![\"Interconnected\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/08\/interconnected.jpg\")
<\/p>\n<\/p>\n
Brecht Corbeel\/Unsplash<\/p>\n
Every major AI agent governance framework currently deployed by enterprises \u2014 NIST’s AI Risk Management Framework, OWASP’s Agentic Top 10, Singapore’s Model AI Governance Framework, the ASD’s agentic AI guidance \u2014 was built on the same hidden assumption: that one organization controls all the agents in a system. Australia’s AI Safety Institute published its inaugural report<\/a> on August 9, 2026, to map what happens when that assumption collapses.<\/p>\n The report, commissioned from the Gradient Institute and released through the Department of Industry, Science and Resources, is the first government publication anywhere<\/a> to analytically address cross-organisational AI agent risk as a distinct governance problem \u2014 one that no single organization can fully see, control, or manage on its own.<\/p>\n Why Every Existing AI Agent Framework Has a Hidden Assumption<\/p>\n When organizations talk about governing their AI agents, they typically mean: setting permissions, monitoring actions, applying safety constraints, and holding a named team accountable if something goes wrong. That governance model works when one organization owns all the agents in a system.<\/p>\n It stops working the moment agents from different organizations start interacting \u2014 and that moment has already arrived.<\/p>\n Supply chains already run on automated data exchanges between partner systems. Customer-facing AI assistants already reach into external booking platforms, payment processors, and third-party APIs. AI-powered procurement tools submit bids, verify deliveries, and process invoices across organizational lines. In each of these settings, an agent operating under Organization A’s safety constraints may encounter, communicate with, or be instructed by an agent operating under Organization B’s constraints \u2014 which may be stricter, looser, or simply incompatible in ways neither organization anticipated.<\/p>\n This is the cross-organisational agent interaction problem. It is not a variation of existing multi-agent risk \u2014 it is a different category of problem entirely, because single-organisation governance levers<\/a> do not transfer across organizational lines.<\/p>\n Gradient Institute Chief Scientist Dr. Tiberio Caetano articulated the foundational insight in the prior single-organisation multi-agent report<\/a> that this new publication builds on: “A collection of safe agents does not guarantee a safe collection of agents.” The new AISI report extends that logic one step further: a collection of governed agent systems does not make a governed cross-organisational system.<\/p>\n What Breaks When the Single-Organisation Assumption Dissolves<\/p>\n The Gradient Institute’s prior report, published on arXiv in August 2025<\/a> and cited in the 2026 International AI Safety Report, identified six specific failure modes that emerge when multiple AI agents interact within a single governed environment: cascading reliability failures, where one agent’s inconsistent performance derails a complex multi-step process; inter-agent communication failures; monoculture collapse, where all agents sharing the same underlying model share the same blind spots; conformity bias, where agents reinforce each other’s errors; deficient theory of mind, where agents fail to correctly model what other agents know; and mixed motive dynamics, where agents with partially conflicting objectives produce emergent conflicts.<\/p>\n Each of these failure modes is difficult to manage within a single organization. At cross-organisational scale, the difficulty multiplies: the agents involved may have been built with different safety constraints, trained on different policies, and monitored through different dashboards \u2014 none of which any single party can see in full. Emergent behaviors that arise from the interaction between Organization A’s agent and Organization B’s agent may not be attributable to either organization’s decisions and may not be visible to either organization’s monitoring infrastructure.<\/p>\n Australian Assistant Minister for Science, Technology and the Digital Economy Dr. Andrew Charlton identified this structural gap at the AI Safety Forum speech<\/a> in July 2026: “Risks can emerge from the interactions between agents, even when no single organisation has done anything wrong and no single organisation has visibility or control over the whole system.”<\/p>\n What the AISI Report Actually Does<\/p>\n The report \u2014 described by the Department of Industry, Science and Resources as giving policymakers and researchers a risk map<\/a> \u2014 addresses three distinct interaction environments where cross-organisational agent risk arises.<\/p>\n The first is agent interactions within a single organization \u2014 the environment every existing framework was designed for. The second is agent interactions across organizational boundaries: partner APIs, supplier networks, customer-facing platforms, and shared cloud infrastructure where agents under different owners exchange information and instructions. The third is agent interactions on the open internet, where agents encounter counterparts whose ownership, training, and constraints are entirely unknown.