{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,22]],"date-time":"2026-10-22T19:39:19Z","timestamp":1792697959948,"version":"4.5.0"},"reference-count":0,"publisher":"EDP Sciences","license":[{"start":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T00:00:00Z","timestamp":1792713600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.edpsciences.org\/en\/authors\/copyright-and-licensing"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Security and Safety"],"accepted":{"date-parts":[[2026,10,22]]},"abstract":"<jats:p>On 1 May 2026, six Five Eyes cybersecurity agencies jointly issued Careful Adoption of Agentic AI Services, the first coordinated Anglophone statement on the governance of LLM-based autonomous agents. This Comment argues that, although the Guidance offers competent cybersecurity risk management within its stated remit, its institutional weight invites a broader governance reading that the document cannot bear, and that five structural limitations then come into view. First, the cybersecurity doctrines on which it relies are necessary but insufficient for agentic systems, whose delegated authority, underspecified goals, and long-horizon autonomy strain the assumptions of conventional controls. Second, it privatises systemic risk by imposing duties on deployers without specifying public-law obligations, redress, or liability across the agentic value chain. Third, it prescribes human oversight without specifying the conditions of effective control, so that responsibility risks being assigned to reviewers who lack the information, authority, or time to exercise it. Fourth, it reduces accountability to auditability, confusing a technical property with a legal relation between duty-holders and affected parties. Fifth, the security-defined mandates of its six authoring agencies, and the intelligence-oversight structures within which most of them sit, raise questions of institutional voice, while its Five Eyes-only authorship raises a risk of divergence from the AI frameworks now emerging in the European Union, the Republic of Korea and Japan. The Comment concludes by outlining the elements of an enforceable, rights-protective, cross-jurisdictional legal regime that should supplement, rather than be displaced by, the technical controls the Guidance recommends.<\/jats:p>","DOI":"10.1051\/sands\/2026025","type":"journal-article","created":{"date-parts":[[2026,10,22]],"date-time":"2026-10-22T18:46:51Z","timestamp":1792694811000},"source":"Crossref","is-referenced-by-count":0,"title":["Patch Management or Public Law? A Critical Comment on the Five Eyes Guidance for the Careful Adoption of Agentic AI Services"],"prefix":"10.1051","author":[{"given":"Hong","family":"Wu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"250","published-online":{"date-parts":[[2026,10,23]]},"container-title":["Security and Safety"],"original-title":[],"link":[{"URL":"https:\/\/sands.edpsciences.org\/10.1051\/sands\/2026025\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,10,22]],"date-time":"2026-10-22T18:46:51Z","timestamp":1792694811000},"score":1,"resource":{"primary":{"URL":"https:\/\/sands.edpsciences.org\/10.1051\/sands\/2026025"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10,23]]},"references-count":0,"alternative-id":["sands20260019"],"URL":"https:\/\/doi.org\/10.1051\/sands\/2026025","relation":{},"ISSN":["2826-1275"],"issn-type":[{"value":"2826-1275","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,10,23]]}}}