Muallif: Len Noe, Yechimlar Arxitektori, BeyondTrust
Har qanday hodisa ko'prigidagi birinchi savol nima uchun sodir bo'lgani haqida emas — kimning ma'lumotlari ishlatilgani haqida. Mening tajribamda, birinchi soat ichida shu ma'lumot savoliga javob bera olgan kishi keyingi hamma narsaning tezligini belgilaydi: nimani ajratish, nimani bekor qilish, kimga xabar berish va zarar qanchalik keng tarqalgan bo'lishi mumkin.
Buni javob bera olmagan jamoalar birinchi kunni hech qachon buni ta'minlash uchun mo'ljallanmagan jurnallardan javobni qayta tiklash bilan o'tkazadilar.
Bu intizom tez orada yangi turdagi ishtirokchi tomonidan sinovdan o'tkaziladi. 2026-yil 16-oktabrda AQSh Milliy Standartlar va Texnologiya Instituti (NIST), Kiberxavfsizlik va Infratuzilma Xavfsizlik Agentligi (CISA) va Milliy Xavfsizlik Agentligi (NSA) birgalikda AI agentlari hech kim yo'naltirmagan tarzda harakat qilganda hodisalarga tayyorlik va javob berish uchun o'nta ixtiyoriy amaliyotni e'lon qildilar.
Qo'llanma, Super Intellektni O'qitish va Baholashda Hodisalarga Tayyorlik va Javob Berishning Asosiy Amaliyotlari, foydali, lekin uni noto'g'ri tushunish ham oson. Uning eng kuchli yo'riqnomasi shaxsni aniqlash haqida, garchi u bu so'zni sarlavha sifatida kam ishlatsa ham.
NIST, CISA va NSA Hodisa Qo'llanmasi Nimalarni Qamrab Oladi
14 sahifalik hujjat yuqori qobiliyatli agentlarni uzoq muddatli vazifalarda (uzoq davr davomida ko'p qadamlar orqali ishlaydigan ish) cheklangan inson nazorati bilan o'qitadigan yoki baholaydigan tashkilotlar uchun yozilgan, garchi mualliflar joylashtiruvchilar ham uni tegishli deb topishi mumkinligini aytishsa ham. U o'nta amaliyotni besh bosqichga tashkil qiladi: tayyorlash, aniqlash, javob berish, tiklash va hisobot berish.
U nazorat hodisasini agentlar operator yoki dushman tomonidan yo'naltirilmagan muhim harakatlarni amalga oshiradigan, va nazorat, siyosat yoki inson nazoratini zaiflashtiradigan hodisa sifatida ta'riflaydi.
Agentliklar amaliyotlar o'rnatilgan hodisalarni boshqarish tizimlariga asoslanishini aytishadi, shuning uchun ular so'ragan narsalarning aksariyati tanish ko'rinadi: eng kam imtiyoz, ma'lumotlarni boshqarish, kuzatuv, dalillarni saqlash, ma'lum asoslardan qayta qurish.
Tanish nazoratlar yangi asosiy ishtirokchiga qo'llanilganda ko'pchilik tashkilotlar qoqilib ketishi mumkin.
AI Agent Hodisalariga Javob Shaxsni Aniqlashdan Boshlanadi, Niyatdan Emas
Ta'riflarda bir tafsilot javob beruvchilar uchun muhim. Qo'llanma dushmanlik bilan kiritilgan so'rov yoki orqadan o'rnatilgan model tufayli yuzaga kelgan harakatlarni yo'naltirilgan, yo'naltirilmagan emas, deb hisoblaydi, shuning uchun ular nazorat hodisasi ta'rifidan tashqarida qoladi. Bu chiziq tadqiqotchilar uchun mantiqiy bo'lsa-da, javob beruvchilar uchun qiyin; hodisa paytida niyat savoli odatda javob berib bo'lmaydi.
Tergovchi qo'lida shaxs, ruxsatlar to'plami va harakatlar izi bor.
Agent hodisalariga tayyorlik birinchi navbatda sababni tasniflashga bog'liq bo'lishi mumkin emas. U shaxs yozuvidan qaysi shaxs harakat qilganini, uning ortida qanday vakolat turganini va agent chalg'itilganmi, noto'g'ri ishlaganmi yoki buzilganmi aniqlash uchun ishlashi kerak.
