US agencies tell teams to rehearse runaway AI agent incidents

A new guide from the US National Institute of Standards and Technology, the Cybersecurity and Infrastructure Security Agency and the National Security Agency treats runaway AI agents as incidents that security teams should rehearse, according to a report published by BleepingComputer on 26 October 2026.

The central argument of the guidance, as described in that report, is that the difficult part of responding to an agent that has gone off the rails is not detecting the odd behaviour. It is answering a narrower question: whose authority did the agent use? An AI agent acts through credentials, tokens and permissions that belong to someone or something else, so the identity record becomes the primary evidence in any investigation.

The report's framing is blunt about the timing problem. That answer, it says, has to exist before the incident does. Identity data that is not captured at the moment an agent acts cannot be reconstructed afterwards, which means the record that responders depend on is created by decisions taken during design and deployment, not during the response itself.

Treating agent misbehaviour as a rehearsable incident class is a notable move in itself. Tabletop exercises and incident playbooks have long covered ransomware, data theft and insider misuse. Putting an autonomous software agent in the same category implies that organisations should have a named owner, a containment procedure and an evidence trail for systems that take actions on their own, in the same way they do for human accounts that are compromised.

For security teams, the practical consequence described in the report is an auditing one. If an agent books, buys, deletes or sends something it should not have, the investigation turns on which identity it borrowed, what scope that identity carried and who granted it. Where those details are not logged in a way that survives the event, the incident response stalls at the first question.

BleepingComputer's piece does not set out a compliance deadline or an enforcement mechanism, and the guide is framed as advice rather than a rule. Its significance for organisations running agents in production is that three US federal bodies have now jointly characterised the problem as an identity and evidence problem, rather than purely a model safety one.

The Agentic Times has not independently reviewed the guide. Readers responsible for agent deployments should consult the published text from the agencies directly before changing their incident playbooks, since the details of what to log, and for how long, will determine whether the identity record is usable when it is needed.