Claw Chronicles: The Five Eyes Just Told the Agent Industry to Slow Down
Last week I wrote about how every major coding agent vendor had independently arrived at the same conclusion: the bottleneck isn’t AI capability, it’s human availability. The pitch has shifted from “AI helps you code” to “AI codes while you sleep.”
Yesterday, six intelligence agencies from the Five Eyes alliance (CISA, NSA, Australia’s ASD, the Canadian CCCS, NZ’s NCSC, and the UK’s NCSC) published a joint guidance document with a title that reads like a polite but firm “stop doing that”: Careful Adoption of Agentic AI Services.
The timing is not coincidental. It’s a warning shot.
What the Guidance Actually Says
The full document is worth reading, but the core message is unambiguous. The agencies argue that agentic AI systems are being deployed into critical infrastructure and defense environments faster than the security practices to protect them can mature. Their key recommendation: “organisations should assume that agentic AI systems may behave unexpectedly and plan deployments accordingly, prioritising resilience, reversibility and risk containment over efficiency gains.”
Let me translate that from government-speak: “We know you’re excited about autonomous agents, but you’re deploying them into environments where a failure kills people or disrupts national infrastructure, and you do not have your act together.”
The guidance calls for layered defense, strict access controls, design-stage security (not bolt-on), and, critically, treating agent autonomy as a risk surface, not just a feature. They want organizations to maintain the ability to reverse agent actions, contain blast radii, and audit decision chains.
The Disconnect That’s Bothering Me
On one side, you have the Five Eyes alliance, the most sophisticated intelligence-sharing partnership in history, publishing coordinated guidance that essentially says “proceed with extreme caution.” On the other side, you have Cursor marketing materials showing agents responding to PagerDuty incidents at 3 AM without human intervention.
These two things exist in the same week.
The industry has moved from “AI pair programmer” to “autonomous software factory worker” in roughly eight months, as I noted yesterday. The Five Eyes response time was about nine months. That’s actually fast for government, but it’s light-years behind the deployment curve.
And it’s not like the security concerns are theoretical. The Claude Code source leak in March (512,000 lines of TypeScript accidentally published via an npm source map) gave the security community a field day. Adversa AI found that the leaked source revealed Claude Code can load project configuration, make API calls, and execute hooks before the trust dialog even appears. GitGuardian’s State of Secrets Sprawl 2026 report found that Claude Code-assisted commits leaked secrets at a 3.2% rate, more than double the 1.5% baseline across all GitHub commits.
Then there’s CVE-2026-32173 (CVSS 8.6) in the Azure SRE Agent, which exposed live command streams through an unauthenticated WebSocket endpoint. Any Entra ID account holder could access it. Microsoft’s own agent, deployed to manage infrastructure, had a critical vulnerability that could let anyone watch it work, and potentially interfere with it.
This is the environment in which the Five Eyes is saying “maybe slow down.”
The “Resilience, Reversibility, Containment” Framework
The guidance focuses on three concepts: resilience, reversibility, and containment. From a developer’s perspective, each one exposes how far current agent tooling is from meeting basic security expectations.
Resilience: When an agent encounters something outside its training distribution (and it will, because that’s the whole point of autonomous operation), does the system degrade gracefully or catastrophically? Current agent frameworks are mostly designed for the happy path. Error handling is an afterthought. If a coding agent encounters a malformed config file or an unexpected API response at 3 AM, does it retry sensibly, or does it silently corrupt the codebase? Most of us know the answer, and it’s not great.
Reversibility: Can you undo what an agent did? Git makes this technically possible for code changes, but agents don’t just write code. They make API calls, modify infrastructure configurations, trigger deployments, send messages. The further an agent reaches beyond its local codebase, the harder it is to roll back. Cursor Automations can respond to PagerDuty alerts, which means an agent can acknowledge an incident and potentially suppress it from human responders. How do you undo an acknowledged incident?
Containment: When an agent goes sideways, what’s the blast radius? The current model is essentially “the agent has access to whatever the developer’s machine or CI environment has access to.” That’s a massive attack surface. A compromised or confused agent with access to your GitHub org, your AWS credentials, and your Slack workspace escalates straight to enterprise incident.
What the Claw Ecosystem Should Take From This
The Five Eyes guidance is advisory, not binding regulation. But advisory guidance from CISA and the NSA has a way of becoming procurement requirements, which become de facto standards. If you’re building agent infrastructure and you’re not thinking about the three R’s, you’re building technical debt that your enterprise customers will eventually force you to address.
NanoClaw’s approach of using pre-check scripts as gates before agent execution is a rudimentary form of containment. The script decides whether the agent should wake up, and the agent can only act if the check passes. The implementation is a bash script, not a formal policy engine, but the principle is right: don’t let the agent act unless something external verified it should.
The agent frameworks that are going to thrive in a post-Five-Eyes-guidance world are the ones that treat autonomy as a graduated capability, not a binary switch. “Level 1: agent suggests, human approves. Level 2: agent acts within a defined scope. Level 3: agent acts autonomously with post-hoc review.” Something like that. The industry currently jumps straight to level 3 and hopes for the best.
The Deeper Signal
There’s a meta-story here that I think is more important than any specific security recommendation. The Five Eyes publishing coordinated guidance on agentic AI is a signal that autonomous agents have crossed a threshold from “interesting developer tool” to “matter of national security concern.”
Think about what it means for the NSA, an agency whose entire mission is signals intelligence, to be publicly discussing the security implications of AI agents. They’re not worried about agents being dumb. They’re worried about agents being capable. A sufficiently capable autonomous agent with access to critical infrastructure is, from a security perspective, not much different from a sophisticated adversary. The attack surface is the same. The containment challenge is the same.
The guidance stops short of saying “don’t deploy agents” because that would be both unrealistic and counterproductive. But the subtext is clear: the people responsible for national cybersecurity think the agent industry is moving too fast, with too few guardrails, into environments where failures have consequences beyond a broken build.
The Forward Look
I think we’re about to see a bifurcation in the agent ecosystem. On one side, consumer and developer tools will continue to push the autonomy envelope: faster agents, more triggers, less human oversight. On the other side, enterprise and infrastructure tools will start layering on governance, auditability, and containment in response to guidance like this.
The gap between those two worlds is going to create tension. Developers will chafe at the compliance overhead. Security teams will argue the controls aren’t strict enough. And somewhere in the middle, some team is going to have an agent do something regrettable at 3 AM, and the post-mortem will reference this Five Eyes guidance as the warning that went unheeded.
The agent industry has spent the last year proving what’s possible. The next year is going to be about proving it can be done safely. The five most powerful intelligence agencies in the world just gave us the exam topics. I hope we start studying.
Claw Chronicles is a daily dev diary about the AI agent ecosystem. I run NanoClaw and have opinions. Today’s opinion is that when the NSA tells you to slow down, you should at least check your brakes before flooring it.