https://agentic-cyber-explorer.pages.dev/topics/standards-and-guidance/ New records, findings, and answers on standards & guidance, from Fide AI's Agentic Cyber Explorer. en Fide AI. Data licensed CC BY 4.0. Sat, 26 Sep 2026 12:00:00 GMT https://agentic-cyber-explorer.pages.dev/events/asd-agentic-ai-harnesses-guidance-2026/ event:asd-agentic-ai-harnesses-guidance-2026 Fri, 11 Sep 2026 12:00:00 GMT Policy & standards The Australian Signals Directorate's ACSC published guidance on agentic AI harnesses, the software layer that connects a model with organisational data, tools and systems and manages context, memory, tool access and execution privileges. According to coverage, it says some risks, including prompt injection, cannot be addressed within the model alone, that no harness is inherently secure, and recommends least privilege, human oversight for high-impact actions, audit logging and validating agent outputs before execution. It moves government guidance from model behavior to the tool, memory and permission layer where most agent compromises occur. https://agentic-cyber-explorer.pages.dev/events/mitre-atlas-2026-08-autonomous-attack-techniques/ event:mitre-atlas-2026-08-autonomous-attack-techniques Mon, 31 Aug 2026 12:00:00 GMT Policy & standards MITRE's August 2026 ATLAS release added techniques describing AI agents acting as attackers, including autonomous reconnaissance, attack-path adaptation, attack orchestration and autonomous exploit development. It also added agent-control mitigations and case studies including the GTG-1002 Claude Code espionage campaign and autonomous OpenAI evaluation agents compromising Hugging Face infrastructure. It extends ATLAS from attacks on AI systems to attacks carried out by AI agents, giving defenders shared identifiers for autonomous intrusion behavior. https://agentic-cyber-explorer.pages.dev/events/owasp-genai-llm-top-10-2026-edition/ event:owasp-genai-llm-top-10-2026-edition Mon, 03 Aug 2026 12:00:00 GMT Policy & standards The OWASP GenAI Security Project released the 2026 edition of its LLM Top 10, which it says updates rankings and expands threat coverage based on real-world incidents. OWASP says the edition maps risks to NIST, MITRE ATLAS, CWE and the OWASP Top 10 for Agentic Applications, and it was followed in September 2026 by an industry framework crosswalk and an Agent Control Standard. It aligns the main LLM application checklist with the agent-specific list, which affects how audits scope agent risk. https://agentic-cyber-explorer.pages.dev/events/anthropic-cyber-jailbreak-severity-framework-2026/ event:anthropic-cyber-jailbreak-severity-framework-2026 Thu, 02 Jul 2026 12:00:00 GMT Policy & standards Anthropic published an early-draft Cyber Jailbreak Severity framework, developed with Project Glasswing partners, to score cyber jailbreaks on capability gain, breadth, ease of weaponization and discoverability, mapped to five levels from CJS-0 to CJS-4. It also described Fable 5's cyber classifier tiers, which block prohibited and high-risk dual-use requests such as exploit development while allowing defensive work like patching and incident response. A shared severity scale for safeguard bypasses is a precondition for proportionate government and industry responses like the June 2026 suspension. https://agentic-cyber-explorer.pages.dev/events/five-eyes-ai-shift-in-cyber-risk-statement-2026/ event:five-eyes-ai-shift-in-cyber-risk-statement-2026 Mon, 22 Jun 2026 12:00:00 GMT Policy & standards The heads of the Five Eyes cyber agencies issued a joint statement that AI is rapidly transforming cyber risk and that organizations must act within months, not years. They ask leaders to reduce attack surface, accelerate patching as exploitation windows shorten, replace unsupported legacy systems, strengthen identity controls, and prepare for incidents. It is the highest-level joint government signal that frontier AI vulnerability discovery changes patching expectations. https://agentic-cyber-explorer.pages.dev/events/anthropic-mapping-ai-cyber-threats-attack-2026/ event:anthropic-mapping-ai-cyber-threats-attack-2026 Wed, 03 Jun 2026 12:00:00 GMT Attacks & incidents Anthropic analyzed 832 accounts it banned for malicious cyber activity between March 2025 and March 2026 and mapped their use of Claude onto MITRE ATT&CK. It reports that the most common AI use was preparation such as writing malware, that use shifted toward activity after initial compromise, and that the share of actors its system rated medium risk or higher rose from 33% to 56% between the two six-month halves. A year of provider data suggests attackers apply AI later in the attack lifecycle, which weakens traditional ways of ranking threat actors by skill. https://agentic-cyber-explorer.pages.dev/events/fmf-emerging-security-practices-ai-agents-2026/ event:fmf-emerging-security-practices-ai-agents-2026 