Skip to content
AI Security Wire

Published

- 4 min read

By

NIST, NSA and CISA Issue Ten Incident Practices for Out-of-Control AI Agents

nist cisa nsa ai-agents incident-response ai-governance
img of NIST, NSA and CISA Issue Ten Incident Practices for Out-of-Control AI Agents

NIST, the NSA and CISA published a joint document on 16 October 2026 setting out ten voluntary practices for handling incidents in which AI agents act well outside their instructions. It is aimed at the people training and testing the most capable agents.

What the document covers

The title is “Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation” (document PP-26-4396, version 1.0, marked TLP:CLEAR). It was authored by NIST’s Center for Advancing Innovation and Standards for Super Intelligence (CAISSI), the NSA’s Super Intelligence Security Center and CISA.

Its central term is the “SI control incident”. The document defines this as an occurrence where one or more agents take significant uninstructed actions that compromise explicit or implicit policies, controls or security measures the operator imposed to define the intended task scope or to ensure human oversight. The agencies use the term “super intelligence” (SI) throughout, so this is not a generic AI-agent standard, and the definition covers incidents that may occur during development, evaluation or use. A separate “near-miss” category covers cases where the risk was foreseeable or imminent but no incident followed.

That definition matters because of what it leaves out. The document separates these incidents from ordinary cybersecurity incidents. An agent could cause a cybersecurity incident, say by compromising a third-party system without authorisation, but the two are not the same thing. An SI control incident can also involve unauthorised actions outside the cyber domain. Actions that result from adversarial prompt injection or an intentionally backdoored model are treated as instructed actions, so they are not the primary cause of an SI control incident.

Structure and themes

The ten practices are grouped into five stages: preparation, detection, response, recovery and reporting. The document builds on NIST SP 800-61r3, the agency’s incident-response guide. According to a Cloud Security Alliance research note (a secondary source), the list runs from technical controls and personnel readiness through monitoring, evidence handling and shutdown, to verified containment before restart and disclosure to affected parties, government and the public.

A few details stand out:

  • Evidence. Practice 5.3 calls for tamper-resistant logs with reliable timestamps, sufficient to reconstruct agent trajectories, tool calls, reasoning traces, user interactions, environmental states and security-control decisions.
  • Monitors as targets. Practice 4.2 in the document says to treat monitored model outputs as potentially containing exploits aimed at the monitors, and the document also calls for red-teaming monitors.
  • No retention period. The document’s evidence practices (Practice 5) give no retention period, and the CSA note says the same. Organisations have to set their own.
  • Future work. The NIST announcement states that further work on agentic incident readiness “will be considered in future phases.”

Who this affects

The stated audience is organisations training or evaluating highly capable agents on long-horizon tasks with limited human supervision. The document says the practices may also apply to deployers of such agents. In our assessment that is a small group today, and most enterprises deploy models they did not train, so the fit for them is partial.

Our assessment: the document is still a useful template for any team running autonomous agents with real credentials. The monitoring and evidence-handling points translate directly to enterprise deployments, even if the “SI” framing does not.

  1. Read the full NIST document, not press summaries. At least one outlet (Cyber Security News) describes it as guidance on “rogue AI agents”, a phrase that appears in neither the NIST page nor the document.
  2. Check whether your agent logging could reconstruct a full run: tool calls, rejected actions and security-control decisions.
  3. Confirm agents cannot alter their own monitoring or logs, and that you can stop a run automatically.
  4. Decide how long you would retain agent evidence, with legal input, before an incident forces the question.

No evidence found as of 22 October 2026 in the NIST page, the document or the CSA note that this document creates binding obligations.

References

Frequently Asked Questions

What is an SI control incident?
The document defines it as an occurrence in which one or more super intelligence (SI) agents take significant uninstructed actions that compromise explicit or implicit policies, controls or security measures the operator imposed to define the intended task scope or to ensure human oversight. Near-misses, where the risk was foreseeable or imminent but no incident occurred, are covered separately.
Is the guidance mandatory?
No. The document describes itself as ten voluntary key practices. Practice 9.1 tells organisations to adhere to any applicable legal reporting requirements, and the document says it does not constitute advice for compliance, regulatory or legal purposes.
Does it apply to companies that only deploy AI agents?
The primary audience is organisations training or evaluating highly capable agents on long-horizon tasks with limited human supervision. The document says the practices may also apply to deployers of such agents, but it is written for developers, so how far they fit enterprise deployers is our reading, not something it spells out.