decrypted · 20 august 2026 · vulnerabilities and patching · supply chain · ai and llm security

NCSC issues interim rules for AI agents, after some already went off script

The National Cyber Security Centre spent this morning telling UK organisations how to keep their AI agents on a leash, and it did so earlier than planned. The interim guidance, published today, follows what the NCSC describes only as "several incidents involving AI models and agentic AI systems carrying out unsanctioned or unintended activity." Formal guidance was already in development; the incidents moved the timetable up. Elsewhere, a Rust crate with 245 million downloads was hijacked for 86 minutes this morning, and a macOS flaw that lets anyone walk in through Screen Sharing without a password is still being worked by cryptominers a fortnight after Apple patched it.

What the NCSC is actually asking for

An agentic AI system is software that can plan, use tools and act on your systems without a human approving every step: booking things, editing records, calling other services. The NCSC's core worry is simple. Give a new contractor a master key and no supervisor, and it barely matters whether the contractor is honest; a mistake, a forged instruction, or someone else's prompt slipped into their inbox can do the same damage as malice. Its guidance sets out a maturity model running from unrestricted network access at one end to a fully sandboxed, locally hosted agent with no external access at the other, and asks organisations to decide deliberately where on that scale each agent sits, rather than defaulting to whatever the vendor ships.

The Secure by Design lesson

The specific controls read like standard Secure by Design practice applied to a new kind of user. Agents should get their own identity, separate from any human's, with credentials scoped to the task and as short lived as possible, ideally injected by a proxy rather than handed to the agent directly. Someone named should own each agent's operation, with monitoring good enough to intervene in real time and a shutdown switch that actually works. None of this is exotic: it is the same least privilege, break glass thinking the NCSC has pushed for service accounts for years. What is new is how many organisations are skipping it, because a chatbot with tool access still feels like a chat window rather than a privileged user that needs onboarding, logging and an exit process. Boards signing off on agentic AI pilots should ask which of the NCSC's four sandboxing levels their vendor's default setup actually sits at, because it usually is not the safest one.

Also this week

A supply chain attack hit two widely used Rust crates this morning. The Rust project's security team says a compromised maintainer's credentials were used to publish a poisoned version of arrayref, downloaded 245 million times, alongside append-only-vec and several other packages. The malicious versions pulled in a typosquatted dependency, proc-macro1, whose build script downloaded and ran a payload the moment anyone compiled a project that used it, no function call required. Crates.io pulled the packages within 86 minutes and restored clean versions, but the incident is a reminder that build time execution turns "just compiling" into running untrusted code, in any language's package ecosystem, not only npm's.

A macOS authentication bypass in Screen Sharing, tracked as CVE-2026-65400, is still being actively exploited against Macs left reachable on port 5900. The Dutch national cyber security centre reported attackers gaining root and installing Monero miners on internet facing systems. Apple fixed the underlying flaw on 6 August, and CISA has set a patch deadline of 21 August for US federal agencies. The lesson for UK organisations running Macs is the older one this newsletter keeps returning to: a remote administration service should never be reachable from the open internet in the first place, patched or not.

Sources

If your organisation is deploying agentic AI and wants a second opinion on where the guardrails should sit, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.