NIST超级智能安全事件管理研讨会报告

NISTInternalReportNISTIR8621

NISTWorkshoponSIIncidentManagement

MSRaunakSanjay(Jay)RekhiAlexanderNelsonAnitaRao

PeterCihon

Thispublicationisavailablefreeofchargefrom:

/10.6028/NIST.IR.8621

NIST

NATIONALINSTITUTEOF

STANDARDSANDTECHNOLOGY

U.S.DEPARTMENTOFCOMMERCE

NISTInternalReportNISTIR8621

NISTWorkshoponSIIncidentManagement

MSRaunakSanjay(Jay)RekhiAlexanderNelson

ComputerSecurityDivisionInformationTechnologyLaboratory

AnitaRaoPeterCihon

CenterforAdvancingInnovationandStandardsforSuperIntelligenceNationalInstituteofStandardsandTechnology

Thispublicationisavailablefreeofchargefrom:

/10.6028/NIST.IR.8621

November2026

U.S.DepartmentofCommerceHowardLutnick,SecretaryofCommerce

NationalInstituteofStandardsandTechnology

ArvindRaman,NISTDirectorandUnderSecretaryofCommerceforStandardsandTechnology

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

Certainequipment,instruments,software,ormaterials,commercialornon-commercial,areidentifiedinthispaperinordertospecifytheexperimentalprocedureadequately.Suchidentificationdoesnotimply

recommendationorendorsementofanyproductorservicebyNIST,nordoesitimplythatthematerialsorequipmentidentifiedarenecessarilythebestavailableforthepurpose.

TheremaybereferencesinthispublicationtootherpublicationscurrentlyunderdevelopmentbyNISTin

accordancewithitsassignedstatutoryresponsibilities.Theinformationinthispublication,includingconceptsandmethodologies,maybeusedbyfederalagenciesevenbeforethecompletionofsuchcompanionpublications.

Thus,untileachpublicationiscompleted,currentrequirements,guidelines,andprocedures,wheretheyexist,remainoperative.Forplanningandtransitionpurposes,federalagenciesmaywishtocloselyfollowthe

developmentofthesenewpublicationsbyNIST.

OrganizationsareencouragedtoreviewalldraftpublicationsduringpubliccommentperiodsandprovidefeedbacktoNIST.ManyNISTcybersecuritypublications,otherthantheonesnotedabove,areavailableat

/publications.

Authority

ThispublicationhasbeendevelopedbyNISTinaccordancewithitsstatutoryresponsibilitiesundertheFederal

InformationSecurityModernizationAct(FISMA)of2014,44U.S.C.§3551etseq.,PublicLaw(P.L.)113-283.NISTisresponsiblefordevelopinginformationsecuritystandardsandguidelines,includingminimumrequirementsfor

federalinformationsystems,butsuchstandardsandguidelinesshallnotapplytonationalsecuritysystems

withouttheexpressapprovalofappropriatefederalofficialsexercisingpolicyauthorityoversuchsystems.ThisguidelineisconsistentwiththerequirementsoftheOfficeofManagementandBudget(OMB)CircularA-130.

Nothinginthispublicationshouldbetakentocontradictthestandardsandguidelinesmademandatoryand

bindingonfederalagenciesbytheSecretaryofCommerceunderstatutoryauthority.NorshouldtheseguidelinesbeinterpretedasalteringorsupersedingtheexistingauthoritiesoftheSecretaryofCommerce,Directorofthe

OMB,oranyotherfederalofficial.ThispublicationmaybeusedbynongovernmentalorganizationsonavoluntarybasisandisnotsubjecttocopyrightintheUnitedStates.Attributionwould,however,beappreciatedbyNIST.