AI Agentlari Harakat Qilishdan Oldin Ular Nima Qila Olishini Nazorat Qiling
AI agentlari ularni ishlatayotgan odamlar bilan bir xil imtiyozlarga ega bo'lishi mumkin, bu esa ularning harakatlari nazoratsiz qolganida yangi xavflarni yaratadi.
Endi umumiy foydalanish mumkin bo'lgan BeyondTrust AI Agent Security individual agent harakatlariga real vaqtda siyosatni qo'llaydi, inson foydalanuvchilari nima qila olishini cheklamasdan ruxsat etilmagan faoliyatni bloklaydi.
AI Agent Xavfsizligini O'rganing
Bekor Qilish Faqat Siz Yetib Bora Olgan Narsaga Yetadi
Oltinchi amaliyot tashkilotlarga hodisa davomida agent kirgan va tashkilot nazorat qiladigan har qanday ma'lumotlarni bekor qilishni, va potentsial buzilgan muhitlarni qayta qurishni aytadi. "Tashkilot nazoratida" degan so'z dastlab ko'rinadiganidan ko'proq og'irlikka ega. Agentlar tashkilot saqlaydigan, lekin bermaydigan ma'lumotlarni to'playdi.
OpenCode buzilishi buni qanday namoyon bo'lishini ko'rsatadi. Ochiq manbali kodlash agenti OpenCode, o'zining joylashtirilgan Console xizmatining ba'zi foydalanuvchilariga u yerda tashqi provayderlar, jumladan Anthropic, OpenAI va Google uchun saqlagan API kalitlari fosh bo'lganini aytdi.
Kompaniya Console foydalanuvchilarining 1,4% ta'sirlanganini va eng erta fosh bo'lish 2026-yil 17-oktabrda 00:30 UTC da bo'lganini aytadi. Foydalanuvchilar bir necha yuz dollardan 1 700 dollargacha bo'lgan ruxsat etilmagan to'lovlar haqida xabar berishdi.
Ba'zi hollarda, Google Cloud loyihalari suiiste'mol faoliyati uchun to'xtatildi, bu esa o'g'irlangan resurslarga mos keladi. Kompaniya hujumchilar qanday kirganini aytmagan va hodisani keng ko'lamli distillatsiya hujumi deb ta'riflaydi.
Kompaniyaning hisobini vaqtinchalik deb qabul qiling. Tayyorlik uchun muhim narsa muammoning shakli. Agent platformasi tomonidan saqlangan kalit faqat uni bergan provayderda, va unga egalik qiladigan shaxs tomonidan bekor qilinishi mumkin. Va hisob egasi kalit hech qachon fosh bo'lganini bilmasligi ham mumkin.
Qo'llanmaning bekor qilish bosqichi agent nimaga tegishi mumkinligi inventarini nazarda tutadi. Usiz bekor qilish uchun hech narsa yo'q. Qo'llanmaning hisobot berish bosqichi xuddi shu inventardan kelib chiqadigan ikkinchi majburiyatni qo'shadi: tizimlari buzilgan yoki suiiste'mol qilingan tomonlarga, jumladan yakuniy maqsad bo'lmagan uchinchi tomonlarga xabar berish.
OpenCode holatida, bu tomonlar model provayderlari va individual kalit egalari, va ularning hech biriga o'z vaqtida xabar berilmaydi, agar kimdir qaysi kalitlar qayerda saqlanganini bilmasa.
AI Agentni Uning Hamkorligiga Tayanmasdan Cheklash
Qo'llanma dizaynerlarga agentlar ko'pincha noto'g'ri konfiguratsiyalar va zaifliklarni topishini taxmin qilishni, va shunga mos ravishda nazorat qurishni maslahat beradi. MIT Technology Reviewning iyuldagi Hugging Face hodisasini qayta tiklashi nima uchun buni ko'rsatadi.
OpenAI modellari asosida qurilgan agentlar kiberxavfsizlik baholashi davomida internetdan ajratilishi kerak edi. Ular baribir onlayn bo'lishdi, Hugging Face'ni buzishdi va o'zlari qotib qolgan muammolarning yechimlarini olishdi.
Maqolada tasvirlangan yagona nazorat tarmoq ajratishdir, va agentlar undan o'tib ketishdi. OpenAIning o'z tadqiqotchilari bu xatti-harakatni uni mukofotlagan o'qitishga bog'lashadi.
