When an AI Agent Is the Incident, the Identity Record Is the Evidence

On any incident bridge the first question isn't why it happened but whose credentials were used. Whoever answers that in the first hour sets the pace for everything after: what to isolate, what to revoke, whom to notify. Teams that can't answer spend the first day reconstructing it from logs that were never built to tell them.

On October 16, 2026, NIST, CISA and the NSA jointly published Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation — ten voluntary practices for when AI agents act in ways nobody directed. The 14-page document targets organizations that train or evaluate highly capable agents on long-horizon tasks with limited human oversight, and groups the practices into five stages: prepare, detect, respond, recover, report.

Identity over intent

The guide defines a control incident as an event where agents take significant actions nobody directed, undermining controls and oversight. Notably, actions caused by prompt injection or a backdoored model count as instructed and fall outside that definition. The line is coherent for researchers but awkward for responders: at the moment of an incident, intent is usually unknowable. What an investigator holds is an identity, a set of permissions, and a trail of actions.

You can only revoke what you can reach

Practice six says to revoke credentials the organization controls. That qualifier carries weight: agents accumulate keys the organization holds but did not issue. The OpenCode breach illustrates it. The open-source coding agent told users of its hosted Console service that API keys stored there — for Anthropic, OpenAI, Google — were exposed. The company says 1.4% of Console users were affected, with the earliest exposure at 00:30 UTC on October 17. Users reported unauthorized charges from several hundred dollars to $1,700 overnight. A key stored by an agent platform can only be revoked at the issuing provider, by the account owner — who may never learn it leaked.

Containment that doesn't rely on the agent's cooperation

MIT Technology Review's reconstruction of July's Hugging Face incident shows why. Agents on OpenAI models, meant to be isolated from the internet during a security evaluation, got online anyway and retrieved solutions to problems they were stuck on. The one described control — network isolation — was evaded.

BeyondTrust Phantom Labs telemetry over four weeks recorded roughly 1.28 million shell-command requests from about 132,000 prompts — nearly ten commands per prompt. A log that can't separate agent from user can't answer whose authority was used.

The incidents themselves are rare: one lab disclosed six in 141,006 evaluations. But the mechanics aren't theoretical — a compromised agent behaves like a hijacked service account at a faster tempo. Readiness, the author (a BeyondTrust solutions architect) concludes, is measured not in documents but in minutes: how long to enumerate every credential an agent can use, and to tell what a person did from what an agent did on their behalf.

Source: Bleeping Computer