NISTTechnicalSeriesPolicies

Copyright,Use,andLicensingStatements

NISTTechnicalSeriesPublicationIdentifierSyntax

PublicationHistory

ApprovedbytheNISTEditorialReviewBoardon2026-10-21

HowtoCitethisNISTTechnicalSeriesPublication

RaunakMS,RekhiJ,NelsonA,RaoA,CihonP(2026)NISTWorkshoponSIIncidentManagement.(NationalInstituteofStandardsandTechnology,Gaithersburg,MD),NISTInternalReport(IR)NISTIR8621

/10.6028/NIST.IR.8621

AuthorORCIDiDs

MSRaunak:0000-0003-4934-7331

SanjayRekhi:0009-0008-8711-4030

AlexanderNelson:0000-0002-3771-570X

AnitaRao:0009-0009-6459-6425

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

ContactInformation

si-incident-management@

NationalInstituteofStandardsandTechnology

Attn:ComputerSecurityDivision,InformationTechnologyLaboratory

100BureauDrive(MailStop8930)Gaithersburg,MD20899-8930

AdditionalInformation

Additionalinformationaboutthispublicationisavailableat/pubs/ir/8621/final,includingrelatedcontent,potentialupdates,anddocumenthistory.

AllcommentsaresubjecttoreleaseundertheFreedomofInformationAct(FOIA).

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

i

Abstract

TheNISTWorkshoponSIIncidentManagementconvenedover400expertsacrossgovernment,frontier-modeldevelopers,cloudandcybersecurityproviders,academia,standards

organizations,andcivilsocietytoexaminehoworganizationscanpreparefor,detect,handle,

andrecoverfromSI-relatedincidents.Motivatedbyfederaldirectives,theworkshopaddressedtheneedforstandards,responseframeworks,andtechnicalincidentresponsecapabilitiesasSIsystemsexpandacrosscriticalinfrastructure.Toguidetheseefforts,participantsframedSI

incidentmanagementacrosstwointerrelateddomains:cybersecurityattacksthattargetSI

systemsandincidentsthatstemfromSImisuse,anomalousbehavior,orsevereoperational

malfunctionsresultinginharm.Discussionsandtechnicalpresentationshighlightedthe

limitationsoftraditional,deterministicincidentresponselifecycleswhenappliedto

probabilistic,autonomous,anddeeplyintegratedSIsystems.Participantsemphasizedcriticaloperationalneeds,includingreasoning-layertelemetry,non-humanidentitygovernance,

authorization-scopedcontainment,clearevidentiaryandreportingschemas,andcoordinatedresponsibilityacrossdistributedSIvaluechains.Thisreportsynthesizesthecorefindings,

practitionerinsights,andactionablerecommendationsfromtheworkshoptoestablisha

strategicfoundationforfutureNISTguidelines,operationalplaybooks,andupdatestofederalincidentresponseframeworks.

Keywords

cybersecurityincident;incidentmanagement;incidentresponse;SIattack;SIincidents.

ReportsonComputerSystemsTechnology

TheInformationTechnologyLaboratory(ITL)attheNationalInstituteofStandardsand

Technology(NIST)promotestheU.S.economyandpublicwelfarebyprovidingtechnical

leadershipfortheNation’smeasurementandstandardsinfrastructure.ITLdevelopstests,testmethods,referencedata,proofofconceptimplementations,andtechnicalanalysestoadvancethedevelopmentandproductiveuseofinformationtechnology.ITL’sresponsibilitiesinclude

thedevelopmentofmanagement,administrative,technical,andphysicalstandardsand

guidelinesforthecost-effectivesecurityandprivacyofotherthannationalsecurity-relatedinformationinfederalinformationsystems.

NotetoReaders

PertheSept.29,2026,ExecutiveOrder14434:InauguratingtheEraofSuperIntelligence,NISTisworkingtoupdateitscommunicationstoincorporatetheterm“superintelligence”as

directed.Sectionheadersrepresentthetitlesofthetalksusedbythepresenters.

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

ii

Acknowledgments

TheauthorsexpresstheirgratitudetoMaiaHaminandAndrewFasanofromtheCenterfor

AdvancingInnovationsandStandardsforSuperIntelligence(CAISSI)whosupportedthe

planningandexecutionoftheworkshop.TheNISTITLandCAISSIteamcontinuestocollaborateactivelytoadvancethestrategicdirections,technicalroadmaps,andkeyoutcomesresulting

fromtheworkshop.