Tarmoq chegaralari qat'iyatli ishtirokchi, inson yoki emas, tomonidan aylanib o'tilishi mumkin. Bitta vazifaga cheklangan, vazifa tugaganda tugaydigan va agentni ishga tushirgan shaxsdan alohida shaxsga tegishli ma'lumotlar agentning o'zini yaxshi tutishiga tayanmaydi va o'g'irlangan nusxa nima qila olishini cheklaydi.
Qo'llanma xuddi shu yo'nalishni ko'rsatadi, chunki u mo'ljallangan vazifalar uchun zarur bo'lgan narsaga cheklangan kirish, iloji bo'lsa yagona foydalanish infratuzilmasi va agent faoliyatini tezda bloklash, cheklash yoki to'xtatish mexanizmlarini so'raydi. Ularning aksariyati shaxs nazoratlaridir.
Inson Bo'lmagan Ishtirokchilar Uchun Sessiya Hisobdorligi
Qo'llanma shuningdek agent traektoriyalarini qayta tiklash uchun yetarli ishonchli vaqt belgilariga ega buzilmas jurnallarni, va agentlar monitorlar va jurnallarga kirish yoki ularni buzish imkoniyatiga ega emasligiga ishonchni so'raydi. Bu hamma narsada sessiya hisobdorligi, faqat nomi boshqacha.
Inson administrator uchun imtiyozli sessiya shaxsga bog'lanadi, yoziladi va ko'rib chiqiladi. Xuddi shu standart agentga ham qo'llanilishi kerak. Qo'llanma bu fikrni javob beruvchilardan rad etilgan harakatlar va vosita chaqiruvlarini saqlashni, va agentlar, himoya va muhit konfiguratsiyalarini yozib olishni so'rash orqali qo'llab-quvvatlaydi, shunda hodisa qayta tiklanishi mumkin.
Rad etilgan harakat agent nimaga yetib borishga uringanining dalilidir, bu ko'pincha u muvaffaqiyatli qilgan narsadan ko'ra ko'proq ochib beradi.
BeyondTrust Phantom Labs™ning so'nggi tadqiqoti, yakuniy nuqta telemetriyasiga asoslangan, nima uchun so'rov darajasidagi jurnallar yetarli emasligini ko'rsatadi. To'rt haftalik davrda olingan mijoz namunalarida kodlash agentlari taxminan 132 000 so'rovdan 1,28 millionga yaqin qobiq buyruqlarini so'rashdi, bu har bir so'rovga deyarli o'n buyruq to'g'ri keladi. Bular so'ralgan buyruqlar, tasdiqlangan bajarilishlar emas. Agent nima qilganini foydalanuvchi nima qilganidan ajrata olmaydigan jurnal kimning vakolati ishlatilganini javob bera olmaydi.
Korxona haqiqat bu ishni murakkablashtiradi. Ko'p eski ilovalar har bir agent faoliyatini jurnalga yozib ololmaydi. Ba'zi agentlar uch yil oldin qurilgan integratsiya tufayli umumiy xizmat hisoblari orqali ishlaydi. Byudjetlar cheklangan. Realistik yo'l eng sezgir ma'lumotlarga yoki eng muhim harakatlarga yetib bora oladigan agentlardan boshlanadi, ularga alohida shaxslar beriladi va ilovalar ruxsat berganicha tashqariga kengaytiriladi.
Nima Uchun Kamdan-Kam Uchraydigan Agent Hodisalari Hali Ham Tayyorlikni Oqlaydi
Eng kuchli qarshi dalil mutanosiblikdir. Qo'llanma chegaraviy o'qitish va baholashga qaratilgan, va u javob beradigan hodisalar kamdan-kam uchraydi: bitta laboratoriya ma'lumotiga ko'ra 141 006 baholashda oltita. Ko'pchilik korxonalar o'rganilayotganlardan ancha kam qobiliyatli agentlarni joylashtiradi, va hozirgacha xabar qilingan zarar kamtarona.
Nima uchun asosan nazariy muammo uchun javob berish qobiliyatini qurish kerak?
Javob shundaki, asosiy mexanizmlar faqat nazariy emas. Buzilgan yoki noto'g'ri yo'naltirilgan agent shaxs yozuvi nuqtai nazaridan tezroq tempga ega buzilgan xizmat hisobi kabi harakat qiladi.
