NIST

NIST announced a paper by Apostol Vassilev in IEEE Security & Privacy arguing, by extension of Gödel's incompleteness results, that no finite set of guardrails can be universally robust against adversarial prompts. NIST recommends a continuous monitor-and-update model: ongoing red teaming, continuous guardrail updates, and operational resilience to limit impact and recover.

NIST's Center for AI Standards and Innovation evaluated the open-weight DeepSeek V4 Pro model and reported that it lags leading US models by roughly eight months in aggregate capability. On a cyber capture-the-flag benchmark it scored well below GPT-5.5 and Claude Opus 4.6, and CAISI notes its non-public benchmarks show weaker agentic performance than DeepSeek's self-reported results.

CAISI, with NIST's Information Technology Laboratory, launched an initiative to support industry-led standards and open protocols for AI agents and research on agent security and identity. Announced deliverables included the agent security RFI, an AI agent identity and authorization concept paper with comments due April 2, 2026, and sector listening sessions from April 2026.

CAISI published a Federal Register request for information on practices for measuring and improving the security of AI agent systems, citing hijacking, backdoors and indirect prompt injection. It asks about model-level, system-level and human-oversight controls, assessment methods, and ways to limit, modify and monitor deployment environments.

NIST published a preliminary draft Cybersecurity Framework Profile for Artificial Intelligence, aligned with CSF 2.0. It is organized around three focus areas: securing AI systems, using AI for cyber defense, and thwarting AI-enabled cyberattacks, with comments due January 30, 2026.

NIST's CAISI evaluated DeepSeek R1, R1-0528 and V3.1 against US reference models across 19 benchmarks, as directed by the AI Action Plan. CAISI reports the largest capability gap on software engineering and cyber tasks, and found DeepSeek-based agents far more likely to follow hijacking instructions and to comply with jailbroken malicious requests.

NIST released a concept paper for Control Overlays for Securing AI Systems (COSAiS), which would tailor SP 800-53 security controls to AI use cases. The planned use cases include generative AI assistants, predictive AI, single-agent systems, multi-agent systems and controls for AI developers, informed by the AI 100-2 E2025 taxonomy. As of the project page, only an annotated outline for the predictive AI overlay (January 8, 2026) had followed; agent overlays had not been published.

Commerce Secretary Howard Lutnick announced the US AI Safety Institute would become the Center for AI Standards and Innovation (CAISI) within NIST. CAISI was tasked with voluntary agreements with developers and unclassified evaluations focused on demonstrable risks such as cybersecurity, biosecurity and chemical weapons, plus assessment of adversary AI systems for backdoors and other security vulnerabilities.

NIST released the 2025 edition of its adversarial machine learning taxonomy, co-authored with the UK AI Security Institute and US AI Safety Institute staff. Unlike the 2023 edition, it includes a section on the security of agents, noting that tool-using agents are exposed to direct and indirect prompt injection and that hijacking can lead to arbitrary code execution or data exfiltration.

NIST's AI safety institute technical staff (renamed the Center for AI Standards and Innovation in June 2025) extended AgentDojo and red-teamed agents built on the upgraded Claude 3.5 Sonnet. On held-out Workspace tasks, attack success rose from 11% for the strongest baseline attack to 81% for the strongest newly developed attack, and across five injection tasks from 57% to 80% when each attack was tried 25 times. The team released an Inspect-based AgentDojo port and ran the red teaming with the UK AI Security Institute.

NIST's AI Safety Institute released a second public draft of NIST AI 800-1, voluntary guidelines for managing misuse risk from dual-use foundation models across the lifecycle. NIST says the draft adds detailed evaluation approaches, a marginal-risk framework, and an extensive appendix on cybersecurity misuse risk, and covers both closed and open model developers.

NIST released the final NIST AI 100-2 E2023 report, a taxonomy and terminology of attacks on and mitigations for machine learning systems. Its generative AI chapter includes separate sections on direct prompt injection and indirect prompt injection, but no dedicated section on agents.