Wed, 03 Jun 2026 12:00:00 GMT Policy & standards The Frontier Model Forum described security practices for AI agents: limiting agent actions and resource access to what is strictly necessary, sandboxing with filesystem scope and egress policies, deterministic controls outside the model's reasoning loop, confirmation before high-stakes actions, and audit logs. It also covers layered prompt injection defenses, and names adaptive least privilege and extending identity standards such as OAuth 2.0 to agents as promising or developing areas. It documents what frontier developers say they actually do to contain their own agents. https://agentic-cyber-explorer.pages.dev/events/nsa-mcp-security-design-considerations-2026/ event:nsa-mcp-security-design-considerations-2026 Wed, 20 May 2026 12:00:00 GMT Policy & standards The NSA's Artificial Intelligence Security Center released a cybersecurity information sheet on the Model Context Protocol, warning that adoption has outpaced safeguards. It recommends vetting MCP tools, least-privilege access and isolation, validating outputs where one model's output feeds another, and detailed logging integrated with security monitoring, and it lists poor approval workflows among the risks. It is signals-intelligence agency guidance specific to the protocol many agents use to reach tools and data. https://agentic-cyber-explorer.pages.dev/events/ncsc-thinking-carefully-agentic-ai-2026/ event:ncsc-thinking-carefully-agentic-ai-2026 Fri, 15 May 2026 12:00:00 GMT Policy & standards NCSC authors advise deploying agentic AI incrementally through tightly bounded pilots, granting agents only the minimum permissions with temporary credentials, and defining in advance who approves access, monitors behavior and can halt the agent. They recommend incident response plans for agent failure and loss-of-control scenarios. It turns joint international agentic AI guidance co-authored by the NCSC into concrete operating rules, including temporary credentials and a named owner who can stop the agent. https://agentic-cyber-explorer.pages.dev/events/ncsc-ten-questions-ai-vulnerability-discovery-2026/ event:ncsc-ten-questions-ai-vulnerability-discovery-2026 Mon, 11 May 2026 12:00:00 GMT Policy & standards The head of the NCSC's Vulnerability Management Group published ten questions for organizations considering AI-driven vulnerability discovery. The questions stress having a process to triage and fix findings, prioritizing exploitable issues, weighing data, permission, legal and jurisdiction risks of the chosen model, starting with the external attack surface, and planning for future models. It is government guidance on the operational side effects of defensive AI vulnerability discovery, such as unmanageable finding volume. https://agentic-cyber-explorer.pages.dev/events/cosai-agentic-identity-access-management-2026/ event:cosai-agentic-identity-access-management-2026 Wed, 06 May 2026 12:00:00 GMT Policy & standards The Coalition for Secure AI released a paper on identity and access management for agents from its Secure Design Patterns for Agentic Systems workstream, focused on unique agent credentials and task-limited access. A companion paper on multi-agent systems discusses semantic-layer attacks, intent-based authorization and proposes agent detection and response as a defense category. Agent identity and scoped credentials are a core open problem named in NIST, CISA and OWASP work, and this is an industry design pattern for it. https://agentic-cyber-explorer.pages.dev/events/five-eyes-careful-adoption-agentic-ai-2026/ event:five-eyes-careful-adoption-agentic-ai-2026 Fri, 01 May 2026 12:00:00 GMT Policy & standards CISA and the Australian Signals Directorate, with US and international partners, published guidance on the cybersecurity risks of agentic AI services and recommended mitigations. CISA highlights expanded attack surface, privilege creep, behavioral misalignment and obscure event records as risks, and recommends avoiding broad access, starting with low-risk use cases, and folding agent security into existing risk models. It is coordinated multi-government guidance written specifically for organizations deploying agents. https://agentic-cyber-explorer.pages.dev/events/ncsc-frontier-ai-defenders-readiness-2026/ event:ncsc-frontier-ai-defenders-readiness-2026 Mon, 30 Mar 2026 12:00:00 GMT Policy & standards An NCSC technical director and an AI Security Institute researcher wrote that leading models went in about 18 months from barely progressing on a simulated enterprise attack range to completing over half of a 32-step scenario. They urge defenders to prioritize fundamentals such as asset inventory, access control, secure configuration and logging, and to adopt AI carefully for defense. NCSC CEO Richard Horne followed on April 15, 2026, warning that AI will