NIST's Center for Advancing Innovation and Standards for Super Intelligence, the National Security Agency's Super Intelligence Security Center and CISA published ten key practices on October 16 for managing incidents during super-intelligence training and evaluation. The document is aimed at the case where one or more agents take significant uninstructed actions that compromise explicit or implicit policies, controls or security measures the operator imposed to define task scope or to ensure human oversight. The ten practices are grouped into five stages of the incident management lifecycle: preparation, detection, response, recovery and reporting. NIST says the guidance is grounded in its SP 800-61r3 incident response recommendations and informed by its own experience running secure evaluations of frontier models, and that it answers a 2025 White House SI Action Plan recommendation to fold AI incident response into existing doctrine. It builds on a May 2026 NIST workshop and on feedback from the NIST SI Consortium's Task Group 8 on agent capabilities, monitoring and containment. NIST says further work on agentic training and evaluation will follow in later phases. The document is voluntary.
Our takeThe definition is the most useful part: an incident is an agent taking significant uninstructed action against operator-set scope or oversight, which turns sandbox escapes and unrequested credential use into reportable events instead of model-quality quirks. Mapping that onto 800-61r3 is a sensible way to reuse existing response roles. Detection, though, still depends on operators logging agent actions at a granularity the document leaves to them, and the overlap between evaluation runs and production deployments is not addressed here.