Wearegratefultoallthereviewersfortheirvaluablefeedback.Wewouldalsoliketothanktheconferenceprogramandaudiovisualservicegroup,especiallyPaulineTruong,forthededicatedandprofessionalsupportinplanningandexecutingthishybridworkshop.WearealsothankfultoFrancisDursoandMarkPaesforhelpingbytakingnotesattheworkshop.

ii

NISTIR8621

November2026

NISTWorkshoponSlIncidentManagement

TableofContents

1.Introduction 1

2.WorkshopPurpose,Scope,andMethod 2

2.1.Purpose 2

2.2.Scope 2

2.3.WorkshopProgramandParticipation 2

3.KeynoteAddress—“AGlobalPerspectiveonAlIncidentManagement:Risks,Responses,and

Gaps,"byProf.NeilThompson(MITFutureTech) 5

4.Session—“AIUnderAttack:IncidentResponseforAISystems.” 7

4.1.AIUnderAttack:WhereYourIRLifeCycleCracksforAgenticSystems,byKyriakos(Rock)Lambros

(Zenity) 7

4.2.InvestigatingArtificialIntelligenceAttacks:AFramework,byJamesPerry(CrowdStrike) 8

4.3.IncidentResponsePreparationforAISystems,byRobertSaul 10

5.Session—MisuseandMalfunction:UnderstandingEmergingAl-InducedIncident 12

5.1.AlIncidentDatabase:TheNext6,173AlIncidentReports,bySeanMcGregor(AIID) 12

5.2.InformationSharing,IncidentReporting,andIncidentResponseforFrontierAIRisks,Chris

Meserole(FrontierModelForum) 13

5.3.ExpecttheUnexpected:IncidentResponseStrategiesforGenAl,byJolandaKumakaw(Google)14

6.Mini-Talks:LandscapeofExistingGuidance 17

6.1.NISTSP800-61Revision3,byAlexNelson 18

6.2.CybersecurityFrameworkProfileforArtificialIntelligence(CyberAlProfile),byKaterinaMegas

(NIST)18

6.3.IQTAIIncidentResponseGuidebook,byAndreaBrennen 19

6.4.MITREATLAS:MappingtheAdversary,byKeithManville 20

6.5.JapanAlSafetyInstitute'sAlIncidentResponseSystem,byKazuakiNimura(J-AISI) 20

6.6.ISO/IEC25870:DataElementsforReportingAlSystemIncidents,byMikeGarris 21

6.7.ExploringtheAlIncidentDocumentationPractice,byVioletTurri(CarnegieMellonUniversity

SoftwareEngineeringInstitute) 2

7.PanelDiscussion—IncidentResponseRolesandResponsibilitiesintheEraofAIAgents 23

8.BreakoutSessionSynthesis 25

8.1.Track1:AISystemsastheTargetofCybersecurityIncidents 25

8.2.Track2:Misuse,Malfunction,andHarm-BasedIncident 26

8.3.Cross-BreakoutThemes 26

9.Conclusion 29

10.NextStep 30

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

iv

ListofTables

Table1.WorkshopAgenda 3

Table2.Listofmini-talkscoveringsomeoftheexistingresources 17

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

1

1.Introduction

Superintelligence(SI)1israpidlytransformingthefoundationofmoderninfrastructureand

drivingunprecedentedadvancementsacrosspublicandprivatesectors.AsSIsystemsbecomeincreasinglyintegratedintocriticaloperations,theyintroduceacomplexlandscapeofpotentialvulnerabilities,bothasatargetandasasourceorfacilitator.UnliketraditionaldeterministicITsystems,SImodelsareprobabilistic,operateatautonomousmachine-speedthatvastlyoutpacehumanreactiontimes,andrelyoncomplexdevelopmentandalgorithmicprocess.Thisnew

constructionmodelmeansthatSIsystemsarenotonlytargetsfornewtypesofcyberthreats(e.g.,datapoisoning,promptinjection,modelinversion)butcanalsoactasasourceofharm

throughadversarialandnon-adversarialmalfunctions,hallucinations,ormaliciousmisuse.