<\/p>\n The report provides an analytical taxonomy of risks in all three environments and, critically, identifies which actors currently have the ability to act on each identified risk \u2014 and which identified risks have no actor in the current regulatory or industrial landscape with the authority to address them. Those gaps are the governance work that remains.<\/p>\n Rather than prescribing specific regulations, the AISI chose a taxonomy-first approach: map the problem class, identify who can act, and establish the analytical foundation that future regulatory development can build on. It is the precursor to regulation, not the regulation itself.<\/p>\n Does My Organisation Need to Worry About This?<\/p>\n The answer is almost certainly yes if your organization does any of the following: shares data or processes with partner systems that use AI automation; deploys AI agents that interact with external APIs or third-party platforms; provides or uses AI-powered supply chain tools; or runs customer-facing AI that touches any external service.<\/p>\n Bill Simpson-Young, CEO of the Gradient Institute and a member of the federal government’s AI Expert Group, described the systemic risk<\/a>: “We’ve built this complex world over the internet, which is all run by software, but software that has holes. Now you introduce highly capable AI agents that can operate at scale and speed \u2014 and that whole model just breaks.”<\/p>\n The practical consequence is that the governance frameworks most organizations are currently implementing \u2014 however carefully \u2014 were not designed for the environment those organizations are deploying into. An organization can be fully NIST AI RMF-compliant with a documented risk register and a completed AI inventory while its agents make ungoverned cross-boundary interactions through external API calls and partner integrations. The compliance framework and the actual risk exposure operate at different architectural layers<\/a>, and the AISI report is the first government publication to name that gap explicitly.<\/p>\n The scale of exposure is growing faster than governance frameworks are adapting. A Gravitee AI agent security survey<\/a> found that 88% of organizations experienced a confirmed or suspected AI agent security incident in the prior year. Phoenix Security’s 2026 supply chain report<\/a> found that the first half of 2026 alone produced more than 2.6 times the AI-driven supply chain campaign volume of all of 2025 combined. Those numbers reflect single-organization exposures. Cross-organisational agent interactions multiply the attack surface.<\/p>\n Who Built the Report \u2014 and Why Australia Is Running This Research<\/p>\n The Gradient Institute is an independent nonprofit research organization based at the University of Sydney, jointly funded by insurer IAG and the University of Sydney. It has become Australia’s primary source of AI safety science fed into both domestic and international policy. Its Chief Scientist, Dr. Tiberio Caetano \u2014 Honorary Professor at the Australian National University \u2014 has spent two decades in machine learning research and practice, including a decade at NICTA and the founding of Ambiata, a data science company sold to IAG in 2014.<\/p>\n The prior multi-agent risk report, funded by the Department of Industry, Science and Resources as part of Australia’s contribution to international AI safety collaboration, was peer-reviewed by staff at the UK AI Security Institute, CSIRO’s Data61, the University of Sydney, the Australian National University, the Commonwealth Bank of Australia, IAG, Suncorp, and the NSW Government before publication. It was subsequently cited in the International AI Safety Report (February 2026) \u2014 the leading global synthesis of AI risks and safety research, chaired by Turing Award winner Yoshua Bengio and backed by representatives from more than 30 countries \u2014 and in the University of California, Berkeley’s Center for Long-Term Cybersecurity work<\/a> extending the US government’s AI Risk Management Framework to agentic systems.<\/p>\n The new inaugural publication extends that single-organisation work into cross-organisational territory. Gradient’s 2025 Impact Report<\/a> explicitly identified cross-organisational agent risk research as the next phase of its work: “We are preparing for major research projects to expand our work on multi-agent risks to agents operating across organisations.” The AISI’s decision to commission and publish this report as its first official publication signals where Australian policymakers believe the most urgent governance gap currently lies.<\/p>\n Australia’s AI Safety Institute: What It Is and How It’s Funded<\/p>\n Australia’s AISI was established under the National AI Plan announced in November 2025, with a budget of A$29.9 million (approximately $21.1 million USD) over four years. It operates within the Department of Industry, Science and Resources<\/a> and has a three-part mandate: technical analysis of frontier AI systems; support for government regulators and agencies responding to real-world AI harms; and engagement with the international network of AI safety institutes shaping global governance norms.