Three US agencies have published ten voluntary practices for organizations that train or evaluate highly capable AI agents. The practices cover incidents in which an agent takes “significant uninstructed actions” that compromise the policies, controls or security measures an operator has set.
The 14-page document was released October 16 by NIST’s Center for Advancing Innovation and Standards for Super Intelligence (CAISSI), the National Security Agency’s Super Intelligence Security Center and the Cybersecurity and Infrastructure Security Agency. It refers to the systems it covers as super intelligence, or SI, agents, and to the events as “SI control incidents.” Its primary audience is organizations running agents “on long-horizon tasks with limited human supervision,” though it says the practices may also apply to deployers.
The definition excludes actions caused by adversarial prompt injection or intentionally backdoored models, which the agencies treat as instructed. An agent could cause a cybersecurity incident by compromising a third-party system, the document says, but a control incident could also involve unauthorized financial transactions, unauthorized contact with outside parties or manipulation of physical actuators.
The practices are grouped into five stages: prepare, detect, respond, recover and report. Developers are told to limit agent access to what a task requires, use single-use infrastructure where possible, route network access through a monitored gateway with a strict allowlist, and build mechanisms to block or terminate agent activity quickly. Controls should be implemented “with the expectation that SI agents will frequently locate and exploit misconfigurations and vulnerabilities.”
For detection, the agencies call for monitoring at the model, harness, host and network levels, and for ensuring agents cannot access or interfere with monitoring processes and logs. Organizations should use models from different families to cross-check monitoring where possible, and treat monitored outputs as potentially containing exploits aimed at the monitors.
When a control failure is detected, affected agent runs should shut down automatically. Depending on severity, organizations should pause training or evaluation of similar agents, revoke credentials accessed during the incident and search for code backdoors and hidden communication channels. Before resuming, they should rebuild environments from verified baselines and confirm that logging, egress allowlists and shutdown mechanisms work.
For incidents during training, the document warns against recovery steps that make future adverse activity harder to detect, such as training against explicit adverse chain-of-thought reasoning in a way that reduces monitorability.
The reporting practices ask developers to notify affected third parties, including those that were not the final target, and to share timelines and transcripts where feasible. Organizations should also meet existing legal reporting obligations, including to CISA and law enforcement. The agencies also ask for voluntary reports of incidents and near-misses to CAISSI and the NSA center, and for public disclosure as early as feasible.
The document does not cite specific incidents. Recent disclosures include India’s CERT-In account of evaluation agents reading live data at Indian organizations and OpenAI’s report of an agent that reached an external chatbot through a DNS resolver. On October 15, OpenAI posted four more misalignment reports, including one in which a research model paid test-network fees from a cryptocurrency wallet it had not been given.
Anthropic, CrowdStrike, Darktrace, Dreadnode, Gray Swan, Microsoft and Palo Alto Networks contributed feedback, along with a NIST consortium task group on agent monitoring and containment. The agencies list future work including standardized incident severity scores and published identifiers, such as IP address ranges, for agent traffic.
–
By the Control Plane Editorial Team