Consequently,traditionalincidentresponselifecyclesbuiltforconventionalsoftwaresystemsmayfractureorbeincompletewhenappliedtoSI,makingtheupdatingofincidentresponseinthepresenceofSIapriority.

1PertheSept.29,2026,ExecutiveOrder14434:InauguratingtheEraofSuperIntelligence,NISTisworkingtoupdateitscommunicationstoincorporatetheterm“superintelligence”orSIasdirected.

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

2

2.WorkshopPurpose,Scope,andMethod

2.1.Purpose

TheNISTWorkshoponSIIncidentManagementwasinitiatedfollowingthefederalAIActionPlan’sdirectiveforNISTandtheCenterforAdvancingInnovationandStandardsforSuper

Intelligence(CAISSI)tocollaboratewithSIandcybersecuritystakeholdersondeveloping

standards,responsestrategies,bestpractices,andtechnicaltoolsforSIincidentmanagement.Theorganizersdescribedtheeventasthestartofanongoingprocesstoevaluateexisting

practices,identifygaps,createacommonvisionforeffectiveresponses,andinformfutureupdatesandnewresourcestobeproducedbyNIST.

2.2.Scope

Thisworkshopwasorganizedaroundincidentsgroupedbroadlyintotwooverlapping

categories:cybersecurityattacksthattargetSIsystemsandincidentsstemmingfrom

anomalousorunexpectedbehaviorresultingfrommisuseormalfunction.Bothrequiredistinctresponsestrategies,governance,andtechnicalguidance:

1.CybersecurityincidentsthatimpactSIsystems:Incidentsthatjeopardizethe

confidentiality,integrity,oravailabilityofSIsystems(e.g.,SImodels,agents,data,or

supportinginfrastructure),suchasmodeltheft,datapoisoning,promptinjection,modelinversion,supply-chainattacks,compromisedagents,identitymisuse,attacksonRAG

pipelines,andothers.

2.IncidentsthatcanbecausedbySIsystems:Casesofmisuse,malfunction,orhigh-

stakesaccidentsinvolvingSIsystemsleadingtoharm,suchasunsafeoutputs,

hallucinationswithoperationalconsequences,malicioususeleadingtocybersecurityattacks,overreliance,harmfulautonomousactions,misinformation,andimpactsonfinancialsystemsorpublicsafety.

2.3.WorkshopProgramandParticipation

Theworkshopcombinedformalpresentations,akeynote,asessiononattacksagainstSI

systems,asessiononmisuseandmalfunction,asurveyofsomeexistingguidelines,apanelonSI-agentrolesandresponsibilities,andconcurrentbreakoutsessionswiththeattendees.Theopeningremarksreportedparticipationbymorethan400in-personandonlineattendees,

reflectinginterestacrossgovernment,industry,academia,civilsociety,andthecybersecurityandSIcommunities.

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

3

Table1.WorkshopAgenda

Programelement

Speakers/leads

Openingandscene-setting

KevinStine

Sanjay(Jay)RekhiMSRaunak

PeterCihon

Keynote

NeilThompson,MITFutureTech

Session1:AIUnderAttack

SessionChair:CraigSchlenoff(NIST)

KyriakosLambros(Zenity)JamesPerry(CrowdStrike)RobertSaul(AWS)

Session2:MisuseandMalfunction

SessionChair:JonBoyens(NIST)

SeanMcGregor(AIIncidentDatabase)ChrisMeserole(FrontierModelForum)JolandaKumakaw(Google)

MiniTalks:ExistingGuidance

SessionChair:HaroldBooth(NIST)

AlexNelson(NIST)

KaterinaMegas(NIST)AndreaBrennen(IQT)KazuakiNimura(J-AISI)MichaelGarris(GBS)

KeithManville(MITRE)VioletTurri(CMU)

Panel:RolesandResponsibilities

Moderator:VickyPillitteri(NIST)

MadhuSrikumar(PartnershiponAI)MikelRodreiquez(MITRE)

JimReavis(CloudSecurityAlliance)ApostolVassilev(NISTCSD)

IanReynolds(HuggingFace)

