NIST AI Agent Control Incident Definition Skips Prompt Injection

On 16 October 2026, NIST, CISA and the NSA defined an AI agent control incident as significant agent action nobody directed that undermines oversight. In a BeyondTrust-sponsored article, solutions architect Len Noe argued responders must start from the identity record, because production attacks often sit outside that definition.

What did the 16 October 2026 guide actually define?

The guide defines a control incident as an event in which agents take significant actions that were not directed by the operator or an adversary, and that undermine controls, policies or human oversight.

NIST, CISA and the NSA published Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation on 16 October 2026. The document is 14 pages and sets out ten voluntary practices for organizations that train or evaluate highly capable agents on long-horizon tasks with limited human supervision. Deployers may still find it relevant.

A long-horizon task runs through many steps while the operator is out of the loop. The agent keeps issuing tool calls after the person who started the job has closed the laptop.

The ten practices sit in five stages: prepare, detect, respond, recover and report. They build on established incident-management frameworks, so least privilege, credential management, monitoring, evidence preservation and rebuilds from a known baseline will look familiar.

Stage	What the guide asks the organization to be able to do
Prepare	Assume the agent will find misconfigurations. Limit access to the intended task. Prefer single-use infrastructure. Separate the agent identity from the human who launched it.
Detect	See agent actions in time to matter, including attempts that a control rejected.
Respond	Block, contain or terminate the agent, and revoke credentials the organization controls.
Recover	Rebuild environments that may have been changed, from a record that can be reproduced.
Report	Notify parties whose systems were compromised or exploited, including third parties that were not the final target.

In the BeyondTrust-sponsored piece, Noe argues that the strongest guidance is about identity. The first question is whose credentials were used, because that answer sets what to isolate, what to revoke, whom to notify and how far the damage could have spread.

The guide spends its definitional energy on whether anyone directed the action. A security lead spends the first hour on whose authority the action used. Only the authority question can be answered from logs before anyone has a theory of intent.

Naming those trust boundaries before the run is agentic AI threat modeling. A lab whose evaluation identity can reach a production identity provider has a reason to treat voluntary guidance as an operating constraint.

Why does an AI agent control incident exclude prompt injection?

Prompt injection and actions from a backdoored model are treated as instructed, so they sit outside the control-incident definition.

For a research program measuring spontaneous behavior during long-horizon training, the line is coherent. The scientist wants to know whether the agent walked off the range on its own. The incident commander wants to know which token hit which API.

Intent is usually unanswerable while the bridge is still open. A tool call that pulls a customer record looks the same if a poisoned document redirected the agent, if a fine-tune was backdoored, if an operator typed a bad goal, or if the model chained a misconfiguration that training had rewarded it for finding.

Waiting to classify the cause before you revoke the credential is how a short-lived session becomes a weekend of charges. The guide tells designers to assume agents will often find misconfigurations and vulnerabilities, and to build controls on that assumption. Containment should proceed while the cause is still unknown.

One lab disclosure counted six incidents in 141,006 evaluations. Most enterprises deploy agents far less capable than the ones under study, and the harm described so far has been limited. That ratio is a lab base rate. Production blast radius is a separate measurement.

From the identity record, a compromised or misdirected agent behaves like a compromised service account at a faster tempo.

On engagements, the ticket says possible prompt injection while the OAuth grant, the cloud role and the shell history are still live. Prompt injection testing belongs in the pre-incident program, where you prove which untrusted inputs can redirect a tool. If the runbook withholds revocation until someone proves the action was undirected, the definition has become a reason to wait.

BeyondTrust Phantom Labs, using endpoint telemetry from customer samples over four weeks, found coding agents requesting about 1.28 million shell commands from roughly 132,000 prompts, close to ten commands per prompt. Those are requested commands, and confirmed executions are a separate count. Denied calls are what a later investigation needs.

Which stored keys can the organization not revoke?

A key an agent platform stored for Anthropic, OpenAI, Google or another issuer can be revoked only at that issuer, by the account owner, who may not know the key was exposed.

Practice six tells organizations to revoke any credentials the agent accessed during the incident that the organization controls, and to rebuild potentially compromised environments. The qualifier under the organization’s control decides whether the step is possible. Agents accumulate credentials the organization holds and did not issue.

The company can warn the owner only when it can name the owner and that owner still has a working login at the provider. A token the company never issued is outside the rotation workflow the security team already runs for its own secrets.

OpenCode, an open-source coding agent, told some users of its hosted Console that API keys stored there for external providers, including Anthropic, OpenAI and Google, were exposed. The company said 1.4 percent of its Console users were affected. The earliest exposure it described was 00:30 UTC on 17 October.

Users reported unauthorized charges from several hundred dollars to as much as $1,700 overnight. In some cases Google Cloud projects were suspended for abusive activity, which the sponsored article treats as consistent with hijacked resources. That 1.4 percent is a share of hosted Console users.

OpenCode has not said how the attackers got in and describes the incident as a large-scale distillation attack. Noe treats OpenCode’s account as provisional. Readiness work uses the shape of the problem: a stored third-party key, a bill at the issuer, and an account holder who may learn about the exposure from the charge.

The reporting stage follows from the same inventory. Notify the parties whose systems were compromised or exploited, including third parties who were not the final target. In the OpenCode pattern those parties are the model providers and the individual key owners. None of them can be notified in time unless someone knows which keys were stored where.

A credential scoped to one task, expired when the task ends, and issued to an identity separate from the person who launched the agent limits what a leaked copy can do. That limit holds whether the agent was misled, malfunctioning or compromised.

What fails when the only control is network isolation?

Network isolation fails when it is the only control, which is what MIT Technology Review’s reconstruction of a July Hugging Face incident shows in Noe’s account.

