SECURING AGENTIC AI - An Addendum on Securing AI Systems - 2025 - Addendum

Oct 13, 2026

Agentic artificial intelligence (AI) systems are self-managing systems that plan, execute, critique, and iterate across multiple steps to meet specified objectives. Aimed at system owners, this addendum highlights how these capabilities expand organizational opportunities while introducing new risks tied to reduced human oversight, including boundary issues, control mechanisms, and potential emergent behaviours. Published by the Cyber Security Agency of Singapore (CSA) with partners, it adopts a risk-based approach across the AI development lifecycle, mapping agentic workflows to identify threat vectors and listing agentic risks and mitigations.

LanguageEnglish

CategoryLetters

FormatPDF

Pages97

Reading Time34 min

AccessFree to download

Quick Reference Table

1. Introduction

2. How Agentic AI Works

2.1. Baseline Components

2.2. Baseline System Design

2.2.1. Agentic AI system architecture

2.2.2. Roles & access control

2.2.3. System workflows & autonomy

2.3. Capabilities

3. Security Threats

( DRAFT FOR PUBLIC CONSULTATION ) SECURING AGENTIC AI An Addendum to the Guidelines and Companion Guide on Securing AI Systems 2025 2 SECURING AGENT IC AI: AN ADDENDUM ON SECURING AI SYSTEMS This document is an addendum to CSA’s Companion Guide on Securing AI Systems (“Addendum”) , focusing on agentic AI systems. Systems owners should use this document in conjunction with the Companion Guide on Securing AI Systems as a resource. This document is meant as a community-driven resource, developed in collaboration with the AI and cybersecurity practitioner communities. It provides practical mitigation measures and practices to secure AI systems. This document is intended for informational purposes only and is not mandatory, prescriptive nor exhaustive . DEVELOPED IN CONSULTATION WITH This document is published by the CSA, in collaboration with partners across the AI and Cyber communities, including: Accenture Alibaba Cloud Amaris AI Cisco Deloitte Singapore DSO National Laboratories Fujitsu Limited Google Asia Pacific Pte. Ltd. Government Technology Agency (GovTech) HP Inc. Kaspersky Lab Singapore Pte Ltd Microsoft Singapore Palo Alto Networks PricewaterhouseCoopers Risk Services Pte Ltd Resaro The American Chamber of Commerce in Singapore (AmChamSG) Vulcan ([vulcanlab.ai](vulcanlab.ai)) 3 SECURING AGENT IC AI: AN ADDENDUM ON SECURING AI SYSTEMS DISCLAIMER The information provided in this document does not, and is not intended to, constitute legal advice. All information is for general informational purposes only. These organisations provided views and suggestions on the security controls, descriptions of the security control(s), and technical implementations included in this Addendum. CSA and its partners shall not be liable for any inaccuracies, errors and/or omissions contained herein nor for any losses or damages of any kind (including any loss of profits , business, goodwill, or reputation, and/or any special, incidental, or consequential damages) in connection with any use of this Addendum. Organisations are advised to consider how to apply the controls within to their specific circumstances, in addition to other measures relevant to their needs. This document contains links to other third-party websites. Such links are informational and do not represent endorsement of content from these third-party sites. 4 SECURING AGENT IC AI: AN ADDENDUM ON SECURING AI SYSTEMS VERSION HISTORY VERSION DATE RELEASED REMARKS 0.1 22 Oct 2025 Release of Addendum on Securing Agentic AI for Public Consultation 5 SECURING AGENT IC AI: AN ADDENDUM ON SECURING AI SYSTEMS EXECUTIVE SUMMARY Agentic artificial intelligence (AI) systems are self-managing AI systems that can plan, execute, critique, and iterate across multiple steps to achieve specified objectives. These systems represent a significant evolution from traditional AI systems, moving beyond simple pattern recognition and predetermined responses to demonstrate increasingly sophisticated abilities to understand context, formulate plans, and take independent actions to achieve specified objectives. Development of these systems bring new capabilities and opportunities for organisations and users. Organisations must carefully consider both the transformative potential and inherent risks these agentic AI systems present. Their capacity to operate with reduced human oversight introduces novel security considerations around system boundaries, control mechanisms, and the potential for unexpected emergent behaviours. Understanding and addressing these security implications is crucial as agentic AI becomes more prevalent in our digital infrastructure and business operations. The Cyber Security Agency of Singapore (CSA) has developed this addendum to advise system owners on securing their agentic AI systems. This addendum is meant to be read together with the Guidelines and Companion Guide on Securing AI Systems, which outline

FAQs

What is the purpose of this addendum on securing agentic AI?

It provides a focused, practical resource for securing agentic AI systems, to be used alongside CSA’s Guidelines and Companion Guide on Securing AI Systems.

How do agentic AI systems differ from traditional AI systems?

They go beyond pattern recognition and predetermined responses by understanding context, formulating plans, and taking independent actions across multiple steps.

What risk-based areas does the addendum cover across the AI development lifecycle?

It maps agentic workflows to identify potential threat vectors and lists agentic AI-related risks and mitigations by capability throughout the development lifecycle.

Oct 13, 2026

Upload by dabgoudw