The Cyber Security Agency of Singapore (CSA) and Google convened cybersecurity policymakers, critical infrastructure leaders and artificial intelligence safety experts at the Singapore International Cyber Week 2026 to examine the security risks posed by increasingly autonomous AI agents. The Oct. 14 tabletop exercise focused on operational challenges as organizations delegate core functions to agents capable of acting at machine speed, highlighting limitations of relying solely on perimeter defenses and manual human review. Participants emphasized the need for system-level safeguards, continuous runtime monitoring, hardened execution environments and strict access controls to detect unintended agent behavior, compromised systems and unexpected coordination among multiple agents.
The exercise identified priorities for strengthening agentic AI security, including real-time guardrails to prevent unauthorized high-impact actions, independent verification and model diversity for highly privileged tasks, and contextual access controls that can operate at machine speed. Participants also called for short-term incident response plans, long-term resilience measures and standardized protocols for verifiable agent identities.
Three areas were identified for further collaboration, including trusted information-sharing channels for emerging threats and anomalous agent behavior; AI stress-testing, behavioral evaluations and pilot testing before widespread deployment; and stronger incident response capabilities with appropriate human oversight of consequential decisions. Participants also underscored importance of international cooperation and public-private partnerships in building a secure and resilient agentic AI ecosystem.
They also welcomed constructive exchange between cybersecurity policymakers, industry leaders, and AI safety experts. They reaffirmed importance of sustained international co-operation to build a secure, resilient, and trustworthy agentic ecosystem.
Participants examined how expansion of autonomous AI agents and their growing cyber capabilities is reshaping operational landscape. Organisations face new challenges as they entrust core functions to autonomous AI agents that operate at machine scale. Relying solely on perimeter defenses or manual human review can lead to inadequate coverage or operational bottlenecks. This makes it more difficult to detect unintended agent behaviour, compromised AI agents, or unexpected multi-agent coordination. Where AI agents perform highly privileged tasks such as monitoring and cybersecurity, organisations should also consider the risks of over-reliance on a single model. Independent verification and model diversity can strengthen resilience.
To address these risks, participants discussed practical safeguards, inspired by industry research on agent control. Rather than assuming models will always behave as intended, safeguards should include system-level (‘outside the model’) protections, including continuous runtime monitoring, hardened execution environments, and strict access controls. For deployers, effective oversight requires a layered approach. For example, real-time, deterministic guardrails can prevent unauthorised high-impact actions, combined with asynchronous monitoring to audit agent reasoning and tool use at scale.
The exercise also surfaced practical recommendations, such as preparing for rapid escalation of novel agentic threats through short-term incident response plans and long-term resilience measures. Other recommendations included standardising protocols around verifiable agent identities and transitioning to contextual, machine-speed access controls, such as those outlined in Google’s ‘Beyond Zero’ security framework.
Beyond Zero is a new security paradigm designed to address these AI-era challenges with a contextual, risk-based, resource-level authorization model to run at machine speed, securing humans and agents without overburdening user experience. This extends the concepts from zero trust into the authorization layer, ensuring that every single action taken inside an enterprise is authorized.
The Beyond Zero model rests on five core principles. First, authorization decisions are made at the level of individual actions on specific resources rather than granting broad access to an entire application or tool, and this applies uniformly across all access methods, including front-end interfaces, APIs, and the Model Context Protocol (MCP). Second, granular static policies are paired with dynamic controls that apply heightened security during high-risk or complex scenarios, which introduces dynamic protections without moving to a fully dynamic model that can be difficult to verify statically.
Third, decision systems are automatically enriched with context, including the user’s action, what the user should be working on, what data the action is trying to interact with, what the action is attempting to do with that data, and what risk mitigations are available. This information is always available to the decision-making infrastructure. Fourth, risk signals can autonomously trigger security investigations, which can immediately deploy user challenges or containment measures across the access stream. Fifth, security policies can directly trigger verification challenges or containment protocols, requiring users or agents to provide additional risk telemetry on demand.
Early internal prototypes and deployments of Beyond Zero are showing improved access abuse detection and intellectual property protection. They are also allowing the company to operate at pace while meeting the many regulatory and specialized control requirements its customers need. Additional technical details and deployment strategies will be shared as the work progresses.
Earlier this month, the CSA issued quantum-safe migration guidance recommending that organizations exposed to quantum-related cybersecurity risks establish migration plans by 2027 and aim to complete the transition by 2035. The guidance calls for Critical Information Infrastructure (CII) systems to complete migration by 2031, reflecting Singapore’s risk-based approach to preparing for advances in quantum computing that could eventually undermine widely used cryptographic methods protecting digital communications, transactions and sensitive information.