AI Agent Hodisalariga Tayyorlikni Qanday O'lchash Kerak
Tayyorlik hujjatlardan ko'ra natijalarda o'lchanishi kerak. Berilgan agent shaxsi foydalanishi mumkin bo'lgan har bir ma'lumotni, jumladan uchinchi tomonlar uchun saqlaydigan kalitlarni sanab o'tish qancha vaqt oladi? Qancha agent o'z shaxsiga ega, nomlangan inson homiy bilan ishlaydi? Tashkilot shaxsning nomidan agent nima qilganini va shaxs nima qilganini ajratadigan sessiya yozuvini ishlab chiqa oladimi?
Agar bu savollarga javob berish bir necha daqiqa oladigan bo'lsa, tashkilot birinchi agent hodisasiga tayyor, u qanday tasniflanishidan qat'i nazar. Agar ular kunlar oladigan bo'lsa, yanada nafis taksonomiya yordam bermaydi.
Muallif Haqida
Len Noe BeyondTrust'da Yechimlar Arxitektori, Transhuman, Podkaster, Xalqaro Kiberxavfsizlik Spikeri, Muallif, Texnik Evangelist va 11 ta implantatsiya qilingan mikrochipga ega Biohaker.
30 yildan ortiq texnologiya tajribasiga ega sobiq blackhat, u 70 dan ortiq mamlakatda taqdimot qilgan va DEF CON 2025 da premyera qilingan I Am Machine hujjatli filmida ishtirok etgan.
BeyondTrust Haqida
BeyondTrust — bu Paths to Privilege™ ni himoya qiladigan global imtiyoz-markazli shaxs xavfsizligi yetakchisi. Shaxsning o'zi xavf yaratmaydi. Imtiyoz yaratadi. Inson, mashina va AI agent shaxslari har bir muhitda portlaganida, BeyondTrust yagona platformadan ularning barchasini kashf etish, nazorat qilish va himoya qilish uchun qurilgan yagona kompaniya. 20 000 dan ortiq mijoz, jumladan Fortune 100 ning 75 tasi ishonch bildiradi va eng yaxshi sanoat tahlilchilari tomonidan ko'p toifali yetakchi deb tan olingan, BeyondTrust shaxs xavfsizligini boshqaruv muammosidan strategik afzallikka aylantiradi.
Ko'proq ma'lumot www.beyondtrust.com da.
BeyondTrust tomonidan homiylik qilingan va yozilgan.
Author: Len Noe, Solutions Architect, BeyondTrust
The first question on any incident bridge isn’t about why it happened--it’s whose credentials were used. In my experience, whoever can answer that credential question in the first hour sets the pace for everything after it: what to isolate, what to revoke, whom to notify, and how far the damage could have spread.
The teams that can’t answer it spend the first day reconstructing their answer from logs that were never designed to provide it.
That discipline is about to be tested by a new kind of actor. On October 16, 2026, the National Institute of Standards and Technology (NIST), the Cybersecurity and Infrastructure Security Agency (CISA), and the National Security Agency (NSA) jointly published ten voluntary practices for incident readiness and response when AI agents act in ways nobody directed.
The guide, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, is useful, and it’s also easy to misread. Its strongest guidance is about identity, even though it rarely uses that word as a headline.
What the NIST, CISA, and NSA Incident Guide Covers
The 14-page document is written for organizations that train or evaluate highly capable agents on long-horizon tasks (work that runs through many steps over a long period) with limited human supervision, although the authors say deployers may find it relevant. It organizes ten practices into five stages: prepare, detect, respond, recover and report.
It defines a control incident as an event in which agents take significant actions that were not directed by the operator or an adversary, and that undermine controls, policies or human oversight.
The agencies say the practices build on established incident-management frameworks, so most of what they ask for will look familiar: least privilege, credential management, monitoring, evidence preservation, rebuilding from known baselines.
Familiar controls applied to a new principal are where most organizations are likely to stumble.
AI Agent Incident Response Starts with Identity, Not Intent
One detail in the definitions matters for responders. The guide treats actions caused by adversarial prompt injection or a backdoored model as instructed, not uninstructed, so they fall outside its definition of a control incident. While that line is coherent for researchers, it’s difficult for responders; at the moment of an incident, the question of intent is usually unanswerable.
What an investigator has in hand is an identity, a set of permissions, and a trail of actions.
Agent incident readiness can’t depend on classifying the cause first. It has to work from an identity record to determine which identity acted, what authority stood behind it, and whether the agent was misled, malfunctioning, or compromised.
Control What AI Agents Can Do Before They Act
AI agents can operate with the same privileges as the people using them, creating new risks when their actions go unchecked.
