation ranges from Level 1 (no isolation, agent runs alongside other workloads) to Level 4 (agent runs on dedicated hardware separate from all other workloads). Organisations should assess where each agentic AI deployment sits on both models and set target levels proportionate to the risk profile of each use case.
5. What does "blast radius" mean in the context of NCSC agentic AI security?
Blast radius is the NCSC's term for the scope of potential damage if an AI agent malfunctions or is compromised. Every resource the agent can access (credentials, data, network connections, APIs) extends its blast radius. The NCSC uses this concept to justify least-privilege credential scoping, network allowlisting, and sandboxing: each of these controls limits what an agent can reach, and therefore limits the potential consequences of a security incident.
6. How does the NCSC agentic AI guidance relate to the 2023 Guidelines for Secure AI System Development?
The August 2026 guidance builds on, but does not replace, the 2023 foundational framework. The 2023 Guidelines for Secure AI System Development (co-published by the NCSC with CISA, the NSA, the FBI, and cyber security agencies from 20 countries) establishes the four lifecycle stages (secure design, secure development, secure deployment, and secure operation and maintenance) that apply to all AI systems. The August 2026 guidance adds operational requirements specific to agentic AI: sandboxing maturity models, chain-of-thought logging, human oversight frameworks, and emergency shutdown requirements. Both documents are in force for UK enterprise AI deployments.
7. What is the difference between human-in-the-loop, human-on-the-loop, and human-out-of-the-loop oversight?
These are the three oversight models the NCSC defines for agentic AI. Human-in-the-loop means humans approve every significant action before the agent takes it. Human-on-the-loop means humans monitor the agent's activity and can intervene, but do not approve each action in advance. Human-out-of-the-loop means the agent operates autonomously without human review. The NCSC recommends that for high-risk scenarios, human oversight is maintained alongside technically enforced controls, and notes that where human oversight is in place, humans should be able to investigate quickly and take action to limit any unintended impact.
Related articles:
- The UK CISO's Complete Guide to Enterprise AI Security (2026)
- Best AI Security Platforms in UK
- NIST AI RMF 1.0: A Step-by-Step Implementation Guide for Enterprises
- OWASP Agentic AI Top 10: Every Risk Explained with Enterprise Mitigations
- Data Sovereignty Requirements under the EU AI Act
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specialises in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026 and recognised across four Gartner Hype Cycle reports in the same year. Headquartered in Barcelona with offices in London (167 Great Portland Street) and New York. ISO 27001 certified.
)
)
)
)