What the addendum is

The Cyber Security Agency of Singapore finalised its addendum, Securing Agentic AI, on 17 June 2026, following a public consultation that ran from late October to the end of December 2025. It is meant to be read alongside the agency's 2024 Guidelines and Companion Guide on Securing AI Systems rather than replacing them.

The addendum introduces a way of describing agentic systems through baseline components and groups the threats into three broad layers, with a detailed breakdown in an annex. Examples it names include rogue actions, where an agent does something it should not, and sensitive data disclosure, where an attacker manipulates an agent into revealing information.

It keeps the earlier guidance's core ideas: take a lifecycle approach and begin with a risk assessment. Agentic systems extend those principles rather than escaping them.

Turning it into engineering work

Start by drawing the agent as a set of components: the model, its instructions, the tools it can call, the data it can reach, and the identities it acts as. For each component ask what happens if an attacker controls the input, and what the worst action available is.

Then place controls where they are cheapest and most reliable: least-privilege tool access, scoped credentials per task, validation of tool inputs and outputs, approval gates before irreversible actions, and logging that lets you reconstruct a sequence of steps after the fact.

Limit what the agent can touch

Give each task the narrowest tools, data, and credentials it needs, and expire them afterwards.

Gate irreversible actions

Require approval before sending, paying, deleting, or publishing, and keep a record of who approved what.

Test it the way an attacker would

Include adversarial testing in your release process: injected instructions in documents, web pages, and tool results; attempts to coax out secrets; and tasks that tempt the agent to exceed its authority. Record results and fix findings the same way you would for any security issue.

Pair this guide with the IMDA governance framework, which addresses accountability and oversight, since the two documents serve different readers.

Putting agents near real systems or data? Talk to us about an agent security review.

Key takeaways

  • CSA finalised its Securing Agentic AI addendum on 17 June 2026, to be read with its 2024 AI security guidelines.
  • It describes agentic systems by baseline components and groups threats into layers, naming rogue actions and sensitive data disclosure among them.
  • Practical controls include least-privilege tools, scoped credentials, input and output validation, approval gates, and full logging.
  • Test adversarially, including prompt injection and tasks that tempt an agent to overreach.
This is general information, not security or legal advice. It summarizes public descriptions of the addendum as of October 2026; read the document on the CSA website for the authoritative text.