AI agents

The NIST National Cybersecurity Center of Excellence (NCCoE) will host a webinar on October 28, 2026, about its DevSecOps Practices project. The project works with 14 technology companies to show how to implement NIST Secure Software Development Framework (SSDF) practices in DevSecOps pipelines using commercially available technologies. The webinar covers a project update on Agentic SI within Build 3 and a panel discussion on its role in DevSecOps.

The article argues that offensive cyber problems are mostly technical, while defensive problems are mostly organisational and political, so defenders cannot deploy agentic AI the way attackers can. It says defenders should explicitly address these constraints rather than mimic attackers' use of agentic tooling. It references CETAS's work on Autonomous Cyber Defence, commissioned by the NCSC.

Enterprises and customers are rapidly deploying agentic AI for uses ranging from personal shopping to customer service, enterprise security and software development. Early deployments are repeating a pattern of prioritizing features and immediate value over security, which the article frames as understandable given pressure to show ROI.

This regulatory guidance advises that AI agents always run within a sandboxed environment that controls what resources they can reach locally and over a network. It recommends defining the sandbox boundaries across execution, network, compute, credentials and data, and denying network traffic by default, using allowlists or protocol-aware proxies with manual approval. It also warns that agents may discover and exploit configuration issues or vulnerabilities in technical controls, leading to a sandbox escape, so it calls for multiple isolation layers and regular validation.

The UK's GCHQ and the National Cyber Security Centre, working with the Department for Science, Innovation and Technology, are developing a national blueprint called Cyber Shield for agentic AI cyber defence. The source says the aim is to use frontier AI to identify, reduce and resolve national cyber risk, and it invites input from academia, critical national infrastructure organisations and frontier labs.

The NCSC, co-authoring with international partners, has published joint guidance titled 'Careful adoption of agentic AI services'. It advises organisations to start small, use agents only for low-risk tasks, and apply established cyber security controls from the outset, and it is aimed at anyone involved in designing, deploying or operating agentic AI systems.