ASD says prompts cannot contain AI agents in cyber tests
New ASD guidance tells Australian organisations to isolate, monitor and tightly control AI agents during cyber testing instead of relying on prompts or model safeguards.
Australian organisations testing AI agents for cyber security work should not rely on prompts or built-in model safeguards to keep those agents contained, according to new guidance from the Australian Signals Directorate.
ASD’s advice focuses on higher-risk tests in which an AI model or agent can execute code, call tools, use credentials or interact with networks. Its central message is straightforward: containment has to come from the surrounding identity, network and infrastructure controls.
What ASD is asking organisations to do
The Securing AI testing environments guidance, published on 12 November, recommends purpose-built test environments separated from production systems and corporate networks. Access should be denied by default and narrowed to the tools, destinations and actions needed for the approved test.
ASD also recommends unique, short-lived credentials; monitoring that the agent cannot alter; rehearsed emergency shutdown procedures; and independent ways to revoke access, block network connections and terminate workloads.
For the highest-risk work, the guidance says virtual machines should not be the only containment control. Organisations should combine restrictions across identity, compute, network and management systems so that one failure does not collapse the boundary.
Why prompts are not a security boundary
A prompt can describe what an agent is allowed to do, but it cannot enforce a network rule or revoke a credential. ASD warns that a capable agent may find an unexpected route through a supporting system, exploit a weakness or misidentify a real service as a simulated target.
The agency therefore recommends verifying containment before the main evaluation begins. That includes controlled attempts to exercise defined boundaries against designated test resources, followed by independent confirmation that the controls worked.
Human oversight remains necessary
ASD’s model combines automation with accountable human control. Logs and traces should be stored outside the environment, alerts should reach an authorised operator quickly, and that operator must be able to pause or terminate the test without depending on the agent or its infrastructure.
The same caution applies when automated systems review proposed agent actions. Approval tools may help, but ASD says they complement rather than replace containment, monitoring and human oversight.
What the guidance does not cover
The document is about AI models and agents being tested for cyber capabilities. It is not a complete security standard for production AI deployments, and it does not claim that every agent will try to escape a test environment.
AI systems also differ sharply in purpose. CSIRO researchers, for example, used machine-learning methods as part of an independent reconstruction of the M87 black-hole ring. The risk depends not simply on the use of AI, but on the tools, permissions, data and networks available to a system.
Primary sources
