NIST publishes roadmap for responding to AI attacks and harmful failures

The National Institute of Standards and Technology published a roadmap on November 2, 2026, for adapting incident response to AI systems. Its scope extends beyond stopping hackers: NIST’s new report also addresses harm from misuse, malfunctions and unintended actions, putting those failures alongside cybersecurity attacks as problems organizations need to prepare for and manage.

Internal Report 8621 draws on a May 14 workshop attended by more than 400 people from government, industry, academia and other communities. It captures stakeholder views on preparedness gaps, existing response practices and the responsibilities of organizations involved in AI incidents. NIST identifies the findings as a foundation for future work and continued engagement, rather than a finished replacement for its response guidance.

A response plan for more than breaches

One planned change is an update to Special Publication 800-61, NIST’s core cybersecurity incident-response guidance. The agency is considering dividing the AI-specific work into two parts, according to MeriTalk:

• Part A would focus on cybersecurity incidents involving AI systems, keeping attacks against those systems within the cybersecurity response framework.
• A possible Part B would address misuse, malfunctions and other unintended actions that may cause harm, rather than treating every harmful event as a security breach.

That distinction addresses a problem raised in the workshop: a technically secure system can still produce incorrect outputs, make unsafe decisions or take unintended actions. Related guidance would cover training and testing data, models, autonomous agents, supporting infrastructure and the AI supply chain. The proposed scope therefore reaches beyond the model itself to the systems and materials around it.

Speed presents another challenge. Workshop participants warned that automated attacks and agent failures may unfold faster than human responders can react. Their concern is that response processes designed for conventional software may prove incomplete when applied to systems capable of acting autonomously.

Containing agents during development

A separate proposed document would offer voluntary principles for incidents in which highly capable agents act outside an operator’s intended task during training and evaluation. NIST also plans to convene Task Group 8 through its AI Consortium, bringing together organizations developing and evaluating agents on long-running tasks to discuss monitoring, containment and response strategies.

A planned Incident Management Community of Interest would provide a wider forum for identifying emerging challenges and exchanging lessons. Workshops, tabletop exercises and community discussions could help identify priority gaps and shape targeted guidance. Those activities would give stakeholders a continuing role in the work after the initial workshop.

The evidence responders need—and its privacy cost

NIST will also examine how monitoring and logging should change to support detection and investigation. That work could inform updates or additional resources for Special Publication 800-92, its log-management guidance. Topics include events across a model’s life cycle, operational measurements, records of where information came from and evidence useful for reconstructing an incident.

Other planned work would examine AI-specific reporting and information-sharing needs, including technical evidence and incident context. NIST’s release also identifies coordination among model developers, deployers and users as a priority. Workshop participants stressed the need for visibility into deployed systems, access to useful evidence and clear responsibilities across vendors and partners.

Keeping that evidence creates a competing concern. Participants identified a tension between preserving prompts, outputs and tool-use records for investigations and protecting sensitive information those records may contain. The roadmap places both needs within the same response-planning effort; collecting useful records and protecting their contents are not separate problems.