Tuesday 5 May 2026

Five Eyes to Enterprises: Your Agentic AI Is Running Ahead of Your Security

Five Eyes agencies warn agentic AI is moving faster than enterprise safety controls — and that's the least of today's problems.

Lead story

Five Eyes to Enterprises: Your Agentic AI Is Running Ahead of Your Security

The intelligence agencies of Australia, the US, the UK, Canada, and New Zealand don't usually agree on much in public. When they do, it's worth paying attention. Yesterday, the Five Eyes published a joint advisory warning that the rapid deployment of agentic AI systems — AI that can take autonomous actions, chain tasks together, and operate across enterprise tools without human sign-off at each step — is outpacing the security frameworks organisations have in place to govern them.

The advisory isn't abstract. Agentic AI is already showing up in enterprise environments as automated code reviewers, IT helpdesk agents, supply chain orchestrators, and customer service systems with access to live databases. The problem the Five Eyes are pointing at is structural: these systems inherit credentials, operate across trust boundaries, and make consequential decisions in ways that traditional access control and audit frameworks weren't designed to handle.

The specific risks flagged include prompt injection (where malicious content in the environment hijacks agent behaviour), privilege escalation (agents accumulating permissions beyond their original scope), supply chain compromise (poisoned tools or APIs that agents call autonomously), and insufficient logging (agentic actions often happen faster and deeper than human-readable audit trails capture). Each of these is a known risk in isolation. The advisory's concern is that agentic architectures combine all four simultaneously.

The timing matters. Enterprise AI deployment has accelerated sharply since late 2025, with vendors including Microsoft, Salesforce, ServiceNow, and Google all shipping agentic features into products already running inside critical infrastructure. The agencies note that many deployments are happening under existing software procurement processes that weren't designed to evaluate autonomous decision-making systems.

For Australian organisations, this advisory lands squarely within the scope of existing obligations. The SOCI Act requires operators of critical infrastructure to manage risks to systems, including third-party and automated processes. The ASD's Essential Eight doesn't yet have explicit agentic AI guidance, but the advisory aligns closely with application control and least-privilege principles. The ACSC is one of the Five Eyes signatories, meaning Australian defenders should treat this as a domestic directive, not just international commentary.

The practical recommendations in the advisory are sensible if unglamorous: apply least-privilege to agent identities, treat agent-to-agent communication as an untrusted channel, log agent actions at the same fidelity as human actions, and conduct red-team exercises that specifically test agentic attack paths. The advisory also calls out the risk of over-relying on vendor safety claims — the fact that a model has built-in guardrails doesn't mean the broader agentic system is secure.

What to watch: how quickly enterprise security vendors translate this guidance into tooling, and whether the ASD follows up with Australia-specific controls for sectors already deep into agentic AI deployments — financial services and federal government procurement being the two most obvious candidates. The advisory is the opening shot of what will likely be a multi-year regulatory conversation about who is responsible when an AI agent does something it wasn't supposed to.

Also today

NSW Treasury Downgrades Severity of Recent Cyber Incident

The New South Wales Treasury has revised down its assessment of a recent cyber incident, saying the impact is less severe than initially feared. The announcement comes less than a fortnight after a state government official was charged in connection with the matter. Treasury hasn't disclosed exactly what data or systems were affected, but the downgrade will offer some relief to other state agencies watching closely. The incident is a reminder that Australian government bodies remain attractive targets — and that initial breach disclosures rarely capture the full picture. The ASD's Essential Eight compliance posture across NSW agencies has been a recurring audit finding in recent years.

The Mandarin ↗

MOVEit Is Back: Critical Auth Bypass in Automation Product Needs Immediate Patching

Progress Software has shipped patches for a critical authentication bypass in MOVEit Automation — the enterprise managed file transfer product that became synonymous with mass data theft after the 2023 Cl0p campaign. This flaw is distinct from that incident but hits the same product. MOVEit Automation is widely deployed in government, healthcare, and financial services to move sensitive files on automated schedules. Progress is urging customers to patch immediately. Given how aggressively the previous MOVEit vulnerability was weaponised, defenders should treat this as urgent rather than routine. Australian organisations using MOVEit in SOCI-regulated sectors should validate patch status and review transfer logs for anomalies.

Bleeping Computer ↗

ShinyHunters Claims Instructure Breach, Canvas User Data Exposed

Educational technology giant Instructure — the company behind the widely used Canvas learning management system — has confirmed a data breach after the ShinyHunters extortion group claimed responsibility. Stolen data includes names, email addresses, student ID numbers, and messages between users. ShinyHunters has a track record of large-scale data theft followed by public leak threats, and the group's involvement suggests this could affect a significant number of institutions. Canvas is used by universities and schools across Australia, including several Group of Eight universities, meaning affected institutions should be reviewing their vendor security agreements and checking for notification obligations under the Privacy Act.

