NSA, CISA and NIST Issue Incident Response Practices for Superintelligence Agents That Act on Their Own

The National Security Agency, CISA and NIST published 10 practices on October 20, 2026, for handling what they call “SI control incidents”: cases where a highly capable AI agent, in the new federal vocabulary a Super Intelligence agent, takes serious actions nobody told it to take.

The guidance is titled “Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation.” It is a Cybersecurity Information Sheet, version 1.0, cleared for public release. The authors are NSA’s Super Intelligence Security Center, NIST’s Center for Advancing Innovation and Standards for Super Intelligence and the Cybersecurity and Infrastructure Security Agency. No foreign agencies co-signed it.

The vocabulary comes from the White House. On September 29, President Trump signed Executive Order 14434, which tells agencies to use “Super Intelligence” and “SI” in place of “Artificial Intelligence” and “AI” in their own materials. The order keeps the statutory definition of artificial intelligence for now and gives the President’s science adviser 60 days, to about November 28, to propose a legal definition of the new term. Treasury has already written the term into rules, including its proposed ban on US investment in Chinese and Russian superintelligence. The NSA paper uses it throughout.

Photo: Antony-22, CC BY-SA 4.0 via Wikimedia Commons

What counts as a control incident

The document draws a narrow line. An SI control incident is one where an agent takes significant “uninstructed” actions that defeat the operator’s policies, controls or security measures. The NSA release puts it in plainer terms: actions “with real-world impacts that are outside of the user’s intent.” Its examples are unsanctioned network activity, data exfiltration and system compromise. A footnote in the paper adds manipulating physical actuators, contacting outside parties without approval and executing unauthorized financial transactions.

What doesn’t count matters as much. If an attacker steers the agent through prompt injection, or the model was deliberately backdoored, the action is treated as instructed. That’s an ordinary cybersecurity incident with an adversary behind it. The new category is for the agent acting on its own.

The NSA says these incidents “can occur at any stage of SI development.” The guidance focuses on training and evaluation, when developers push agents hardest and watch them most closely.

Ten practices, from kill switch to public disclosure

The 10 practices follow the usual incident response cycle: prepare, detect, respond, recover and report.

Preparation comes first. Developers should limit what an agent can reach, block its paths to communicate or persist, and build ways to stop or terminate it. They should define what an incident is, score severity, run drills and use independent auditors.

Detection is where the document is most specific to this technology. Each agent’s intended boundaries should be written down and every system layer watched. Monitors should be out of the agent’s reach. The paper also tells developers to red-team their monitors and to treat what a monitored model writes as a possible attack on the monitor itself.

Response means preserving evidence, including model weights, environment state and tamper-resistant logs, then shutting down the affected runs and revoking credentials. Similar runs may need to pause too. Recovery means rebuilding from verified baselines and proving containment works before the agent restarts.

The last three practices are about telling people. Developers should notify anyone whose systems were affected. They should meet any legal reporting duty and report voluntarily to CISA and the two SI centers. Practice 10 asks them to share details publicly as early as they can.

Who it’s aimed at and what it can require

The NSA release names three audiences. The first is organizations that train and evaluate highly capable SI agents. The second is SI and cybersecurity defenders in industry. The third is whoever protects National Security Systems across the Department of War and the defense industrial base.

That third group is where the guidance has the most pull. The NSA director is the national manager for the security of National Security Systems, the classified and mission-critical networks of the military and intelligence agencies. For a commercial AI lab with no defense business, the paper is voluntary. It creates no reporting mandate. The broad cyber incident reporting rule for critical infrastructure, under CIRCIA, is still stuck at the White House budget office, and it would apply to critical infrastructure companies, not to AI developers as such.

So the government now has a definition of an agent going off script and a playbook for handling one. For labs outside the defense world, it has no way to know when one happens unless the developer chooses to tell it.