US agencies publish steps for handling AI agent control incidents

In short

Three US government bodies have published ten voluntary practices for groups that train and test very capable AI agents. The bodies are CISA, the NSA and NIST. The document is guidance. It does not describe a specific incident.

What happened

CISA, the US cyber defense agency, published the document on October 16, 2026. The National Institute of Standards and Technology (NIST) and the National Security Agency's Super Intelligence Security Center (NSA SISC) are named as co-publishers.

The document is called Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. It is meant for organizations that train and evaluate highly capable "super intelligence" (SI) agents. CISA says it is aimed in particular at agents that have not yet been released and that have reduced safeguards, or at other high-risk systems that are not public.

CISA defines an "SI control incident." This is when one or more SI agents take actions nobody told them to take, and those actions conflict with or compromise the policies, controls or security measures that set the limits of a task and let humans oversee it.

The agencies say the guidance follows standard cyber incident response practice, with extra points specific to SI agents. It also stresses testing controls and checking that an agent is properly contained before its activity resumes.

According to CISA, the practices cover:

• limiting an agent's access to information, systems, tools and networks;
• monitoring for unexpected activity;
• preserving evidence and shutting down unwanted behavior;
• rebuilding from verified baselines, meaning systems known to be in a good state; and
• reporting incidents and near-misses to relevant government agencies and affected parties.

What was done about it

The page describes no incident and no response to one. The publication is itself the action: the agencies released the practices for organizations to adopt if they choose. CISA also points readers to its Super Intelligence page for more resources. The practices are voluntary.

Why it matters

CISA's page does not give a long explanation. It says the practices are meant to help organizations prepare for and manage SI control incidents, and it stresses testing controls and confirming containment before agent activity restarts. The page does not say whether any such incident has happened. For the full text, see the original report.