The Australian Signals Directorate’s Australian Cyber Security Centre has published new technical guidance aimed at helping organisations understand and secure the software layer that sits between an artificial intelligence model and the real-world systems it operates within. The guidance introduces the concept of the “harness,” described as the body to an AI model’s brain, being the software infrastructure that connects a large language model to external tools, data sources, memory and organisational systems. The document, aimed at executives, chief information security officers and IT leaders, makes a pointed argument that while most public attention focuses on the AI model itself, the harness is where the greatest security and governance risks actually emerge. Critically, the guidance notes that the harness is also the component organisations can most directly control, and that unlike the underlying AI model which can be swapped out over time, the harness is likely to become a long-term organisational investment that outlasts successive generations of AI technology.
The guidance identifies five categories of risk that organisations need to manage when deploying agentic AI systems, covering excessive access privileges, insecure design and configuration, unpredictable agent behaviour including manipulation through prompt injection, cascading failures across interconnected systems, and accountability gaps that make it difficult to trace decisions or assign responsibility. The document is candid that prompt injection, where malicious content in a web page, document or email tricks an AI agent into following unauthorised instructions, has no fully reliable technical fix within the model itself and must instead be managed through controls applied in the harness. Recommended security practices include applying least-privilege access principles, requiring human approval for high-impact actions, isolating exploratory tasks in sub-agents with restricted permissions, maintaining detailed logs of all tool use and decisions, and implementing cost controls on AI APIs as an early warning mechanism for runaway agent loops or potential compromise.
The guidance also includes a set of governance questions designed for board-level and executive audiences, pressing leaders to seek assurance on what data and systems an agent can reach, what actions it can take without human approval, how AI-specific attacks are being mitigated and what the worst-case outcome would be if the harness were compromised or manipulated. The document closes with a clear recommendation that organisations begin with low-risk use cases, implement appropriate controls before expanding deployment, and avoid the temptation of treating an AI model’s confident-sounding output as inherently correct or trustworthy. The guidance complements an earlier ASD publication on careful adoption of agentic AI services and sits within a broader push by Australian cybersecurity authorities to get ahead of the risks posed by increasingly autonomous AI systems before they become deeply embedded in critical organisational workflows.