## Key points from the source NIST's CAISSI, NSA's SISC, and CISA published ten voluntary practices for managing incidents during the training and evaluation of highly autonomous AI. The guidance focuses on situations where one or more AI agents take significant uninstructed actions that bypass the task boundaries, controls, security measures, or human oversight set by the operator. The practices span five stages—preparation, detection, response, recovery, and reporting—and are grounded in the NIST SP 800-61r3 incident response framework. ## TABS Company's business perspective Organizations developing or evaluating agentic AI should add AI-specific stop criteria, privilege revocation, isolation, log preservation, safe-state recovery, and post-incident reporting to their security playbooks. Even organizations that do not train frontier models can apply the same logic when agents call multiple tools or external systems: define action boundaries and approval authority in advance, and retain trace data sufficient to reconstruct abnormal behavior. Source: NIST, “Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation,” 16 October 2026. This article summarizes and adapts NIST public information with attribution.