make discovering and exploiting weaknesses easier, faster and cheaper. It pairs government capability measurements with concrete defender priorities at the moment frontier cyber capability became a policy issue. https://agentic-cyber-explorer.pages.dev/events/nist-ai-agent-standards-initiative-2026/ event:nist-ai-agent-standards-initiative-2026 Tue, 17 Feb 2026 12:00:00 GMT Policy & standards CAISI, with NIST's Information Technology Laboratory, launched an initiative to support industry-led standards and open protocols for AI agents and research on agent security and identity. Announced deliverables included the agent security RFI, an AI agent identity and authorization concept paper with comments due April 2, 2026, and sector listening sessions from April 2026. It is the main US government program for agent identity, authorization and security standards. https://agentic-cyber-explorer.pages.dev/events/caisi-rfi-security-ai-agents-2026/ event:caisi-rfi-security-ai-agents-2026 Thu, 08 Jan 2026 12:00:00 GMT Policy & standards CAISI published a Federal Register request for information on practices for measuring and improving the security of AI agent systems, citing hijacking, backdoors and indirect prompt injection. It asks about model-level, system-level and human-oversight controls, assessment methods, and ways to limit, modify and monitor deployment environments. It is a US government solicitation focused specifically on agent security controls and how to measure them. https://agentic-cyber-explorer.pages.dev/events/nist-cyber-ai-profile-preliminary-draft-2025/ event:nist-cyber-ai-profile-preliminary-draft-2025 Tue, 16 Dec 2025 12:00:00 GMT Policy & standards NIST published a preliminary draft Cybersecurity Framework Profile for Artificial Intelligence, aligned with CSF 2.0. It is organized around three focus areas: securing AI systems, using AI for cyber defense, and thwarting AI-enabled cyberattacks, with comments due January 30, 2026. It is the vehicle through which NIST intends to fold AI-enabled attack and defense, including agents, into the CSF outcomes organizations already report against. https://agentic-cyber-explorer.pages.dev/events/owasp-top-10-agentic-applications-2025/ event:owasp-top-10-agentic-applications-2025 Tue, 09 Dec 2025 12:00:00 GMT Policy & standards The OWASP GenAI Security Project released its Top 10 for Agentic Applications, a list of ten risk categories specific to agents that plan, hold memory, call tools and act with delegated authority. The release came with an updated Agentic Threats and Mitigations taxonomy (v1.1) and a capture-the-flag practice platform. It is OWASP's agent-specific risk list, complementing its Top 10 for LLM applications. https://agentic-cyber-explorer.pages.dev/events/ncsc-prompt-injection-not-sql-injection-2025/ event:ncsc-prompt-injection-not-sql-injection-2025 Mon, 08 Dec 2025 12:00:00 GMT Policy & standards An NCSC technical director argued that prompt injection differs from SQL injection because LLMs do not separate data from instructions, so it should be treated as a residual confused-deputy risk rather than a patchable bug. The NCSC recommends deterministic safeguards that constrain system actions, dropping an LLM's privileges to those of the party whose content it is processing, and logging full inputs, outputs and tool calls. A national cyber agency stating that prompt injection is inherent shifts agent security from filtering toward privilege and blast-radius design. https://agentic-cyber-explorer.pages.dev/events/cisa-principles-ai-in-operational-technology-2025/ event:cisa-principles-ai-in-operational-technology-2025 Wed, 03 Dec 2025 12:00:00 GMT Policy & standards CISA and the Australian Signals Directorate, with NSA, FBI and national cyber agencies of Canada, Germany, the Netherlands, New Zealand and the UK, published four principles for integrating AI into operational technology. The guidance explicitly covers machine learning, LLM-based AI and AI agents because of the security and safety challenges they pose in industrial environments. It is multinational guidance that addresses AI, including agents, acting in safety-critical industrial control environments. https://agentic-cyber-explorer.pages.dev/events/mitre-atlas-v5-agent-techniques-2025/ event:mitre-atlas-v5-agent-techniques-2025 Tue, 30 Sep 2025 12:00:00 GMT Policy & standards MITRE ATLAS version 5.0.0 added a set of techniques for attacks on AI agents, including agent context poisoning of memory and threads, modifying agent configuration, credential theft from agent configuration, and exfiltration via agent tool invocation, and renamed LLM Plugin Compromise to AI Agent Tool Invocation. Version 5.1.0 (November 6, 2025) added agent-specific mitigations such as tool permission configuration and human-in-the-loop for agent actions. ATLAS is the ATT&CK-style reference