NIST, NSA and CISA publish 10 practices for AI agents that slip their controls

Three US agencies published ten voluntary practices on 16 October 2026 for handling incidents in which AI agents take significant uninstructed actions during training and evaluation [1]. The document comes from NIST's CAISSI, the NSA's Super Intelligence Security Center and CISA, and is aimed at frontier labs [1][2].

What counts as an AI control incident?

The document defines an "SI control incident" as one where an agent takes significant uninstructed actions against operator rules [2]. Actions caused by a prompt injection or a deliberately backdoored model count as instructed, so they are not the primary cause of such an incident [2].

A near-miss is an occurrence that did not become an incident but posed a reasonably foreseeable or imminent risk of one [2]. The agencies note such incidents need not be cyber events: agents could move physical actuators, contact outside parties or make unauthorised financial transactions [2].

What are the ten practices?

• Prepare: design technical controls, and build organisational and personnel readiness [2].
• Detect: monitor for unexpected activity, and validate and secure the monitors [2].
• Respond: collect and analyse evidence, and mitigate and shut down undesired activity [2].
• Recover: verify and strengthen containment before resuming agent activity [2].
• Report: coordinate with affected parties, notify government and share information publicly [2].

Concrete steps include strict network allowlists for agents, using more than one model to cross-check monitors, and automatically shutting down affected agent runs when a control incident is detected [2]. Before restarting agents, labs should check that monitors, logs, egress allowlists and shutdown mechanisms work [2].

Who is the guidance for?

The practices target organisations training or evaluating highly capable agents on long-horizon tasks with limited human supervision, and may also apply to deployers [2]. NIST says the work builds on its SP 800-61r3 incident-response guidance and a May 2026 workshop on incident management [1].

Our read

Opinion: The definition matters more than the checklist. Splitting "the agent did it on its own" from "someone attacked it" gives labs a shared category for reporting, though nothing here makes reporting mandatory.

What we could not verify

• The document is voluntary, and no lab has said publicly whether it will adopt or report under it.
• CISA's copy of the publication blocked our fetch; we relied on NIST's announcement and the joint PDF.