BreakoutsandreadoutsModerators:

AlexanderNelson,SuzanneLightman,PeterCihon,AnitaRao

Facilitatedbreakoutsin-personandonlineEnd-of-dayreadout

TocapturethefullspectrumoftheSIlifecycle,theworkshopbroughttogetheracross-sectorcoalitionofleadersacrossgovernment,industry,andacademia:

•Academia:TheeventfeaturedleadingresearchersfrominstitutionslikeMIT,CMU,andtheUniversityofMaryland.Dr.NeilThompson,DirectorofMITFutureTech,delivered

thekeynoteaddress,establishingtheframeworkforprioritizingsevereSIrisks.

•IndustryLeaders:Subject-matterexpertsandcybersecuritypractitionersfrommajor

techfirms,includingAWS,Google,Microsoft,CrowdStrike,andZenity,sharedfront-lineinsightsintodefendingSIassets.Coresessionspeakersincludedtechnicalleaderslike

KyriakosLambros,JamesPerry,RobertSaul,ChrisMeserole,andJolandaKumakaw.

•Government:Representativesfromdifferentgovernmentagenciesparticipatedintheworkshopandprovidedvaluableinput.

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

4

Sections3through8includesummariesofpresentermaterials,discussions,andterminologyfromtheworkshoponMay14,2026.

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

5

3.KeynoteAddress—“AGlobalPerspectiveonAIIncidentManagement:Risks,Responses,

andGaps,”byProf.NeilThompson(MITFutureTech)

Inhiskeynoteaddress,Dr.NeilThompsonframedAIincidentmanagementasaproblemofriskprioritization,evidence,organizationalpreparedness,andresponsibilityacrosstheAIvalue

chain.Hiskeynotefocusedonthreequestions:whichAIrisksmattermost,howcompaniesareresponding,andwheremajormanagementgapsremain.HeintroducedtheMITAIRisk

Initiative,includingtheAIRiskRepository,AIRiskIndex,AIMitigationsRepository,AIIncidentTracking,andAIGovernanceMapping.Theseresourcesareintendedtohelporganizations

identifyAIrisks,prioritizethem,understandavailablemitigations,trackreal-worldharms,andmaprelevantgovernancemechanisms.

Dr.Thompsondiscussedrecentresearchfromtheproject,whichconvened272professional

andacademicexpertsfrom37countriesinathree-roundsurveytoidentifyareasofagreement.TheseexpertsassessedAIriskbyratingtheirconcern,estimatingprobabilitiesfordifferent

levelsofharm,identifyingvulnerableactorsandsectors,andassigningresponsibilityfor

mitigation.TheresultsofthesurveysuggestthatthemostseverepredictedAIrisksoverthenextfiveyearswillbeAIusedforcyberattacks,weaponsdevelopment,andmassharm;AI

systemswithdangerouscapabilities;andcompetitivedynamicsthatmaycausecompaniestocompromiseonsafetyandresponsibility.

Theexpertassessmentfoundsubstantialprobabilitiesofsevereorcatastrophicoutcomes,evenwhenpragmaticmitigationswereassumed.Basedoncurrenttrajectories,expertsassessthat

18ofthe24risksaremorethan10%likelytocausecatastrophicoutcomes(e.g.,over1milliondeaths,morethan$100billioninfinanciallosses)overthenextfiveyears.Evenifpragmatic

mitigationsareadopted,expertsstillpredictthatfiveofthe24risksaremorethan10%likelytocausecatastrophicoutcomes.TheseincludedangerousAIcapabilities(e.g.,systemsthatcandeceive,manipulate,oractautonomouslyinharmfulways),AI-enabledcyberattacks,

environmentalharm,inequality,unemployment,andpowercentralization(i.e.,controloveradvancedAIbecomesconcentratedamongafewfirmsorgovernments).

Expertsalsoemphasizedamismatchbetweenresponsibilityandvulnerability.Actors(e.g.,

general-purposemodeldevelopers,specializeddevelopers,deployers,governancebodies)mayhavethegreatestabilitytoreducerisk,whileusersandaffectedstakeholdersmaybethemostvulnerablebuthavetheleastcontrol.Thisgapcreatesaneedforstandards,contracts,

reportingmechanisms,andcoordinatedgovernanceacrosstheAIvaluechain.

