Some links on this page may be affiliate links. They never change a rating. Details
In 2026 the US National Institute of Standards and Technology (NIST) moved AI agent security from a research topic to a formal programme. For QA and SDET teams testing agents that call tools, browse or move data, it sets out what American organisations are being asked to think about. NIST has not issued binding rules here, so treat this as direction, not law.
What NIST and CAISI have published
- AI Agent Standards Initiative (17 February 2026). NIST’s Center for AI Standards and Innovation (CAISI) launched it with three pillars: industry-led standards for agent interoperability and security, community-led open-source agent protocols (including the Model Context Protocol ecosystem), and research on agent security, especially agent identity and limiting agents to the authority they are explicitly given.
- Request for Information (8 January 2026). CAISI asked for public input on agent security threats, measurement and gaps in existing frameworks. Comments closed on 9 March 2026.
- Agent identity and authorization concept paper (5 February 2026). NIST’s National Cybersecurity Center of Excellence proposed a demonstration project using OAuth 2.0, SPIFFE/SPIRE and the Model Context Protocol. Feedback was open until 2 April 2026.
- Control overlays for securing AI systems (COSAiS). An outline draft appeared on 8 January 2026, with overlays planned for single-agent and multi-agent deployments. Full publication is expected around late 2026 to 2027.
A red-teaming finding worth knowing
CAISI worked with the UK AI Security Institute on agent hijacking tests. Novel attacks raised task-hijacking success from 11% to 81%, and with 25 repeated attempts per task the average attack success rate rose from 57% to 80%. The lesson for test design is that a single pass of an attack prompt tells you little.
What to test (our interpretation)
The following checklist draws on the Cloud Security Alliance’s reading of this work, not on any NIST requirement:
- Inventory your agents. List each agent, its tools, its data sources and the identity it acts under.
- Include indirect prompt injection and memory poisoning in your red-team scope, and repeat each attack many times rather than once.
- Test least privilege. Check that an agent only has task-scoped permissions, not a full user login or a shared service account.
- Treat MCP as an attack surface. Test authentication, tool authorization and audit logging on every MCP server your agents use.
For hands-on methods, see our guides to prompt injection testing and how to test an AI chatbot.
Frequently Asked Questions
Is the NIST AI Agent Standards Initiative a regulation?
No. It is a standards and research effort. NIST asked for public comment, and nothing in the material we reviewed makes it a binding requirement.
What is CAISI?
CAISI is the Center for AI Standards and Innovation, part of NIST. It leads the agent security work described here.
Why test an agent more than once with the same attack?
Agent behaviour varies from run to run. In CAISI’s hijacking tests, repeating each attack 25 times raised the average success rate from 57% to 80%.
Sources
QA automation engineer. Each guide says what I ran myself and what I only researched, and I update it when things change. About me
One useful email a week
New guides, tool price changes and AI testing news. No spam.
