NIST published an initial public draft of NIST SP 2400-102e2026, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, on November 9, 2026. The CSRC announcement says the comment period closes December 18, 2026, and that the new edition focuses on attacks on agentic systems and their mitigations. It is a voluntary draft and it may change before a final edition.
One note on language: the document calls its subject “SI” (super intelligence) systems, while this column writes AI agents and quotes the text only where its exact wording matters.
What the draft gives security teams
The announcement describes the taxonomy as meant to inform other standards and future practice guides by establishing a common language for the field. For agents, that language is concrete. The report defines an agent as a system that can interact with an environment, receive information, and autonomously execute actions in service of a specified goal. It adds that agents may keep memory across sessions and may work with other agents.
The index of agent attacks sorts named attack types under availability, integrity, privacy, misuse, and supply chain groupings. The index names 12 distinct attack types, including agent hijacking, memory poisoning, malicious tools, malicious skills, malicious agents, resource exhaustion, and decomposition attacks (NIST, 2026, index pages xi to xii). The report says these attacks have been demonstrated against production systems and observed in the wild, and that compromise can persist when an agent keeps long-term memory.
On defenses, the report is direct about the state of the field. Agent mitigations remain at an early stage, and the authors, citing adaptive attacks that bypassed published defenses, suggest that agent guardrails must also be evaluated against attackers who tailor their attacks to the defense. That is a testing expectation. Results from a fixed list of known attacks alone don’t show how a guardrail holds up against an attacker who has studied it.
Where the taxonomy stops
The report states its limit in the executive summary. It does not make recommendations on risk tolerance, meaning the level of risk acceptable to organizations or society, because that level is contextual and specific to applications and use cases. A later section says the taxonomy deliberately leaves aside how organizations decide about developing and using these systems in light of attack evidence.
The draft also tells readers what to expect from mitigations. It reports that several lines of research point to the same result, that perfect mitigations are not attainable, and it advises that organizations, particularly those delegating trust to models in high-stakes contexts, assume a breach and manage the residual risk. Residual risk doesn’t manage itself. Someone has to look at what remains after the guardrails and tests, and decide whether the organization will live with it.
That decision belongs to AI Governance. The testing belongs to Responsible AI, which in this column means machine checking machine with no human review. Guardrails, classifiers, monitors that watch an agent’s full sequence of actions, and automated attack simulations are valuable and necessary, and they fit work where outputs are reversible. They produce evidence but don’t accept risk. AI Governance places a named human at a Checkpoint-Based Governance checkpoint, a point where that person decides before the work proceeds, to record accept, modify, or reject for each relevant attack type on each deployed agent before the agent goes live. Choosing Responsible AI alone for a given agent is a legitimate organizational decision based on risk tolerance and consequence severity. It should be made on purpose and written down.
The draft does not hand organizations a ready answer on human involvement either. It says traditional recommendations such as human-in-the-loop oversight and control are difficult to apply at the speed and scale of agentic systems, and that deciding which decision points to escalate to humans is an open research problem. The organization can’t borrow a design from the document, so it has to define its own escalation points and name the signer itself.
Two more points matter for internal planning. First, the document says it does not establish any legal standard or defense. An earlier column on this site argued that a recognized standard can become the yardstick for whether an organization took the precautions a careful peer would have taken. After an incident, a published taxonomy of attack types may be read as a list of what the organization could have looked for. Second, standards language can leave the human decider out. Basil C. Puglisi’s public comment asking for binding human decision authority in the Clause 3.2 definition of AI governance in ISO/DIS 21520, the draft international standard for AI in project management, was rejected by the U.S. Technical Advisory Group on September 21, 2026, as that column reports. A public comment period is the point where outsiders can ask for the human decider to be named, and this draft has one.
Unintended agent failures need a separate owner. The report states that failures that do not arise from adversarial attacks, such as models reaching the internet from test environments, are outside the scope of the taxonomy. A team that maps agents only to this taxonomy covers attackers and still needs a named owner for incidents no attacker caused.
What to do before the comment period closes
- Map each deployed agent to the taxonomy’s agent attack types. List its tools, memory, other agents it talks to, and data sources it reads, then mark which attack types apply.
- Record a signed residual-risk decision per attack type. A named owner writes accept, modify, or reject, the date, and the evidence the decision rests on. A committee name does not count as a signer.
- Rerun adaptive tests when the agent’s configuration changes. Include attacks built against the specific defense in place, and keep those results beside the known-attack results.
- Give unintended agent failures their own owner. Write down who answers for non-adversarial incidents, since the taxonomy excludes them.
- Submit comments to NIST by December 18, 2026. The document lists SP-2400-102@nist.gov for comments. Ask NIST to name where the human risk decision sits when an organization uses the taxonomy, and to say who owns agent failures with no attacker.
Two measures track progress. The first is the share of applicable agent attack types with a signed decision, tracked per deployed agent. A new agent starts at zero and should not reach production below the threshold the signer sets. The second is the share of guardrail tests that were adaptive, meaning designed against the specific defense in place. A low share means the testing record says little about an attacker who adapts, so reviewers should read it beside coverage and open findings. Report both to the executive who owns the deployment, and review them at each change to the model, tools, memory, or connected agents.
Sources
- National Institute of Standards and Technology, Computer Security Resource Center. (2026, November 9). Adversarial machine learning taxonomy and terminology | Draft NIST SP 2400-102e2026 [News item]. https://csrc.nist.gov/News/2026/adversarial-machine-learning-taxonomy-2026-draft
- Vassilev, A., Oprea, A., Fordyce, A., Davies, X., & Hamin, M. (2026). Adversarial machine learning: A taxonomy and terminology of attacks and mitigations (NIST Special Publication 2400-102e2026, initial public draft). National Institute of Standards and Technology. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.2400-102e2026.ipd.pdf
- Puglisi, B. C. (2026). The standard of care: How NIST and ISO are turning voluntary AI governance into a liability defense. basilpuglisi.com. https://basilpuglisi.com/standard-of-care-ai-governance/
- Puglisi, B. C. (2026). Humans are optional when defining AI governance for ISO, according to the U.S. Technical Advisory Group. basilpuglisi.com. https://basilpuglisi.com/humans-optional-ai-governance-iso/
FAQ
What is NIST SP 2400-102e2026?
It is an initial public draft titled Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, released November 9, 2026. It sets out concepts and terminology for attacks on machine learning systems and, in this edition, focuses on attacks on agentic systems and their mitigations.
Is the draft mandatory?
No. The draft says its guidance remains voluntary and that it does not establish any legal standard or defense. It is also a draft, so the text may change before a final edition.
Does the draft tell organizations how much agent attack risk to accept?
No. It states that it makes no recommendation on risk tolerance because that level is contextual and specific to applications and use cases. The organization has to decide, and AI Governance means a named human records accept, modify, or reject for each relevant attack type on each deployed agent.
What is the difference between Responsible AI and AI Governance for agent security?
Responsible AI is machine checking machine with no human review, and guardrail tests, classifiers, and automated attack simulations all fall under it. AI Governance requires a named human to make the decision at a checkpoint, such as signing the residual risk for each relevant agent attack type before deployment.
Does the taxonomy cover agents that fail without an attacker?
No. The report says failures that do not arise from adversarial attacks are outside the scope of the taxonomy. An organization needs a separate named owner for those failures.
How do I comment on the draft, and by when?
The public comment period runs from November 9, 2026, to December 18, 2026. The draft lists SP-2400-102@nist.gov for comments. A useful comment asks NIST to say where the human risk decision sits when an organization applies the taxonomy.
AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIgenerated
Leave a Reply