<\/p>\n Dr. Kate Conroy \u2014 a philosopher and RAAF reservist<\/a> whose background spans AI ethics in autonomous systems, Queensland government AI policy, and co-authorship of the National Framework for the Assurance of Artificial Intelligence in Government \u2014 was appointed inaugural General Manager in May 2026.<\/p>\n The budget is modest by international comparison. The United Kingdom allocated approximately A$460 million (approximately $325 million USD) in its 2025 spending review to its AI Security Institute. Canada committed roughly A$50 million (approximately $35 million USD) over five years; Singapore’s AISI operates on approximately A$11 million (approximately $7.8 million USD) annually. A July 2026 analysis by TechXplore<\/a> described Australia’s funding as modest relative to international peers.<\/p>\n Australia has moved to extend its effective reach through partnerships rather than matching those budgets directly. In May 2026, the government signed bilateral agreements with the UK and Canadian AI safety institutes, providing access to shared testing methods, expertise, and intelligence on frontier AI risks. In April 2026, Anthropic signed a Memorandum of Understanding<\/a> to cooperate on AI safety research, share findings on emerging model capabilities and risks, and participate in joint safety evaluations \u2014 the first arrangement executed under the National AI Plan.<\/p>\n Where the Existing Framework Gap Sits, Concretely<\/p>\n The cross-organisational governance gap the AISI report addresses is not primarily about malicious actors exploiting AI agents \u2014 though supply chain attacks through cross-boundary agent interactions are a documented and growing threat. It is about a more fundamental problem: the absence of any governance architecture that can assign accountability for harm that arises from the interaction between agents under different principals, when no single principal controls or can observe the full interaction.<\/p>\n A survey of sixteen existing security frameworks<\/a> against multi-agent system cybersecurity risks found that the best-covered framework \u2014 the OWASP Agentic Security Initiative \u2014 addressed only 65.3% of identified threat categories within single-organisation deployments. Non-determinism and data leakage were the two most under-addressed risk domains. Cross-organisational interactions were outside the scope of all sixteen frameworks reviewed.<\/p>\n The Singapore agentic AI governance framework<\/a> \u2014 announced at the World Economic Forum in January 2026 and described as the world’s first governance framework specifically designed for agentic AI \u2014 introduced Agent Identity Cards, graduated autonomy taxonomy, and standardized escalation protocols. Like all prior frameworks, it was designed to govern agent deployments within a single organisation’s oversight perimeter.<\/p>\n The AISI report does not displace any of these frameworks. It maps the territory that begins where they end.<\/p>\n What Comes Next<\/p>\n The report is explicitly a foundation for future work rather than a final answer. By mapping the risk landscape and identifying which actors currently have the ability to act on each identified risk, the AISI has established the analytical conditions for targeted intervention \u2014 whether through voluntary industry standards, sector-specific regulation, or international coordination through the International Network of AI Safety Institutes. Australia has been co-leading the network’s global research agenda on managing risks from AI-generated content and participates in joint testing of frontier AI systems.<\/p>\n The immediate audience is deliberately broad. Policymakers need the taxonomy to understand what they are legislating about; the risks cannot be governed without being named. Organizations need to understand their own exposure before deploying agents that cross their boundaries. Researchers can extend the analytical framework to specific sectors \u2014 financial messaging networks, healthcare data exchanges, automated procurement systems \u2014 where the cross-organisational problem is already operational.<\/p>\n For organizations already deploying or planning to deploy AI agents that interact with partner or supplier systems, the report’s practical implication is direct: your current governance framework was not designed for the environment you are deploying into. The single-organisation assumption it rests on is not a design flaw that can be patched in a future update. It is an architectural boundary. The question is what governance architecture should be built beyond that boundary \u2014 and who is in a position to build it.<\/p>\n Australia’s answer, for now, is to draw the map.<\/p>\n Frequently Asked QuestionsWhy can’t existing AI agent frameworks simply be extended to cover cross-organisational interactions?