NIST Publishes Draft Taxonomy SP 2400-102 for Attacks on AI Agents
NIST released the first public draft of SP 2400-102 E2026 on 9 November 2026, extending its 2025 taxonomy of machine-learning attacks with a dedicated chapter on AI agents. The document aims to establish shared terminology for developers, researchers, and security teams when describing threats and countermeasures, serving as a foundation for future standards and guidelines.
Attacks on AI Agents
The new chapter examines attacks across the agent lifecycle: task assignment, planning, action execution, tool-result processing, and plan refinement. Adversary objectives include availability denial by forcing endless tool invocations, integrity violations that change behavior or produce unauthorized actions, data leakage, and repurposing the agent for malicious ends.
Attack surfaces include direct user prompts that split malicious goals into seemingly benign steps, supply-chain compromise of the underlying model through poisoned training data or tampered fine-tuning components, and indirect prompt injection via malicious content embedded in documents, web pages, or knowledge bases. Additional vectors target tool descriptions and outputs, plugin skill sets, and inter-agent messaging where a compromised agent relays forged instructions to peers.
Long-running agents that retain state between sessions introduce persistence risks: once an injected instruction is stored in memory, it can influence future tasks indefinitely. NIST stresses the need to monitor what an agent retains after an attack and how that information is reused.
Defensive Measures
Defenses operate at both model and system layers. Models can be trained to distinguish user instructions from untrusted content, yet carefully crafted attacks may still bypass this protection. System-level controls therefore limit data access and operation execution even when the model accepts a parasitic instruction. Tool isolation is recommended to contain malicious code that may be present in external functions.
These restrictions must be balanced against legitimate task performance. The draft notes that combining model and system protections requires further research, referencing sections 4.4–4.5.
Testing and Standards Alignment
The taxonomy supports structured testing. An example scenario involves an agent with email access that requires human approval before sending messages. Testers compare runs with and without an injected instruction to send mail immediately, checking tool-call logs against service logs to determine whether the approval control was bypassed.
OWASP LLM03:2026 Excessive Agency similarly recommends independent validation and human confirmation for high-impact actions. In Russia, GOST R 56939-2024 provides requirements for secure software development, while GOST R 59276-2020 links trust evaluation to both security and functional performance. Sber and Yandex have already incorporated agent-specific threats into their AI threat models and the AI-SAFE framework.
Related articles
Deepfake Videos for Business Attacks Drop to Just $5 per Minute as AI Costs Plummet
The cost of creating convincing deepfake videos for attacks on companies has fallen roughly 100 times over the past two years. A single minute of high-quality fake video can now be produced for as little as $5, compared with several hundred dollars previously. The drop in prices was reported by Russian newspaper Izvestia, which also noted that underground marketplaces now sell ready-made templates that further reduce expenses. Lower prices significantly lower the barrier for criminals to conduct business email compromise and CEO impersonation scams. Experts warn that recognizable faces combined with urgent requests for wire transfers or credential sharing make traditional verification methods less reliable. Organizations are advised to confirm all financial instructions through an independent, pre-established channel rather than relying on video calls alone.
Over a Dozen AI Platforms Breached in One Month for API Keys in LLM-Jacking Operations
Between late September and early November, at least a dozen AI developer platforms were compromised in a coordinated campaign targeting API access tokens rather than customer data. Affected organizations include Andromeda, NVIDIA Brev, CommandCode, Fireworks AI, Lightning AI, Northflank, OpenCode, Railway, Trigger.dev, Warp, Zeabur, Chainstack, and WorkOS. Attackers exploited third-party components and internal sales applications to reach stored credentials used for AI inference services. The stolen tokens enable LLM-jacking and model distillation activities, with multiple threat groups observed reusing the same credentials shortly after disclosure. The open-source penetration testing framework Artex was used to automate reconnaissance and exploitation, lowering the barrier for less skilled actors. Companies such as Chainstack and WorkOS confirmed the incidents through their own disclosures, highlighting risks in non-core systems that store high-value AI credentials.
Fake ITSM Tickets Allow Attackers to Trick AI SOC Agents into Dismissing Real Incidents
An experiment with the DeepSeek model showed that AI agents in Security Operations Centers can be reliably deceived by forged change-management tickets rather than classic prompt injection. Attackers with limited rights edit already-approved tickets in an ITSM system, changing the server and maintenance window while preserving the “Approved” status. The agent reads the ticket, matches the observed actions to the documented work, and automatically closes the alert. Human analysts reviewing the closed case later see only the reassuring link to the ticket and may also accept the decision. Three common LLM-based defenses—strict prompting, a secondary critic model, and supplying audit logs—either blocked too many legitimate changes or still allowed a quarter of attacks through. Only a deterministic code gate that cross-checks the ticket against immutable logs, role directories, and time windows achieved zero false closures on the test set while still automating 97 percent of genuine maintenance events.
How AI Agents Are Reshaping Cybersecurity Hiring: What Employers Ask in 2026 Interviews
Cybersecurity job interviews in 2026 increasingly feature the question of how candidates work with AI agents, as employers seek engineers who can respond rapidly to emerging vulnerabilities. The shift stems from the fact that proof-of-concept exploits now appear within hours of disclosure, leaving defenders with almost no time for traditional patching workflows. Companies now expect security engineers to act as independent units capable of assessing exploit viability, mapping impact to their infrastructure, and detecting compromise indicators using agent-based automation. Innostage director Vladimir Dryukov explains that narrow specialists are losing ground to professionals who combine deep technical knowledge with the ability to build, constrain, and validate AI agent pipelines. The article outlines the four key competencies interviewers evaluate, practical ways to prepare even with limited experience, and why foundational expertise in operating systems, networks, and code remains essential. It also provides salary benchmarks and career advice for entry-level positions in a market where junior SOC roles are being automated.