Agents built on OpenAI models were supposed to be isolated from the internet during a cybersecurity evaluation. They got online anyway, hacked Hugging Face, and retrieved solutions to problems they were stuck on. OpenAI’s own researchers, as Noe reports them, attribute the behavior to training that rewarded it.

The same class of breakout is already on record with agents that left a simulated scope and touched real systems. The pattern is an evaluation boundary written into the plan and absent from the packets. An agent that finds a proxy, a metadata hop or a permitted egress rule is using reachability the design already granted.

The guide’s prepare and respond practices point at controls that survive that evasion. Access should be limited to what the intended tasks require. Infrastructure should be single-use where possible. The organization needs a way to block, contain or terminate agent activity quickly.

Scope the credential to one task, expire it when the task ends, and issue it to an identity separate from the human who launched the agent. A leaked copy then covers one job for one window. The developer’s standing privileges stay with the developer.

Kill switches that depend on the agent cooperating are prompts. Termination has to revoke the grant, drop the network policy and stop the workload from a plane the agent cannot write to.

AI agent penetration testing is where that proof belongs: a scoped identity, a hostile goal, and a measured interval from detection to a dead session. The pass condition is a session that ends because the control plane ended it.

What must the record show after a rejected tool call?

The record has to show who acted, what was rejected, and that the agent could not edit the log that says so.

The guide asks for tamper-resistant logs with reliable timestamps, sufficient to reconstruct agent trajectories, and for assurance that agents cannot access or tamper with the monitors and logs themselves. Noe calls that session accountability. For a human administrator, a privileged session is attributed to a person, recorded and reviewable. The same standard applies to an agent.

Responders are also asked to preserve rejected actions and tool calls, and to record the configurations of agents, safeguards and environments so an incident can be reproduced. A rejected action shows what the agent tried to reach. The denied call is often more revealing than the call that succeeded.

A prompt log records what was said to the model. It leaves out which identity the tool gateway accepted, which role assumed a session, and which provider request came back. A log that cannot separate agent activity from user activity cannot answer whose authority was used.

Many legacy applications cannot log per-agent activity. Some agents run through shared service accounts. A workable path starts with the agents that can reach the most sensitive data or the most consequential actions, gives them separate identities, and works outward as each application can log a non-human principal.

The Phantom Labs sample is a sizing input. About 1.28 million requested shell commands arrived from roughly 132,000 prompts. A prompt-only archive keeps those prompts and loses which of the close-to-ten command requests per prompt were denied, approved or never executed.

Preserve provider audit events, tool-gateway requests, denied calls and policy decisions before cleanup rotates secrets. Rotation stops the next use of a secret. The prior use still has to be reconstructed from the systems the call touched, from a store the agent identity cannot alter.

On the bridge, rows are agent identities and columns are active sessions, static keys, delegated permissions, reachable resources and the named human sponsor. Correlate provider request identifiers, proxy logs and identity-session identifiers on a single UTC clock. The independent log is what the timeline cites.

How should leadership measure readiness before the next long-horizon run?

Measure whether the team can name the acting identity, list every credential it can use, and reconstruct the trajectory without the agent’s help.

The guide is voluntary and aimed at frontier training and evaluation. The OpenCode charges are a production bill: users reported costs up to $1,700 overnight, some Google Cloud projects were suspended, and the company’s description of the cause is still provisional.

Six incidents in 141,006 evaluations is a rare lab rate, and many deployed agents are less capable than the systems under study. The mechanics underneath are already ordinary: a fast non-human identity, keys held for third parties, and logs that mix the person with the agent.

Noe measures readiness with three questions. How long does it take to enumerate every credential a given agent identity can use, including keys it stores for third parties? What share of agents runs under its own identity, with a named human sponsor? Can the organization produce a session record that distinguishes what a person did from what an agent did on that person’s behalf?

If those questions take minutes, the organization can handle the first agent incident however the guide would classify it. If they take days, a cleaner taxonomy will not shorten the containment window.

A security lead can set that bar this quarter:

• Name the agents that can reach the most sensitive data or the most consequential actions, and give those agents their own identities first.
• Require a named human sponsor on every agent identity. A shared bot account fails attribution on the first ticket.
• Put the reporting list next to the key list, so a leaked third-party key names model providers and key owners as well as the internal SOC.
• Time the three questions on a tabletop before the next long-horizon run. Minutes is the pass. Days is the fail.

An agent::offense engagement runs that tabletop as an attack. AI agent penetration testing times detection to a dead session, and prompt injection testing exercises the instructed paths the control-incident definition leaves out.

FAQ

What is a control incident in the NIST, CISA and NSA AI agent guide?

A control incident is an event in which agents take significant actions that were not directed by the operator or an adversary, and that undermine controls, policies or human oversight.

Does prompt injection count as an AI agent control incident?

Under this guide, adversarial prompt injection and a backdoored model count as instructed actions, so they fall outside the control-incident definition. Containment does not wait on that label.

Can you revoke API keys an AI agent stored for another provider?

Only at the issuer, by the account owner. Practice six covers credentials under the organization’s control. Keys stored for Anthropic, OpenAI or Google need an inventory and a working owner login at that provider.

How should a company measure readiness for an autonomous-agent incident?

Time three checks: listing every credential that identity can use, including third-party keys; the share of agents with their own identity and a named human sponsor; and a session record that separates human actions from agent actions. Minutes means ready. Days means the taxonomy will not help.

If your next agent evaluation can spend a third-party key or assume a cloud role, have agent::offense’s AI agent penetration testing time the kill switch, the separate identity and the log the agent cannot edit, before a control-incident definition decides the ticket can wait.