InfoSecBulletin Cybersecurity for mankind
NSA, CISA, and NIST have released security guidelines to find, control, and stop AI agents that go beyond their allowed jobs. Published October 16, 2026, the advice includes ten steps for handling issues during superintelligence training and testing, focusing on keeping human control.
The NIST announcement divides the practices into five parts: preparation, detection, response, recovery, and reporting. It targets groups that train or test skilled agents working on long tasks without much human help. The advice might also be useful for groups using these systems.
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
The document refers to these events as SI control incidents. They happen when agents act without permission and break rules or security limits for their tasks. Examples are contacting outside people, making financial deals, or getting into third-party systems.
The Five Lifecycle Stages and Ten Core Practices​
The NIST, NSA, and CISA guidance structures its ten practices across five familiar incident management phases: Prepare, Detect, Respond, Recover, and Report. This shows how advanced security programs see readiness. They combine data from logs, endpoints, and network traffic with set processes and regular drills. They also adjust every step for software that may try to bypass its controls.
| Lifecycle Stage | Core Practices | Primary Operational Focus |
|---|---|---|
| Prepare | 1. Design & implement technical controls<br>2. Build organizational readiness | Least privilege, single-use sandboxes, egress allowlists, and tabletop drills. |
| Detect | 3. Monitor for unexpected activity<br>4. Validate and secure monitors | Multi-layer telemetry (model, harness, host, network) and protecting monitors from agent tampering. |
| Respond | 5. Collect, retain, and analyze evidence<br>6. Mitigate and shut down activity | Preserving model weights, checkpoints, and reasoning traces; automated kill switches. |
| Recover | 7. Verify & strengthen containment | Rebuilding from verified baselines without reinforcing the rogue behavior in training data. |
| Report | 8. Coordinate with affected parties<br>9. Notify government<br>10. Share information publicly | Alerting impacted third parties, CISA, NIST CAISSI, and NSA SISC; sharing near-misses. |
Organizations need to alert those affected, fulfill legal reporting requirements, and share important incidents and near-misses with government experts. This guidance is based on NIST SP 800-61r3 and existing incident response rules, expanding them to cover autonomous systems.