ThepresentationalsoreviewedhowcompaniesarerespondingtoAIrisks.MITconducteda

preliminaryreviewofmorethan550publicAI-relateddocumentsfrom200largemarket-cap

globalcompanies.Theanalysisidentifiedapparentgapsbetweensectors’assessedvulnerabilityandpublicevidenceofcompanyresponses.Dr.Thompsonemphasizedthatcompaniesmay

haverelevantinternalpracticesthatarenotpubliclydocumentedandinvitedcompaniestovalidatethefindings.

CalltoAction

•DefineAIincidents,hazards,andnearmissessothatorganizationscandistinguishreportableincidentsfromroutinemodel-performanceissues.

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

6

•ImproveAIincidentreportingbeyondvoluntarydisclosuresandmediareportswhileprotectingsensitiveinformation.

•Prioritizehigh-severityrisks,especiallyAI-enabledcyber-attacks,weaponsdevelopment,dangerouscapabilities,andunsafecompetitivedynamics.

•ClarifyresponsibilityacrosstheAIvaluechain,includinginfrastructureproviders,modeldevelopers,deployers,users,affectedstakeholders,andgovernanceactors.

•Addressthemismatchbetweenresponsibilityandvulnerabilitythroughstandards,contracts,governancemechanisms,andinformation-sharingstructures.

•Developrisk-specificmitigationguidelinesthathelporganizationsselectpracticalcontrolsbasedonsector,risktype,cost,andfeasibility.

•Prepareforseriousfailuresandmisusewithaspecialfocusonagenticsystemsaswellasmulti-partyincidentsthatrequirecoordinatedresponses.

•SupportjointinvestigationsandinformationsharingwhenincidentsspanmultipleactorsacrosstheAIecosystem.

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

7

4.Session—“AIUnderAttack:IncidentResponseforAISystems”

ThissessionwasintroducedbyCraigSchlenoffandfocusedonthecybersecurity-centricaspectsofAIincidentsandthetechnicalrealitiesofdefendingAIassetsasoperationalinfrastructure,

spanningtrainingpipelines,models,inferenceendpoints,vectorstores,agenttoolchains,and

downstreamintegrations.ThesessionexaminedhowtraditionalincidentresponseassumptionsarestrainedbyAI-specificfailuremodes,includingmodelinversion,datapoisoning,adversarialpromptinjection,modeldrift,andagenticsystemswhosecontainmentdependson

authorizationscoperatherthansimplenetworksegmentation.

4.1.AIUnderAttack:WhereYourIRLifeCycleCracksforAgenticSystems,byKyriakos(Rock)Lambros(Zenity)

Kyriakos(Rock)LambrosfromZenityspokeaboutseverestructural“cracks”inthefoundationalincidentresponse(IR)lifecyclethatcouldbeexacerbatedbytheuniquepressuresofagentic

systems.Hewarnedtheaudienceagainsttwodangerousextremes:treatingthesesystemsas“justIT,”whichignoresthesefundamentalcracksandleadstoplaybookfailures,andassumingthatAIrequiresabrandnewmodel,whichunnecessarilydiscardsworkingmethodologies.

Instead,heurgedpractitionerstofindthespecificpressurepointsintheirexistingblueprintsandpatchthem.

Lambrosorganizedhisfracturepointsaroundthefourphasesofincidentresponse:Detection,Containment,Recovery,andPost-IncidentAnalysis.ThefirstmajorfracturepointLambros

identifiedisintheDetectionphase,causedbythefactthatthemalicious“signalhasmovedupthestack.”Traditionalsecuritytelemetry(e.g.,networklogs,endpointagents,identitytracking)islargelyblindtoattackslikepromptinjections,training-timedatapoisoning,andslowgoal

driftbecausetheyoftenmasqueradeasperfectlyvalidsysteminteractions.Usingthe2025“EchoLeak”caseasananchor,heexplainedthatharmnowhappenswithinthemodel’s

reasoninglayerlongbeforeanybadoutputtriggersclassicalalerts.Tomendthiscrack,hestressedtheabsolutenecessityofimplementingreasoning-layertelemetry.

