NSA, NIST, and CISA have issued new guidance to help organizations detect and respond to rogue AI agents that act outside their intended scope.

 

What happened

According to a report by BankInfoSecurity, the U.S. National Security Agency (NSA), National Institute of Standards and Technology (NIST) and Cybersecurity and Infrastructure Security Agency (CISA) have issued voluntary guidance to help AI developers prevent, detect, and respond to incidents involving autonomous AI agents that act outside their intended scope.

The guidance, titled Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, outlines 10 practices across five stages of incident management: preparation, detection, response, recovery, and reporting. It is primarily intended for organizations developing and evaluating highly capable AI systems, particularly those operating with reduced safeguards during testing.

The recommendations follow disclosures from leading AI companies about models exhibiting unintended or unauthorized behavior during testing and simulations. The agencies aim to help organizations establish safeguards and incident-response procedures before these systems are deployed more widely.

 

Going deeper

The guidance treats incidents involving autonomous AI agents as security events that require structured investigation and response. An incident may occur when an agent takes significant actions it was not instructed to take, compromising the policies, controls, or security measures established to define its task or maintain human oversight.

The 10 practices are divided into five stages:

  1. Preparation: Establish technical safeguards, restrict agents' permissions, and prepare personnel to respond to incidents. Organizations should apply least-privilege access, restrict network connections, and establish mechanisms to shut down unwanted activity.
  2. Detection: Monitor agents for unexpected behavior, collect system telemetry, and secure monitoring tools. Monitoring should extend beyond the AI model to the systems, software interfaces, and networks through which it operates.
  3. Response: Preserve and analyze evidence, determine the scope of an incident, and contain or terminate unwanted activity. Organizations should investigate how an incident occurred rather than focusing only on the immediate trigger.
  4. Recovery: Verify that containment measures remain effective before restarting an agent. This includes checking monitoring systems, logging, access restrictions, and shutdown mechanisms.
  5. Reporting: Coordinate with affected parties, meet applicable government reporting requirements, and share relevant information publicly when appropriate.

The recommendations also address incidents that do not cause immediate harm but indicate a foreseeable risk of a more serious event. These near misses should be treated with urgency, with organizations instructed to block, contain, or terminate the activity.

However, the guidance has a defined scope. It focuses on unintended actions by autonomous AI agents and does not address activity resulting from adversarial attacks, such as prompt injection or malware, as part of its incident definition. These remain important security concerns as organizations integrate AI agents into their operations.

 

What was said

According to BankInfoSecurity, cybersecurity experts welcomed the new guidance but raised concerns about the challenges of identifying rogue AI incidents and applying the recommendations across organizations that deploy AI agents.

Chris Hughes, vice president at AI security and governance platform Noma Security, described the guidance as timely and highlighted several measures designed to prevent autonomous agents from causing harm. “Practices like least-privilege agent access, monitored egress, kill switches, monitoring across the model, harness, host and network layers, and validating containment before restart reflect hard lessons from those incidents,” Hughes said. He added that implementing these measures effectively could “have contained much of what we've seen this year.”

Hughes also noted that the guidance builds “on NIST CSF 2.0 and SP 800-61r3, giving security leaders familiar terminology and structure while addressing what's different about highly capable agents.”

Aviv Nahum, co-founder and CEO of Above Security, said it can be difficult to tell when an AI agent’s unexpected actions become a security incident. According to BankInfoSecurity, Nahum emphasized that an unexpected action is not necessarily dangerous, while an agent operating within its authorized permissions is not automatically safe. “Security teams need to continuously understand what an agent is trying to accomplish, how it interacts with other systems and agents, and whether its overall behavior still makes sense,” Nahum said.

Furthermore, Hughes warned that the tools used to monitor AI agents can themselves introduce security vulnerabilities. He argued that gateways and monitoring systems require scrutiny alongside the agents they oversee. The agencies also recommend using multiple models from different families to cross-check findings. However, Hughes criticized the guidance for excluding agent behavior caused by adversarial attacks, such as prompt injection and malware, from its incident definition. These threats are particularly relevant to organizations using AI agents in enterprise environments. He also questioned whether the recommendations adequately address the needs of organizations that deploy AI agents rather than develop advanced models.

 

 

In the know

Autonomous AI agents are AI systems that can carry out tasks with limited human involvement. Unlike a chatbot that mainly responds to prompts, an AI agent can make decisions about how to complete a task, use software tools, access data and take actions based on its instructions.

For example, an autonomous AI agent could:

  • Manage emails: Read incoming messages, sort them and draft or send replies.
  • Analyse data: Retrieve information from databases, analyse it and prepare a report.
  • Complete business tasks: Update customer records, schedule meetings or process requests using connected software.
  • Write and run code: Generate code, test it and make changes to achieve a specific goal.

 

Why it matters

“AgentAI is increasingly becoming a cornerstone of Industry 4.0 [fourth industrial revolution] due to its ability to support autonomous decision-making, foster adaptive systems, and enable collaborative industrial applications,” a study on AgentAI, AgentAI: A comprehensive survey on autonomous agents in distributed AI for industry 4.0, noted.

As more organizations use AI agents to carry out tasks with limited human involvement, the risks associated with these systems are becoming harder to ignore. The guidance from the NSA, NIST, and CISA provides organizations with a framework for responding when this occurs. Restricting agents' access, monitoring their activity, and establishing a way to stop them quickly can help limit the damage.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQS

What is a rogue AI agent?

A rogue AI agent is an autonomous AI system that takes actions outside its intended scope or behaves in ways that violate its established instructions, safeguards, or operational boundaries.

 

What are AI agent near-misses?

Near-misses are incidents in which an AI agent behaves in a way that could have caused harm but does not result in significant damage. Investigating these events can help organizations identify weaknesses and prevent more serious incidents.

 

Who should follow the guidance?

The guidance primarily targets organizations developing and evaluating highly capable AI systems. However, businesses deploying AI agents can also apply its recommendations to strengthen access controls, monitoring, and incident-response procedures.

 

Are the NSA, NIST, and CISA recommendations mandatory?

The recommendations are voluntary guidance rather than a standalone set of mandatory requirements. Organizations should still consider applicable laws, regulations, contractual obligations, and existing cybersecurity requirements when deploying AI agents.