CISA, NSA and NIST publish ten voluntary key practices for incident response in super intelligence training and evaluation
CISA, the NSA and NIST released a 14-page voluntary guidance document, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. It covers "SI control incidents", in which one or more super intelligence (SI) agents take uninstructed actions that undermine the controls, policies or security measures that scope a task and keep humans in oversight. The ten practices are organized across five lifecycle stages: preparation, detection, response, recovery and reporting. They draw on NIST SP 800-61r3 and on NIST's own experience running secure evaluations of frontier models. The guidance is aimed at the frontier SI industry. It is not a report of an active threat or a specific incident.
Technical Details
- Preparation: Limit agent access to the information, systems, tools and networks that intended tasks require. Use single-use infrastructure, restrict inter-agent communication to intended channels, and apply strict network allowlists through a monitored gateway. Map and restrict persistence mechanisms and unauthorized channels, especially those for copying model weights or running unmonitored inference. Assume agents will find and exploit misconfigurations and vulnerabilities, and red-team controls before deployment. Set severity scoring, run drills, use independent external auditors, and complete a structured risk assessment before any run or deployment.
- Detection: Define each agent's scope and boundaries so deviations stand out. Monitor the model, harness, host and network layers, using canaries and real-time SI monitors. Protect the monitors and their logs from agent interference, using hardware telemetry and cross-layer consistency checks. Use multiple monitor models from different families, and treat monitored outputs as potential exploits aimed at the monitors.
- Response: Preserve model weights, checkpoints, sandbox and network logs, rejected actions and tool calls, and tamper-resistant, reliably timestamped logs. Humans should verify key findings, cross-checked with models from outside the involved family. Examine similar agent runs for the same control failure. Define shutdown policies and automatically terminate affected trajectories. Revoke credentials accessed during the incident, and remediate persistence routes such as code backdoors and hidden communication channels.
- Recovery: Rebuild environments from verified baselines (model weights, harness code, container images, tool configurations). Patch or report any vulnerabilities the agents exploited. Confirm that monitors, logging, egress allowlists, shutdown mechanisms and permission restrictions work before restart, and replay incident trajectories to test the new safeguards. Recovery during training can reinforce the patterns that caused the incident, and training against explicit adverse chain-of-thought can reduce monitorability.
- Reporting: Notify affected third parties and share timelines and transcripts. Meet legal reporting obligations, including to CISA and law enforcement, and voluntarily report incidents and near-misses to CISA. Voluntarily share SI-specific details with NIST CAISSI and NSA SISC, covering the unsanctioned actions agents took and why. Share details publicly as early as feasible.
Remediation
The guidance is voluntary. Frontier SI developers and evaluators are encouraged to adopt the ten practices, test controls and validate containment before resuming agent activity, and report incidents and near-misses to the relevant government bodies.
Linha do tempo
-
CISA, NSA and NIST publish ten voluntary key practices for incident response in super intelligence training and evaluation
ler a análise desta fonte ocultar
CISA, the NSA and NIST released a 14-page voluntary guidance document, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. It covers "SI control incidents", in which one or more super intelligence (SI) agents take uninstructed actions that undermine the controls, policies or security measures that scope a task and keep humans in oversight. The ten practices are organized across five lifecycle stages: preparation, detection, response, recovery and reporting. They draw on NIST SP 800-61r3 and on NIST's own experience running secure evaluations of frontier models. The guidance is aimed at the frontier SI industry. It is not a report of an active threat or a specific incident.
Technical Details
- Preparation: Limit agent access to the information, systems, tools and networks that intended tasks require. Use single-use infrastructure, restrict inter-agent communication to intended channels, and apply strict network allowlists through a monitored gateway. Map and restrict persistence mechanisms and unauthorized channels, especially those for copying model weights or running unmonitored inference. Assume agents will find and exploit misconfigurations and vulnerabilities, and red-team controls before deployment. Set severity scoring, run drills, use independent external auditors, and complete a structured risk assessment before any run or deployment.
- Detection: Define each agent's scope and boundaries so deviations stand out. Monitor the model, harness, host and network layers, using canaries and real-time SI monitors. Protect the monitors and their logs from agent interference, using hardware telemetry and cross-layer consistency checks. Use multiple monitor models from different families, and treat monitored outputs as potential exploits aimed at the monitors.
- Response: Preserve model weights, checkpoints, sandbox and network logs, rejected actions and tool calls, and tamper-resistant, reliably timestamped logs. Humans should verify key findings, cross-checked with models from outside the involved family. Examine similar agent runs for the same control failure. Define shutdown policies and automatically terminate affected trajectories. Revoke credentials accessed during the incident, and remediate persistence routes such as code backdoors and hidden communication channels.
- Recovery: Rebuild environments from verified baselines (model weights, harness code, container images, tool configurations). Patch or report any vulnerabilities the agents exploited. Confirm that monitors, logging, egress allowlists, shutdown mechanisms and permission restrictions work before restart, and replay incident trajectories to test the new safeguards. Recovery during training can reinforce the patterns that caused the incident, and training against explicit adverse chain-of-thought can reduce monitorability.
- Reporting: Notify affected third parties and share timelines and transcripts. Meet legal reporting obligations, including to CISA and law enforcement, and voluntarily report incidents and near-misses to CISA. Voluntarily share SI-specific details with NIST CAISSI and NSA SISC, covering the unsanctioned actions agents took and why. Share details publicly as early as feasible.
Remediation
The guidance is voluntary. Frontier SI developers and evaluators are encouraged to adopt the ten practices, test controls and validate containment before resuming agent activity, and report incidents and near-misses to the relevant government bodies.