SecurityWeek ↗

Backdoored PyTorch Lightning Package Steals Credentials From Developer Machines

A malicious version of the PyTorch Lightning package has been found on PyPI, delivering a credential-stealing payload that targets saved browser credentials, environment files, and cloud service tokens. PyTorch Lightning is a popular framework used by ML engineers to simplify model training code — meaning the likely victims are data scientists and AI developers with elevated cloud access. The attack follows a well-worn supply chain playbook: publish a near-identical package name, wait for installs, exfiltrate credentials silently. Defenders should audit their Python environments for unexpected package versions and rotate any cloud credentials stored in environment files on developer machines.

Bleeping Computer ↗

Amazon SES Is Becoming Phishers' Favourite Delivery Rail

Attackers are increasingly routing phishing emails through Amazon Simple Email Service, exploiting the platform's trusted reputation to slip past security filters that rely on sender reputation scores. Because SES emails originate from Amazon's own infrastructure, domain-based blocklists and reputation checks struggle to flag them. The technique is particularly effective against targets using default email security configurations. The trend puts pressure on organisations to move beyond reputation-based filtering toward content inspection and link analysis. Defenders should review inbound email rules for SES-originated messages and consider whether their current tooling can inspect SES-delivered payloads effectively.

Bleeping Computer ↗

DigiCert Revokes Certificates After Support Portal Compromise

DigiCert has begun revoking certificates after attackers compromised its internal support portal. The attack chain involved delivering malware through a customer chat channel, infecting an analyst's workstation, and then pivoting to the support portal from there. Certificate revocations create downstream disruption for any organisation relying on affected certs — and given DigiCert's market share, that's a large pool. This is a separate, escalating development to the Microsoft Defender false-positive story that ran Monday, though both involve DigiCert certificates. Affected customers should check their certificate inventory and monitor for browser trust warnings that could signal unexpected revocations.

SecurityWeek ↗

Cisco Acquires Astrix Security to Plug Non-Human Identity Gap

Cisco has announced it will acquire Astrix Security, an Israeli startup focused on securing non-human identities — the API keys, service accounts, OAuth tokens, and automated integrations that increasingly outnumber human users in enterprise environments. The deal signals where Cisco thinks the next major attack surface sits: not compromised employee accounts, but the machine-to-machine connections that run quietly in the background of every SaaS-heavy organisation. Astrix's technology maps and monitors these non-human identities and flags excessive or dormant permissions. The acquisition extends Cisco's identity security portfolio at a moment when agentic AI is about to make the non-human identity problem significantly larger.

SecurityWeek ↗

Automating AI Research: The Road to Recursive Self-Improvement

This week's Import AI newsletter examines a cluster of new research pointing toward AI systems that can meaningfully assist in their own development — running experiments, interpreting results, and proposing architectural changes without constant human direction. The framing is careful: this isn't recursive self-improvement in the science-fiction sense, but it's the first credible set of papers showing AI accelerating the pace of AI research in measurable ways. The implications for safety evaluation timelines are significant. If AI systems can compress the research cycle, the window between capability jumps and corresponding safety work may narrow faster than most governance frameworks assume.

Import AI ↗

Shadow AI Gets a Supply Chain Problem: The Case for AI-BOMs

Shadow IT was the enterprise security headache of the 2010s — employees using unauthorised cloud services outside IT's view. The 2026 version is shadow AI: models, agents, and automation tools deployed by individual teams without procurement or security review. The Register examines the emerging concept of an AI Bill of Materials (AI-BOM), a structured inventory of the AI components, models, training data, and third-party services embedded in an organisation's workflows. The idea borrows from the software supply chain playbook (SBOMs became mandatory in some US federal procurement after the 2021 executive order) and applies it to the AI layer. Expect Australian government procurement frameworks to eventually require something similar.

The Register ↗

Nature Retracts Influential ChatGPT-in-Education Study

A widely cited study published in Nature claiming significant educational benefits from integrating ChatGPT into classrooms has been retracted following concerns about the integrity of its data and methodology. The paper had already accumulated hundreds of citations and been used to inform school technology policies in multiple countries. Researchers and educators who pushed back on the findings are now pointing out that policy decisions were being made on a shaky evidential base. The retraction is a case study in how AI hype can propagate through academic publishing, and a reminder that education systems — including Australia's, which has been debating AI in schools — need rigorous evidence before embedding AI tools into curricula.

Ars Technica ↗

GameStop Bids $56 Billion for eBay — and Nobody Quite Knows How

GameStop, the struggling video game retailer better known for its meme stock era than its business fundamentals, has made an unsolicited $56 billion offer to acquire eBay. CEO Ryan Cohen says the goal is to build a "legit competitor to Amazon." The problem: GameStop has roughly $9.4 billion on its balance sheet and hasn't explained how it would fund the remaining $46 billion. eBay says it will "carefully review" the proposal. Markets reacted with a mixture of amusement and scepticism. The bid follows GameStop's earlier pivot toward crypto and collectibles, and reads less like a credible M&A play than a public pressure campaign — though stranger things have happened in post-meme-stock corporate America.

Ars Technica ↗

Sources consulted