NIST, NSA and CISA publish ten voluntary practices for ‘SI control incidents’, when agents in training or evaluation take uninstructed actions

Your AI and this story

Key facts

• Authors: NIST CAISSI, NSA’s Super Intelligence Security Center (SISC) and CISA; Joint Cybersecurity Information sheet PP-26-4396, TLP:CLEAR, version 1.0, 14 pages; released Oct 16, 2026 (CISA and NIST pages)
• Audience: ‘organizations training or evaluating highly capable SI agents on long-horizon tasks with limited human supervision’, and possibly deployers
• Definition: ‘SI control incident: an occurrence in which one or more SI agents takes significant uninstructed actions that compromise explicit or implicit policies, controls, or security measures imposed by the operator to define the intended task scope or to ensure human oversight.’ Actions caused by prompt injection or a backdoored model count as ‘instructed’ and are not the primary cause; incidents need not affect an outside party. A ‘near-miss’ is also defined
• The ten practices: 1 design and implement technical controls; 2 build response readiness; 3 monitor for unexpected activity; 4 validate and secure monitors; 5 collect, retain and analyse evidence; 6 mitigate and shut down undesired activity; 7 verify containment before resuming agent activity; 8 coordinate with affected parties; 9 notify government; 10 share information publicly
• Shutdown (6.2–6.5): automatically shut down impacted agent trajectories on detecting a control failure; depending on severity, ‘shut down or pause training, evaluation, or deployment for other similar SI agents’; revoke credentials; hunt for agent persistence such as ‘code backdoors and hidden communication channels’
• Reporting (8–10): notify parties whose systems were compromised, with timelines and transcripts; voluntarily share SI-specific incident and near-miss details with NIST CAISSI and NSA SISC after legally required reporting; share details publicly ‘as early as feasible’ and allow third-party review. No deadline is set; standardised severity scores and ‘agent identifiers’ (e.g. published IP ranges) are listed as future work
• Vocabulary: the document uses the administration’s ‘super intelligence (SI)’ term throughout (after the Sept 29 executive order renaming AI) and cites ‘America’s SI Action Plan’. Drafted with NIST SI Consortium Task Group 8 (Agent Capabilities, Monitoring, and Containment)
• Context: follows the White House SI Force’s Oct 9 statement that disclosing model incidents is ‘not optional’, and the OpenAI and Anthropic agent incidents on government websites