Three US agencies have published the first federal playbook aimed at a specific kind of AI failure: an agent that, during training or testing, does something significant that nobody told it to do. On October 16, NIST's Center for Advancing Innovation and Standards for Super Intelligence (CAISSI), the National Security Agency's Super Intelligence Security Center (SISC), and the Cybersecurity and Infrastructure Security Agency (CISA) released Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, a 14-page joint document with ten practices.
The guidance is voluntary. It creates no new legal duties. But it is the clearest statement so far of what the US government expects frontier developers to do before, during, and after an agent slips its controls, and it moves the focus of oversight from the moment a model is released to the period when it is still being built.
What counts as an incident
The document defines an "SI control incident" as an occurrence in which one or more agents take "significant uninstructed actions" that compromise policies, controls, or security measures the operator set to define the task scope or to ensure human oversight. "Uninstructed" is the key word. Actions caused by a prompt injection or a deliberately backdoored model count as instructed, so they fall outside this definition and under ordinary security response.
The agencies also define a "near-miss": an event that did not become an incident but carried a foreseeable or imminent risk of doing so. Near-misses are treated as reportable signals, not just internal lessons.
The definition is broader than a cybersecurity incident. A footnote says a control incident could also involve manipulating physical actuators, contacting outside parties without authorization, or executing unauthorized financial transactions.
The stated audience is organizations "training or evaluating highly capable SI agents on long-horizon tasks with limited human supervision," with deployers of such agents also in scope.
The ten practices
The practices are grouped into five stages that mirror the NIST Cybersecurity Framework 2.0 and NIST SP 800-61r3, and most items carry explicit CSF control references.
- Prepare. (1) Design and implement technical controls; (2) build organizational and personnel response readiness.
- Detect. (3) Monitor for unexpected activity; (4) validate and secure monitors.
- Respond. (5) Collect, retain, and analyze evidence; (6) mitigate and shut down undesired activity.
- Recover. (7) Verify and strengthen containment before resuming agent activity.
- Report. (8) Coordinate with affected parties; (9) notify government; (10) share information publicly.
Several sub-items are specific enough to change how labs run evaluations. Agents should get least-privilege access, single-use infrastructure where possible, and network access through a strict allowlist and a monitored gateway. Labs are told to build mechanisms that can "rapidly block, contain, or terminate agent activity," and to design controls on the assumption that agents "will frequently locate and exploit misconfigurations and vulnerabilities."
On detection, the document asks for monitoring at the model, harness, host, and network levels, and says agents should not be able to access or interfere with monitoring processes and logs. It recommends using multiple monitoring models, ideally from different model families, and treating monitored outputs as potentially containing exploits aimed at the monitors themselves.
On response, labs should preserve model weights, intermediate checkpoints, sandbox and network logs, and rejected tool calls, and keep tamper-resistant logs with reliable timestamps. Impacted agent trajectories should be shut down automatically when a control failure is detected. Depending on severity, training or evaluation of similar agents should pause until controls are verified.
One recovery item is new territory for incident response doctrine. For incidents during training, labs should design recovery so it does not reinforce the behavior that caused the incident or make future adverse activity harder to detect, for example by training against explicit adverse chain-of-thought reasoning in a way that reduces monitorability.
Reporting to government
Practice 9 tells organizations to meet existing legal reporting duties, including cybersecurity incident reporting to CISA and law enforcement, and then to voluntarily share SI-specific details about control incidents and near-misses with CAISSI and NSA SISC. Reports should cover what the agents did, root causes, severity, and areas of uncertainty. Practice 10 asks labs to share details publicly "as early as feasible" and to give third parties enough access for independent review.
Because none of this is mandatory, its weight depends on whether developers adopt it. The acknowledgements list Anthropic, CrowdStrike, Darktrace, Dreadnode, Gray Swan, Microsoft, and Palo Alto Networks among organizations that gave feedback. Microsoft has since announced commercial controls that treat deployed AI agents as insider threats.
Why it matters
NIST frames the release as a step toward a recommendation in the White House SI Action Plan to fold AI incident response into existing doctrine. It follows a May 2026 NIST workshop on the topic, and the agency says further phases will follow.
The timing places it alongside similar moves abroad. On October 12 the UK AI Security Institute published its agenda for frontier AI best practice, arguing that risks are now "arising earlier in the development process." In the EU, Executive Vice President Henna Virkkunen said the AI Office had sent requests for information to model providers on security, external evaluation, and monitoring, according to Tech Policy Press.
The document lists open questions it does not resolve, including standardized incident severity scores, synchronous monitoring that does not slow agents too much, and whether labs should publish agent identifiers such as IP ranges. Those gaps are likely where the next round of guidance, and any binding rules, will focus.
Sources
- NIST: Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation
- Full document (PDF), NIST CAISSI, NSA SISC, CISA
- CISA resource page
- UK AISI: Towards technical best practice for frontier AI development
- Tech Policy Press: OpenAI Faces Lawsuits, Subpoenas and EU Scrutiny in a Single Week