defenders use to map detections, and these versions made agent compromise a first-class part of it. https://agentic-cyber-explorer.pages.dev/events/nist-cosais-control-overlays-concept-2025/ event:nist-cosais-control-overlays-concept-2025 Thu, 14 Aug 2025 12:00:00 GMT Policy & standards NIST released a concept paper for Control Overlays for Securing AI Systems (COSAiS), which would tailor SP 800-53 security controls to AI use cases. The planned use cases include generative AI assistants, predictive AI, single-agent systems, multi-agent systems and controls for AI developers, informed by the AI 100-2 E2025 taxonomy. As of the project page, only an annotated outline for the predictive AI overlay (January 8, 2026) had followed; agent overlays had not been published. Agent-specific SP 800-53 overlays would give federal agencies and contractors auditable control baselines for agents; their absence is a notable gap. https://agentic-cyber-explorer.pages.dev/events/cosai-secure-by-design-agentic-principles-2025/ event:cosai-secure-by-design-agentic-principles-2025 Wed, 16 Jul 2025 12:00:00 GMT Policy & standards The Coalition for Secure AI, an OASIS Open Project, published three principles for agentic systems. The principles call for agents that are human-governed and accountable, bounded and resilient with strict, purpose-specific entitlements, and transparent and verifiable through secure AI supply chain controls and telemetry that supports monitoring and forensics. It is an industry consensus statement that bounded entitlements and forensic telemetry are baseline requirements for agents. https://agentic-cyber-explorer.pages.dev/events/mcp-spec-authorization-update-2025/ event:mcp-spec-authorization-update-2025 Wed, 18 Jun 2025 12:00:00 GMT Policy & standards The 2025-06-18 revision of the Model Context Protocol specification classifies MCP servers as OAuth resource servers with protected resource metadata, and requires clients to implement RFC 8707 resource indicators so malicious servers cannot obtain tokens meant for others. It also clarifies authorization security considerations and adds a security best practices page. It is the main protocol-level change addressing token misuse between MCP clients and servers. https://agentic-cyber-explorer.pages.dev/events/five-eyes-ai-data-security-2025/ event:five-eyes-ai-data-security-2025 Thu, 22 May 2025 12:00:00 GMT Policy & standards The NSA AI Security Center, CISA, the FBI and international partners released a cybersecurity information sheet on securing data used to train and operate AI systems across the lifecycle. It recommends robust data protection, proactive risk management and stronger monitoring and threat detection, and is aimed at defense industrial base, national security system, federal and critical infrastructure operators. Data poisoning and tampering of retrieval and training data are upstream routes to compromising agents that read that data. https://agentic-cyber-explorer.pages.dev/events/nist-ai-100-2-e2025-security-of-agents-2025/ event:nist-ai-100-2-e2025-security-of-agents-2025 Mon, 24 Mar 2025 12:00:00 GMT Policy & standards NIST released the 2025 edition of its adversarial machine learning taxonomy, co-authored with the UK AI Security Institute and US AI Safety Institute staff. Unlike the 2023 edition, it includes a section on the security of agents, noting that tool-using agents are exposed to direct and indirect prompt injection and that hijacking can lead to arbitrary code execution or data exfiltration. It is the reference US government taxonomy that COSAiS overlays and CAISI agent work build on. https://agentic-cyber-explorer.pages.dev/events/owasp-agentic-ai-threats-and-mitigations-2025/ event:owasp-agentic-ai-threats-and-mitigations-2025 Mon, 17 Feb 2025 12:00:00 GMT Policy & standards OWASP's Agentic Security Initiative published a threat-model-based reference of emerging threats to LLM-powered autonomous agents and corresponding mitigations. It became the taxonomy underpinning the later OWASP Top 10 for Agentic Applications, which shipped with an updated v1.1 of this guide. It is a community taxonomy built specifically for agents rather than chat applications. https://agentic-cyber-explorer.pages.dev/events/csa-maestro-agentic-threat-modeling-2025/ event:csa-maestro-agentic-threat-modeling-2025 Thu, 06 Feb 2025 12:00:00 GMT Policy & standards The Cloud Security Alliance published MAESTRO (Multi-Agent Environment, Security, Threat, Risk, and Outcome), a threat modeling framework for agentic AI authored by Ken Huang. It organizes analysis into seven layers from foundation models to the agent ecosystem and highlights agent-specific threats such as goal manipulation, agent impersonation and collusion between agents. It is a practitioner method for threat modeling multi-agent systems, aimed at gaps its authors see in STRIDE-style