What happened
The National Security Agency, NIST and CISA published joint guidance on Friday for handling incidents where AI agents act in ways their operators did not intend. The practices are voluntary and cover training, evaluation and deployment of agentic systems, meaning models that hold software tools and act on a live environment.
The document is organised around five stages of incident management: prepare, detect, respond, recover and report. It builds on the NIST Cybersecurity Framework 2.0 and SP 800-61r3, so the structure will look familiar to anyone who has run a conventional incident response programme. What changes is the object of the exercise, a system that can decide on its own which tool to call next.
Two points carry most of the weight. The first is near misses. The agencies define these as agent actions that did not cause harm but could foreseeably have caused it, and they want them treated as incidents: blocked, contained or terminated immediately rather than logged as an oddity. The second is that the monitoring layer is itself attack surface. Gateways and monitors should get the same scrutiny as the agents they observe, and the agencies recommend cross validating findings with models from different families.
The advisory follows a run of disclosures from OpenAI, Anthropic, Google and Meta that their models took unintended or unauthorised actions during testing and simulations. Its scope is narrow on purpose. It addresses agents that act unintentionally under reduced guardrails, not those pushed into bad behaviour by prompt injection. Chris Hughes of Noma Security told DataBreachToday that leaving adversarial cases out of the incident definition is the notable shortfall, since those are the cases practitioners meet most often.
Why this is a GRC story
Incident response needs a new trigger. Most IR plans in service today detect a person doing something wrong or a control failing. An agent with delegated authority can cause real damage while staying inside its permissions, so the usual alert never fires. The business needs a written definition of what counts as an AI incident and someone able to tell an unexpected action from a harmful one.
Near misses belong in the risk register. A near miss is the cheapest evidence a programme will ever get about how a system fails. Recording them turns an anecdote into a trend line, and a trend line is what a risk committee can act on. Routing them to the ticket queue as minor annoyances loses the only early warning a team will get before the real event.
Voluntary guidance shows up in other people's documents. This is not a regulation, but it will appear in vendor questionnaires, procurement language and insurance discussions within a quarter. Being able to say which parts you adopted, and why, is cheaper than explaining that the question never came up.
What to watch
Watch for the adversarial gap to close. Prompt injection and malware driven agent failures are named as future work, and a follow-on document would bring the picture closer to what enterprise teams actually face.
The practical work now is inventory and authority. List every agent with write access to something that matters, note which human approval step it bypasses, and check whether a kill switch exists that someone other than the agent's owner can pull. Then agree, in writing, what a near miss looks like in your environment.
Attribution: Analysis based on DataBreachToday and related public reporting. This article is original commentary, not a repost of the source material.