NIST Presents Classification of Attacks on AI Agents and Protection Methods
The U.S. National Institute of Standards and Technology (NIST) has published a public draft of a taxonomy of attacks and protective measures for AI agents. Comments on the document are accepted until December 18, 2026.
Document SP 2400-102 E2026 systematizes threats to predictive, generative, and agent-based systems and proposes a common language for their description. NIST plans to rely on this classification when preparing future standards and practical guidelines for AI security.
The new edition focuses primarily on attacks targeting agent-based systems. An attacker may interfere with task formulation, planning, execution of actions, or processing of tool results. Possible objectives include disrupting availability and integrity, exposing sensitive data, and using the agent for malicious purposes.
The draft examines attacks via user queries, the model supply chain, untrusted documents, web pages, and knowledge bases. Fraudulent instructions may also enter the agent’s long-term memory, causing their influence to persist between working sessions. Risks associated with connected tools, integrated skills, and interactions among multiple agents are described separately: a compromised component can transmit malicious messages to others.
For protection, NIST considers training models to recognize instructions in untrusted content, system-level restrictions on data transmission and operation execution, and isolation of tools containing potentially dangerous code. The authors note, however, that specially crafted attacks may bypass model-level defenses, making independent checks of operation permissibility and system-wide consequence limitations essential.
Public discussion of the draft will continue until December 18, 2026. After reviewing comments, NIST will prepare the final version of the document.