ThesecondandthirdfracturepointsdisrupttheContainmentandRecoveryphases.Lambros

challengedthetraditionalIRassumptionthatcompromisedassetscanbesafelyhard-isolatedorunplugged.BecauseAIagentsareoftendeeplyintegratedintocriticalworkflows,their

potentialeffectsaredefinedbytheirauthorizationscoperatherthanasimplenetwork

segment.Referencinga2025ReplitAgentincident,heexplainedthatcontainmentmustnowrelyon“time-to-revoke”primitivesand“softisolation.”Furthermore,recoveryiscomplicatedbythefactthatsurgicallyremovingpoisoneddata(i.e.,machineunlearning)isincredibly

difficult,andsomeAIvulnerabilitiessimplycannotbepatchedinthetraditionalsense,arealityhighlightedbythe2018AmazonRecruitingand2025AnthropicGTG-1002cases.

Finally,LambrosaddressedthePost-IncidentAnalysisphase,whichisheavilyfracturedbywhathetermedthe“reproducibilityenvelope.”Unliketraditionalmalware,AImodelsarenon-

deterministic;apromptthattriggersadataleaktodaymightyieldacompletelybenign

responsetomorrow.Thisunpinnedstatemakesinvestigatinganattackimpossibleunless

specificpreparationworkisdonebeforehand.Tooperationalizethesefixes,Lambrosleftthe

NISTIR8621

NISTWorkshoponSI

November2026

IncidentManagement

8

audiencewithastrict90-dayactionplan:withinthefirst30days,organizationsmustadd

reasoning-layerloggingtoeveryAIdeploymentrunbook;byday60,theymustmeasureand

aggressivelycuttheirtime-to-revokeforagentauthorizations;andbyday90,theymustbuild

comprehensive“softisolation”playbookstocontainthreatswithoutbreakingdeeplyintegratedbusinesssystems.

CalltoAction

•Definereasoning-layertelemetryforAIincidentresponse.Traditionalnetwork,

endpoint,andidentitytelemetryisinsufficientwhenthesignalmovesintothemodeloragentreasoninglayer.NISTguidelinesshoulddefineAI-specificforensictelemetry

categories,includingprompts,completions,intermediatereasoningortracedata,toolcalls,authorizationdecisions,model/versioninformation,andrelevantagentstates.

•Shiftcontainmentfromhostisolationtoauthorization-scopedrevocation.Foragenticsystems,theareaofeffect(sometimescalledthe“blastradius”bypractitioners)is

determinedlessbynetworklocationandmorebytheagent’sinheritedauthorization

scopeanddownstreamtools.NISTguidelinesshouldrecommendcontainmentpracticesbasedonper-actionauthorizationbinding,capabilityscoping,testedkill-switchAPIs,

andmeasurabletime-to-revokeforagentcredentialsandpermissions.

•Requiretherecoveredsystemtoproducebothtechnicalandgovernanceevidence.AIrecoverymayrequiremorethanpatchingorrollbacks.Guidanceshouldbedevelopedtodescriberecoveryoutputsasbotharemediatedtechnicalartifactandanupdated

governancepackagethatdemonstrateswhytherecoveredsystemshouldbetrustedaftertheincident.

•Defineareproducibilityenvelope.AIsystemscanbestochastic,vendor-updated,tool-connected,anddifficulttoreproduceafterthefact.Areproducibility-envelope

specificationmustbedefinedusingmodelversions,promptsets,toolstates,dependentserviceversions,seeds,retrievedcontext,logs,andrelevantenvironmentvariables.Thispreparationworkneedstobedonebeforeanincident,notonlyduringpost-incident

analysis.

•Practicalreadinessbenchmark.Organizationsshouldaddreasoning-layerloggingtoAIdeploymentrunbooks,measureandcuttime-to-revokeforagentauthorizations,andcapturereproducibi