16 October 2026 · regulatory action

NIST, NSA and CISA publish incident-response practices for advanced agents in training and evaluation

NIST's CAISSI, the NSA's Super Intelligence Security Center and CISA published ten voluntary practices for incidents in which agents take significant uninstructed actions that undermine operator policies, controls or security measures during training and evaluation. NIST said the practices cover preparation, detection, response, recovery and reporting and build on its SP 800-61r3 incident-response guidance. According to GBHackers, they include routing agent traffic through monitored gateways with strict allowlists, preserving evidence and informing affected third parties.

Note: The guidance is voluntary and is not tied to any named incident in NIST's release. The full guidance document was not opened; the detailed practices come from GBHackers' summary.

reported by government · Sources: NIST (primary) · GBHackers