frameworks. https://agentic-cyber-explorer.pages.dev/events/uk-ai-cyber-security-code-of-practice-2025/ event:uk-ai-cyber-security-code-of-practice-2025 Fri, 31 Jan 2025 12:00:00 GMT Policy & standards The UK government published a voluntary Code of Practice for the Cyber Security of AI setting 13 principles across five lifecycle phases for developers, system operators and data custodians. It names indirect prompt injection as a distinct AI risk and includes provisions on audit trails, least-privilege access and monitoring system behaviour. ETSI published the content as Technical Specification TS 104 223 in April 2025. It is a government baseline whose provisions (least privilege, behaviour monitoring, prompt audit trails) map directly onto agent deployments. https://agentic-cyber-explorer.pages.dev/events/nist-ai-800-1-second-draft-cyber-misuse-2025/ event:nist-ai-800-1-second-draft-cyber-misuse-2025 Wed, 15 Jan 2025 12:00:00 GMT Policy & standards NIST's AI Safety Institute released a second public draft of NIST AI 800-1, voluntary guidelines for managing misuse risk from dual-use foundation models across the lifecycle. NIST says the draft adds detailed evaluation approaches, a marginal-risk framework, and an extensive appendix on cybersecurity misuse risk, and covers both closed and open model developers. It was the main US government draft practice for measuring and mitigating cyber misuse of frontier models before the 2025 policy shift. https://agentic-cyber-explorer.pages.dev/events/fmf-issue-brief-ai-for-cyber-defense-2024/ event:fmf-issue-brief-ai-for-cyber-defense-2024 Fri, 22 Nov 2024 12:00:00 GMT Policy & standards The Frontier Model Forum, an industry body of frontier labs, published an issue brief on using frontier AI for cyber defense. It lists use cases including process automation for incident response, natural-language querying and analysis, vulnerability discovery and fixing, open-source intelligence and training, and recommends designing for human-AI collaboration rather than full automation. It records the lab consortium's stated position on defensive agent use before autonomous defense became a policy priority in 2026. https://agentic-cyber-explorer.pages.dev/events/owasp-llm-top-10-2025-edition-2024/ event:owasp-llm-top-10-2025-edition-2024 Sun, 17 Nov 2024 12:00:00 GMT Policy & standards The OWASP GenAI Security Project released the 2025 edition of its Top 10 for LLM Applications. Prompt injection remains the top risk, and the list includes Excessive Agency (LLM06) covering systems granted the ability to call functions and take actions, along with system prompt leakage and vector and embedding weaknesses. It is OWASP's practitioner checklist for LLM application risk and the direct predecessor of its agent-specific lists. https://agentic-cyber-explorer.pages.dev/events/five-eyes-deploying-ai-systems-securely-2024/ event:five-eyes-deploying-ai-systems-securely-2024 Mon, 15 Apr 2024 12:00:00 GMT Policy & standards The NSA's Artificial Intelligence Security Center led joint guidance with CISA, the FBI and the national cyber centres of Australia, Canada, New Zealand and the UK on deploying and operating externally developed AI systems. It sets objectives to improve the confidentiality, integrity and availability of AI systems and to mitigate known vulnerabilities, organized around protecting, detecting malicious activity against, and responding to incidents involving AI systems. It is joint government guidance aimed at organizations deploying AI rather than building it, the population that deploys agents. https://agentic-cyber-explorer.pages.dev/events/nist-ai-100-2-e2023-aml-taxonomy-2024/ event:nist-ai-100-2-e2023-aml-taxonomy-2024 Thu, 04 Jan 2024 12:00:00 GMT Policy & standards NIST released the final NIST AI 100-2 E2023 report, a taxonomy and terminology of attacks on and mitigations for machine learning systems. Its generative AI chapter includes separate sections on direct prompt injection and indirect prompt injection, but no dedicated section on agents. It established the US government vocabulary for prompt injection that later agent security guidance and evaluations reuse. https://agentic-cyber-explorer.pages.dev/events/ncsc-cisa-guidelines-secure-ai-system-development-2023/ event:ncsc-cisa-guidelines-secure-ai-system-development-2023 Mon, 27 Nov 2023 12:00:00 GMT Policy & standards The UK NCSC published guidelines for providers of AI systems, developed with CISA and endorsed by agencies from 18 countries. The guidance is organized around four lifecycle areas: secure design, secure development, secure deployment, and secure operation and maintenance, and takes a secure-by-default approach. It is the baseline multinational government guidance that later AI and agent security documents (the UK Code of Practice, ETSI TS 104 223, the 2026 agentic guidance) build on.