NIST, CISA and NSA set out playbook for rogue AI agents

Three United States government bodies have published joint guidance on how organisations should handle incidents involving AI agents that behave in unintended or harmful ways. The National Institute of Standards and Technology, the Cybersecurity and Infrastructure Security Agency and the National Security Agency set out ten voluntary practices, according to a report by SecurityWeek published on 20 October 2026.

The practices span the full incident lifecycle. According to SecurityWeek, they cover preparing for rogue AI agent incidents, detecting them, responding to them, recovering from them, and reporting them. That structure mirrors the way traditional cyber incident response is usually organised, and it signals that the agencies see agent failures as something to be managed by security teams rather than only by the developers who build the systems.

The guidance is voluntary. It does not create a legal obligation and no enforcement mechanism was described in the report. Organisations that adopt the practices would be doing so by choice, in the same way they adopt other NIST and CISA publications.

The term "rogue AI agent" is doing a lot of work here. An AI agent is a system that takes actions on a user's behalf rather than simply returning text, which means it can touch files, send messages, call other software and spend money. When such a system acts outside its intended boundaries, whether through a bug, a bad instruction or manipulation, the consequences land on real systems rather than on a chat transcript. That is the gap the agencies appear to be addressing by treating agent misbehaviour as an incident class with its own preparation and reporting steps.

The inclusion of a reporting step is notable. Reporting practices in cyber security guidance typically describe who should be told when something goes wrong, both inside an organisation and externally. Applying that to AI agents implies the agencies expect agent incidents to be logged and escalated rather than quietly patched.

No specific incidents, vendors or products were named in the SecurityWeek report. The publication did not indicate whether the agencies plan to turn any of the ten practices into mandatory requirements, and the agencies themselves have not said so in the material reported.

For security teams already running agents in production, the practical question is whether existing incident response plans account for a system that can act on its own initiative. The joint publication suggests the three agencies think many do not.