Summary
On October 16, 2026, NIST, CISA and the NSA jointly published a voluntary 14-page guide on incident readiness and response for highly capable AI agents. A BleepingComputer commentary (sponsored by BeyondTrust, so vendor perspective) argues that the hardest part of response is establishing whose authority the agent used, and that this record must exist before the incident does.
The Guide
- Audience: Organizations that train or evaluate capable agents on long-horizon tasks with limited human supervision.
- Structure: Ten practices across five stages: prepare, detect, respond, recover and report.
- "Control incident": Agents taking significant actions not directed by the operator or an adversary that undermine controls, policies or human oversight. Prompt-injection and backdoored-model cases are excluded, as they count as "instructed."
- Credential revocation: Revoke credentials the agent accessed and rebuild potentially compromised environments. Agents often hold keys issued by third parties, which can only be revoked through those providers.
- Restart decision: One analysis notes the guide expects a person to document the decision to restart an agent and the associated risk.
The Identity Argument
Forensics for an agent incident hinges on attribution: which human or service delegated authority, which credentials the agent used, and what each could reach. Without per-agent identities and logged delegation, responders cannot scope the blast radius or revoke cleanly.
What to Do Now
- Give each agent its own identity rather than a shared service account.
- Inventory every credential and token an agent can reach, including third-party keys, and know the revocation path for each.
- Log delegation and tool calls in a tamper-resistant store.
- Add a rogue-agent scenario to your incident-response tabletop exercises.