Government cyber guidance on AI now covers three separate jobs: protecting AI systems themselves, using AI in defense, and resisting attacks that use AI. As of October 24, 2026, none of the main documents is a statute; they are voluntary guidance from agencies such as the US Cybersecurity and Infrastructure Security Agency (CISA), the National Institute of Standards and Technology (NIST), and Canada's Cyber Security Centre, with the newest joint guide on AI agents dated May 1, 2026.
Key takeaways
- NIST's draft Cyber AI Profile, released December 16, 2025, groups the field into securing AI systems, AI-enabled defense, and thwarting AI-enabled attacks.
- The May 1, 2026 joint guide on agentic AI advises starting with low-risk, non-sensitive tasks and never granting broad or unrestricted access.
- CISA, the NSA, and the FBI issued separate guidance on May 22, 2025 about the data used to train and operate AI.
- Canada's 2025-2026 threat assessment says criminals use AI for convincing phishing and deepfakes, and that AI labs are likely more prominent targets.
Three jobs that get mixed together
Claims that AI strengthens security usually refer to only one of these jobs. NIST's preliminary draft of the Cyber AI Profile (NIST IR 8596) separates them. The first is securing AI system components when they are built into an organization's infrastructure. The second is conducting AI-enabled cyber defense, meaning the use of AI inside security operations, together with the new problems that creates. The third is thwarting AI-enabled attacks. The profile maps these areas onto the NIST Cybersecurity Framework 2.0 and links to the AI Risk Management Framework.
The draft was released on December 16, 2025, and its comment period closed on January 30, 2026. NIST's page still lists that version as the initial preliminary draft and says an initial public draft will follow, so it should be treated as unfinished.
What the joint guidance says, in order of publication
| Document | Date | Issuers | Main subject |
|---|---|---|---|
| Guidelines for secure AI system development | November 26, 2023 | CISA, UK NCSC, and 21 other agencies and ministries | Design, development, deployment, and operation of AI systems |
| NIST AI 100-2 E2025, adversarial machine learning taxonomy | March 24, 2025 | NIST | Evasion, poisoning, privacy, and misuse attacks |
| AI Data Security information sheet | May 22, 2025 | NSA, CISA, FBI, and international partners | Protecting data used to train and run AI |
| Principles for secure AI in operational technology | December 3, 2025 | CISA, Australia's ACSC, and partners including Canada's Cyber Centre | AI in industrial and infrastructure settings |
| Careful Adoption of Agentic AI Services | May 1, 2026 | CISA, NSA, and the cyber agencies of Australia, Canada, New Zealand, and the UK | LLM-based agents that take actions |
The NIST taxonomy treats predictive AI and generative AI differently: predictive systems face evasion, poisoning, and privacy attacks, while generative systems add misuse attacks. The operational technology guide lists four principles: understand AI, assess its use in operational technology, establish governance, and embed safety and security.
Agent guidance: the most specific and the newest
The Cyber Security Centre's page on careful adoption of agentic AI shows a modification date of September 10, 2026 and does not state an original publication date, while CISA's announcement is dated May 1, 2026. The guide recommends aligning agent risks with an organization's existing security model, using agents only for low-risk, non-sensitive tasks at first, and considering non-AI options for repetitive work. It names risks such as prompt injection, including injection hidden in emails or web results, over-privileged agents, unvetted third-party components, and logs too voluminous to review.
The page uses recommendation language and does not present the guide as binding. It also points readers to outside frameworks that carry their own status, so legal duties have to be checked separately.
A control checklist drawn from the agent guide
- Give each agent its own identity and the least privilege it needs, with short-lived credentials instead of long-lived secrets.
- Restrict tool use to an approved list of tools and versions, and block agents from changing their own privileges.
- Require human approval for high-impact or hard-to-reverse actions, such as deleting critical records.
- Log tool calls and privilege changes, and deny agents write access to their own logs.
- Deploy in phases, with rollback to a known-good version when failures occur.
Threat side: what Canada's assessment records
The Cyber Centre released its National Cyber Threat Assessment 2025-2026 on October 30, 2024, using information available as of September 20, 2024. It states that cybercriminals and state-sponsored actors use generative and predictive AI, that AI makes personalized phishing and deepfake audio and video easier to produce, and that organizations building AI models are likely more prominent targets. It does not go into detail on attacks against AI models themselves; the NIST taxonomy fills that gap.
This article is general information, not legal or professional security advice. Guidance documents change quickly and do not replace sector rules, contracts, or privacy law, so organizations with a specific deployment should consult a qualified security professional and read the originals, such as NIST's Cyber AI Profile page.
FAQ
Is any of this guidance legally required?
The documents above are voluntary guidance. Separate laws, sector rules, or contract terms may still impose security duties, and those vary by organization.
Does AI reduce cyber risk or add to it?
Both appear in the sources. NIST lists AI-enabled defense as a focus area, while the Canadian assessment records criminal use of AI for phishing and deepfakes. Net effect depends on the deployment, and the guidance does not claim a single answer.
What is prompt injection?
It is an attack in which instructions are hidden in content that an AI model reads, such as an email or a web result, so the model acts on them. The agent guide names it as a risk inherited from large language models.
Which document suits a small organization best?
The agent guide's early advice is short enough to act on: limit access, start with low-risk tasks, and keep a person approving consequential actions. The longer NIST drafts are aimed at structured risk programs.
Related reading
- AI in cyber defense
- the contest between attackers and defenders
- Canadian AI law and policy
- AI and workplace safety
More in AI Policy and Ethics.
Last verified: October 2026
Sources
- Careful adoption of agentic AI, Canadian Centre for Cyber Security, page modified September 10, 2026
- CISA, US and International Partners Release Guide to Secure Adoption of Agentic AI, CISA, May 1, 2026
- Draft NIST Guidelines Rethink Cybersecurity for the AI Era, NIST, December 16, 2025
- NIST IR 8596, Cyber AI Profile initial preliminary draft, NIST Computer Security Resource Center, 2025
- NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, NIST, March 24, 2025
- New Best Practices Guide for Securing AI Data Released, CISA, May 22, 2025
- New Joint Guide Advances Secure Integration of Artificial Intelligence in Operational Technology, CISA, December 3, 2025
- DHS CISA and UK NCSC Release Joint Guidelines for Secure AI System Development, CISA, November 26, 2023
- National Cyber Threat Assessment 2025-2026, Canadian Centre for Cyber Security, October 30, 2024