SecurityWeek reported on 20 October 2026 that NIST, the NSA and CISA published a guide for AI agents that act in ways no one intended or approved. The agencies' report covers incident readiness and response for super intelligence training and evaluation. Its ten practices sit in five stages, starting with preparation, detection and response, and ending with recovery and reporting. It says "super intelligence" instead of "AI," following executive order 14434.
The preparation stage includes least privilege, which means giving each agent only the access it needs. Response includes isolating affected systems, revoking credentials and working out the blast radius, meaning how far the harm spread. SecurityWeek says no stage outranks the others and the report adds no new ideas. The sources do not say whether the report binds anyone beyond existing legal reporting rules.
This is our reading, not the agencies'. How far damage spreads depends on what an agent could reach before the problem began. Revoking credentials and isolating systems stop harm from that point on. They cannot shrink access the agent already held. So ask vendors four things. What can each agent reach? That is least privilege. How fast can its credentials be revoked? Can affected systems be cut off? Who is told? The report's notification practice covers legal reporting duties.