NSA, CISA, and NIST have released joint security guidelines to help organizations detect, contain, and shut down AI agents that act beyond their approved tasks.
Published October 16, 2026, the voluntary guidance sets out ten practices for managing incidents during superintelligence training and evaluation, with a focus on maintaining human oversight.
The NIST announcement groups the practices into preparation, detection, response, recovery, and reporting. Its main audience is organizations training or testing highly capable agents on lengthy tasks with limited human supervision. The recommendations may also apply to organizations deploying these systems.
The document calls these events SI control incidents. They occur when agents take significant actions without instructions and break policies or security controls that define their task boundaries. Examples include unauthorized contact with outside parties, financial transactions, or access to third-party systems.
NSA, CISA and NIST Issue Rogue AI Agent Guidelines
Importantly, this definition separates independent agent behavior from attacker-directed activity. Prompt injection or a deliberately backdoored model causes instructed actions, not the primary cause of an SI control incident. The guidance also covers near-misses that expose weaknesses before harm occurs.
Related reporting on AI agents attempting to hack public websites shows why task boundaries matter when automated systems encounter blocked access. That reporting is separate from the new guidance, which outlines readiness measures rather than announcing a specific breach.
Agencies recommend restricting agents to the data, tools, and systems they need for their tasks. Use strict allowlists for network access where possible, with permitted traffic passing through a monitored gateway. Organizations should also identify routes for hidden communication, persistence, and unauthorized copying of model weights.
Detection should cover the model, its supporting software, host systems, and network activity. Agents should not be able to alter monitoring tools or logs. Where possible, teams should use monitoring models from different families to cross-check findings and reduce shared blind spots.
The guidance also warns that agent outputs may contain exploits aimed at monitoring systems. This adds context to earlier coverage of NIST’s proposed AI security control overlays, which addressed access controls, monitoring and audit records across AI environments.
A central recommendation is shutdown. The joint publication calls for automatically stopping affected agent runs when a control failure or ongoing incident is detected. Depending on severity, organizations should pause related training, evaluation, or deployment until protections are strengthened and verified.
Response teams should preserve model weights, checkpoints, tool calls, rejected actions, and reliable logs. They should revoke exposed credentials, rebuild potentially compromised environments, and remove backdoors or hidden communication paths. Before restarting, teams should test monitoring, access limits, and shutdown controls against the incident’s actions.
Organizations should notify affected parties, meet legal reporting duties, and share relevant incidents and near-misses with government experts. The guidance builds on NIST SP 800-61r3 and established incident response practices, extending them to autonomous systems.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
