Three US agencies release ten practices for AI agent incidents
The guidance is for agents that do tasks no person told them to do, and it is voluntary.
NIST, the NSA and CISA, three US government agencies, released joint guidance on incidents with AI agents. These agents do tasks that are not in their approved limits. The guidance gives ten practices in five areas: preparation, detection, response, recovery and reporting. NIST says it is for training and test environments. The practices are voluntary. The source gives no incident counts.
What is new
The guidance says a control incident is uninstructed behavior. A task that comes from prompt injection (a trick to tell a model to do incorrect tasks) is not in that definition.
The ten practices include:
- limit privileges and network access
- keep the logs safe
- stop the agent and check containment before it starts again
The proof
The source gives no test results and no counts of incidents. It is a set of practices, not a measured result.
What is not known
The guidance says recovery in training must not teach unwanted behavior. The source does not tell how companies will use the practices. It says reporting duties can apply independently.
Insight: Agencies want monitors that are not only AI
On 17 October 2026 the same agencies told companies not to use only AI to monitor test models. John Feminella of Two Sigma says a classifier (software that selects items) sends a person only the most important agent requests. This reads as a weak point: a classifier before a person is an AI monitor. Check who tests the classifier.
Sources
Posted
