NIST Internal Report 8621, November 2026, approved October 21, 2026; roadmap coverage November 2, 2026; based on a workshop of more than 400 experts
NIST IR 8621: Incident Response Has to Cover AI Misuse and Malfunction, Not Only Attacks on AI Systems
NIST has published Internal Report 8621, the report of its Workshop on SI Incident Management, using the term SI, for super intelligence, as directed by the September 29, 2026 executive order on terminology. The report draws on a workshop of more than 400 experts from government, frontier model developers, cloud and security providers, academia, standards bodies, and civil society, and NIST presents it as a foundation for future guidance rather than a finished replacement for its response publications. Its central framing splits the problem in two: cybersecurity attacks that target AI systems, and incidents that stem from AI misuse, anomalous behavior, or severe malfunction resulting in harm. The abstract is direct about why the split matters: traditional deterministic incident response life cycles are limited when applied to probabilistic, autonomous, deeply integrated systems that operate at machine speed. The operational needs the workshop surfaced include reasoning-layer telemetry, non-human identity governance, authorization-scoped containment, clear evidentiary and reporting schemas, and coordinated responsibility across distributed AI value chains. Coverage of the roadmap describes the follow-on work NIST is considering: an update path for SP 800-61, its core incident response publication, with AI-specific material divided between attacks on AI systems and a possible companion part on misuse and malfunction; a separate voluntary document on incidents in which capable agents act outside their intended task during training and evaluation; work on logging that could inform SP 800-92; and standing community structures, including a task group on long-running agents and an incident management community of interest. NIST sets no deadlines for any of it, and says the scope will evolve with stakeholder feedback.
Executives
The practical shift in this report is definitional: an AI incident is no longer only a breach. A system that is technically secure and still produces harmful output, takes an unintended action, or is misused by an authorized user now sits inside the incident management frame that NIST is building. That has governance consequences today, before any final guidance lands: incident severity definitions, escalation paths, and board reporting that only recognize intrusions will miss the class of event regulators are organizing around.
CIO / CISO
Use the two-domain split as a design review for your own program. Map current playbooks against attacks on AI systems, such as poisoning, prompt injection, model theft, and compromised agents, and separately against incidents caused by AI systems, such as unsafe outputs and out-of-scope agent actions. Then check the evidence position the workshop names: whether you retain reasoning-layer telemetry, prompts, outputs, and tool calls in a form an investigation can use, and whether containment for an agent is scoped by its authorizations so it can be revoked without taking down the surrounding platform.
Engineers
Build for the telemetry list now, because retrofitting it during an incident is not possible: model and agent identity on every action, authorization scope attached to containment controls, and logs that reconstruct what the system perceived, decided, and did, stored where the agent cannot alter them. Rehearse the malfunction case, not only the intrusion case: a tabletop in which the AI system itself is the hazard, with a tested way to halt it, is the exercise this report is pointing at.
Everyone (non-IT)
If your workplace is rolling out AI assistants or agents, it is reasonable to ask a simple question: if this tool did something harmful tomorrow without anyone hacking it, whose job is it to respond, and how would anyone know. Organizations that can answer that are ahead of the standard NIST is now writing. Nothing in this report asks anything of you personally.