A tabletop exercise on agentic AI security at the 11th Singapore International Cyber Week (SICW 2026) found that organisations relying on perimeter defences or manual human review alone are not equipped to handle autonomous AI agents operating at machine scale.

The exercise, run by the Cyber Security Agency of Singapore (CSA) and Google, brought together senior cyber policymakers, critical infrastructure leaders and AI safety experts for a scenario-based look at what happens when organisations hand core functions to AI agents that can act on their own.

Perimeter defences aren’t enough

According to the outcome statement released after the exercise, participants found that relying solely on perimeter defences or manual human review can leave gaps in coverage and create operational bottlenecks, making it harder to catch unintended agent behaviour, compromised agents, or unexpected coordination between multiple agents.

Where AI agents handle highly privileged tasks such as monitoring and cybersecurity, participants said organisations should also watch for the risk of leaning too heavily on a single model. Independent verification and using a mix of models, they said, can make systems more resilient.

Safeguards need to sit outside the model

Rather than assuming a model will always behave as intended, participants said safeguards need to operate at the system level, outside the model itself. That means continuous runtime monitoring, hardened execution environments and strict access controls.

For organisations deploying AI agents, the exercise recommended a layered approach to oversight: real-time, deterministic guardrails to block unauthorised high-impact actions, paired with asynchronous monitoring to audit how an agent reasons and uses tools at scale.

Other recommendations included preparing short-term incident response plans and longer-term resilience measures for novel agentic threats, standardising protocols for verifiable agent identities, and moving toward contextual, machine-speed access controls, along the lines of Google’s “Beyond Zero” security framework.

Three areas flagged for further work

Participants identified three areas for further discussion and collaboration. The first is collaborative information sharing: setting up trusted channels for stakeholders to share threat intelligence and flag emerging anomalies or unexpected agent behaviour. The second is AI security and testing, including stress-testing, behaviour evaluations, security guardrails and pilot testing before agents and multi-agent systems are deployed widely. The third is incident response and human oversight, covering preparedness, resourcing, legal and compliance obligations, and keeping humans in the loop for consequential decisions.

Participants said they welcomed the exchange between cybersecurity policymakers, industry leaders and AI safety experts, and called for continued international cooperation to build a secure and trustworthy agentic ecosystem.