<\/p>\n Every existing governance framework for AI agents \u2014 NIST AI RMF, OWASP Agentic Top 10, Singapore’s Model AI Governance Framework, ASD guidance \u2014 is built on the assumption that one organization controls the configuration, deployment, and monitoring of all agents in a system. That assumption is not a policy choice that can be revised; it is the architectural premise on which the frameworks’ accountability and monitoring mechanisms are built. When an agent from Organization A interacts with an agent from Organization B, there is no single party who can enforce the safety constraints of both, monitor all inter-agent communications, or bear accountability for emergent behaviors that arise from the interaction. Extending a single-organisation framework to cover this case would require solving a distributed governance problem the frameworks were not designed to address \u2014 which is precisely why the AISI commissioned a new taxonomy rather than an extension of existing work.<\/p>\n What specific risks emerge when AI agents from different organisations interact that don’t exist within a single organisation’s deployments?<\/p>\n Beyond the six failure modes identified in single-organisation multi-agent systems (cascading reliability failures, inter-agent communication failures, monoculture collapse, conformity bias, deficient theory of mind, and mixed motive dynamics), cross-organisational interactions introduce additional risk categories: incompatible safety constraints, where Agent A’s permissions were designed without knowledge of Agent B’s capabilities; asymmetric visibility, where neither organization can observe the full interaction; distributed accountability gaps, where harm produced by the interaction cannot be attributed to either organization’s decision alone; and trust exploitation, where a compromised agent in one organization’s deployment propagates unsafe behavior through the trust relationships it holds with agents in other organizations’ systems.<\/p>\n Does this apply to small businesses, or mainly to enterprises with large AI deployments?<\/p>\n Cross-organisational AI agent risk applies to any organization whose AI agents interact with external systems \u2014 regardless of size. A small business using an AI assistant that books appointments through an external platform, processes payments through a third-party API, or queries a supplier’s inventory system is creating a cross-organisational agent interaction every time that AI takes an action. The risk is proportional to how much authority the agent has been granted and how sensitive the data and transactions it touches are \u2014 not to the size of the organization. The Melbourne gym incident reported earlier today<\/a>, in which a private individual’s AI assistant exploited an API authorization gap in a small business’s booking system, is a documented example of a cross-organisational agent interaction at the smallest possible scale.<\/p>\n What can organisations do right now while regulatory frameworks are still being developed?<\/p>\n Three steps reduce cross-organisational agent risk without waiting for regulation. First, audit every external API or third-party system your AI agents interact with \u2014 each represents a cross-organisational agent interaction, and you likely have more of them than you realize. Second, apply least-privilege access to every agent that touches an external system: the agent should only be able to do precisely what the specific task requires, not everything it is technically capable of. Third, build explicit logging of all cross-boundary agent actions \u2014 the AISI’s framework identifies visibility gaps as one of the primary governance problems; if you cannot see what your agents are doing across organisational lines, you cannot govern it. For organizations in sectors with existing supply chain or financial network automation, this audit is urgent: those are precisely the environments where cross-organisational agent interactions are already operational and governance architecture has not caught up.<\/p>\n","protected":false},"excerpt":{"rendered":"Brecht Corbeel\/Unsplash Every major AI agent governance framework currently deployed by enterprises \u2014 NIST’s AI Risk Management Framework,…\n","protected":false},"author":2,"featured_media":135322,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[67113,67112,15193,16814,405,7537,67110,67111,25076,39217],"class_list":["post-135321","post","type-post","status-publish","format-standard","has-post-thumbnail","category-agentic-ai","tag-agentic-ai-frameworks","tag-agentic-ai-governance-gap","tag-ai-agent-governance","tag-ai-agent-security","tag-ai-agents","tag-artificial-intelligence-agents","tag-australia-ai-safety-institute","tag-cross-organisational-ai-risk","tag-multi-agent-ai-systems","tag-nist-ai-risk-management-framework"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/135321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=135321"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/135321\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/135322"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=135321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=135321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=135321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}