CISA and NSA Issue First Federal Guidance on Agentic AI Security

In May 2026, CISA and the NSA, together with Five Eyes partners, published Careful Adoption of Agentic AI Services, the first federal guidance written specifically for agentic AI. Its core instruction is straightforward: before granting an AI agent access to data or systems, know exactly what that agent can reach, and revisit that inventory as its footprint changes. Agent permissions had mostly been governed by general zero trust principles applied after the fact. This guidance makes it explicit: knowing what an agent can reach is now a named federal security requirement, not an implied one.

Few agencies can currently produce that inventory on demand. A May 2026 survey of 275 federal civilian and defense IT and security leaders found that only 11 percent of agencies report AI fully integrated into their zero trust architecture, and just 24 percent report high or complete visibility into API-driven AI interactions, the channel through which agents act autonomously. Yet 78 percent agree that AI agents should be treated as managed entities within a zero trust environment, not exceptions to it. That gap between near-consensus and 24 percent visibility is what the guidance is now asking agencies to close.

The problem has a name: authority drift

The stakes showed up months before the guidance did. In August 2025, attackers stole OAuth tokens belonging to Drift, an AI sales chat agent connected into customer Salesforce instances. Those tokens carried the same broad, rarely revisited access Drift used for its own workflows. The attackers used that access to exfiltrate data from more than 700 organizations. Nobody had to breach Drift itself, they only needed the access that already reached further than any single workflow required.

That kind of overreach is authority drift: the permission footprint that expands past what was originally approved until no one can account for everything an agent can reach. It grows through inheritance, when an agent picks up the access of whatever system it connects to; through integration, when a developer connects it to a new tool that solves an immediate problem; and through convenience, since broad access is faster to configure than scoped access and nobody revisits it once the agent is working. No process evaluates the aggregate, which is why an agent's footprint six months in can bear little resemblance to what was approved on day one.

Why the blind spot persists

Part of why authority drift goes unnoticed is architectural. Continuous verification in zero trust deployments is tuned to reassess human signals (behavior, location, device posture) not what an autonomous agent does with access it already holds. An AI agent authenticates once, then acts on its own for the rest of the session, calling APIs and invoking tools with credentials that stay valid throughout, without generating a signal built to trigger a re-check.

Then there's the November 2025 disclosure from Anthropic: a Chinese state-sponsored group designated GTG-1002 had used an AI coding agent to run a largely autonomous cyberespionage campaign against roughly 30 government and industry targets. The agent executed most of the operation on its own, with humans stepping in only at a handful of decision points. Lateral movement that would normally take a skilled attacker days happened in a fraction of that time, because the agent was already authorized to reach most of what it needed, the exact condition the new guidance is aimed at closing.

What compliance actually requires

Meeting the guidance takes three things working together: a current, continuously updated map of what each agent can actually reach (not what it was provisioned to reach at launch), agents restricted to a fixed set of tools and data sources rather than broad standing access (what OWASP calls "least agency") and an enforcement point that can scope access down without waiting for the next scheduled review cycle. Skip enforcement and the first two just produce a report nobody can act on in time. Skip mapping and the rest is guesswork.

The guidance does not yet carry explicit enforcement weight or audit penalties, and no implementation deadline has been set. But the requirement is now on paper, and agencies that cannot produce an agent permission inventory are on notice.