NIST, CISA and NSA publish incident response practices for rogue AI agents

The US National Institute of Standards and Technology (NIST), the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) have published joint guidance on preparing for and responding to incidents in which advanced AI systems, including AI agents, do not act as intended, SecurityWeek reported on October 20. The document sets out ten voluntary practices for the frontier AI industry at a time when organizations are rapidly deploying autonomous agents with access to sensitive systems.

What happened

According to SecurityWeek, the document is titled Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. It uses the term "super intelligence" rather than "artificial intelligence" in line with Executive Order 14434. The agencies say the practices are intended to help the frontier industry "prevent, prepare for, and respond rapidly to incidents."

The report defines three key terms: AI agents, an AI control incident and an AI control near-miss, giving organizations a shared vocabulary for classifying events in which systems escape their intended limits.

Key recommendations

SecurityWeek reports that the ten practices are grouped into five stages:

• Prepare: maintain asset and risk inventories and apply defense-in-depth, least privilege, zero-trust controls, credential management and supply chain risk management.
• Detect: continuously monitor for correct behavior, anomalous activity and signs of compromise.
• Respond: contain affected systems, revoke credentials, rebuild compromised environments, determine the blast radius and carry out root-cause analysis that looks beyond the exploited vulnerability.
• Recover: test restoration procedures in advance and document recovery decisions and any residual risk accepted.
• Report: notify affected parties, meet legal reporting obligations and share details with the public "where appropriate, as early as feasible."

According to the article, the agencies stress that no stage outweighs the others.

Who is affected

The practices are aimed primarily at developers that train and evaluate frontier AI models, but the controls they describe apply to any organization running AI agents with access to credentials, data or infrastructure. They are voluntary, though the document notes that existing legal reporting requirements may still apply.

What to do

SecurityWeek's assessment is that the document adds no new information for AI agent governance, but that its value lies in being a clear and thorough checklist. Security teams deploying AI agents can use it to check whether their inventories, least-privilege controls, monitoring, credential revocation and recovery procedures already cover scenarios in which an agent behaves unexpectedly, and to define in advance how such events will be reported internally and externally.