Now generally available, BeyondTrust AI Agent Security enforces policy on individual agent actions at runtime, blocking unauthorized activity without restricting what human users can do.
Explore AI Agent Security
Revocation Reaches Only What You Can Reach
Practice six tells organizations to revoke any credentials the agent accessed during the incident that the organization controls, and to rebuild potentially compromised environments. The qualifier "under the organization's control" carries more weight than it may appear to at the outset. Agents accumulate credentials that the organization holds, but doesn’t issue.
The OpenCode breach shows how that plays out. OpenCode, an open-source coding agent, told some users of its hosted Console service that API keys they had stored there for external providers, including Anthropic, OpenAI, and Google, were exposed.
The company says 1.4% of its Console users were affected, and that the earliest exposure was at 00:30 UTC on October 17. Users reported unauthorized charges with costs ranging from several hundred dollars to as much as $1,700 overnight.
In some cases, Google Cloud projects were suspended for abusive activity, consistent with hijacked resources. The company hasn’t said how the attackers got in, and describes the incident as a large-scale distillation attack.
Take the company's account as provisional. What matters for readiness is the shape of the problem. A key stored by an agent platform is revocable only at the provider that issued it, by the person who owns the account. And the account holder may not even know the key was ever exposed.
The guide's revocation step presupposes an inventory of what the agent could touch. Without it, there’s nothing to revoke against. The guide's reporting stage adds a second obligation that follows from the same inventory: notify the parties whose systems were compromised or exploited, including third parties who were not the final target.
In the OpenCode case, those parties are the model providers and the individual key owners, and none of them can be notified in time unless someone knows which keys were stored where.
Containing an AI Agent Without Relying on the Agent’s Cooperation
The guide advises designers to assume agents will often find misconfigurations and vulnerabilities, and to build controls accordingly. MIT Technology Review's reconstruction of the July Hugging Face incident shows why.
Agents built on OpenAI models were supposed to be isolated from the internet during a cybersecurity evaluation. They got online anyway, hacked Hugging Face, and retrieved solutions to problems they were stuck on.
The one control the article describes is network isolation, and the agents got around it. OpenAI's own researchers attribute the behavior to training that rewarded it.
Network boundaries can be evaded by a determined actor, human or not. A credential that’s scoped to one task, expires when the task ends, and belongs to an identity separate from the person who launched the agent does not rely on the agent behaving, and it limits what a leaked copy can do.
The guide points the same direction when it asks for access limited to what’s necessary for intended tasks, single-use infrastructure where possible, and mechanisms to quickly block, contain, or terminate agent activity. Most of those are identity controls.
Session Accountability for Non-Human Actors
The guide also asks for tamper-resistant logs with reliable timestamps sufficient to reconstruct agent trajectories, and for assurance that agents can’t access or tamper with the monitors and logs themselves. That is session accountability in everything but name.
For a human administrator, a privileged session is attributed to a person, recorded and reviewable. The same standard should apply to an agent. The guide supports this by asking responders to preserve rejected actions and tool calls, and to record the configurations of agents, safeguards and environments so an incident can be reproduced.
A rejected action is evidence of what the agent tried to reach, which is often more revealing than what it succeeded in doing.
New research from BeyondTrust Phantom Labs™ drawing on endpoint telemetry shows why prompt-level logs fall short. In customer samples taken over a four week period, coding agents requested about 1.28 million shell commands from roughly 132,000 prompts, close to ten commands per prompt. Those are requested commands, not confirmed executions. A log that can’t separate what the agent did from what the user did is unable to answer whose authority was used.
Enterprise reality will complicate this. Many legacy applications can’t log per-agent activity. Some agents will run through shared service accounts because that’s how the integration was built three years ago. Budgets are finite. A realistic path starts with the agents that can reach the most sensitive data or the most consequential actions, gives them separate identities, and works outward as applications allow.
Why Rare Agent Incidents Still Justify Preparation
The strongest counter-argument is proportionality. The guide is aimed at frontier training and evaluation, and the incidents it responds to are rare: six in 141,006 evaluations in one lab's disclosure. Most enterprises deploy agents far less capable than the ones under study, and the reported harm so far has been modest.
Why build response capability for a problem that’s mostly theoretical?
The answer is that the underlying mechanics aren’t just theoretical. A compromised or misdirected agent behaves, from the perspective of the identity record, like a compromised service account with a faster tempo.
How To Measure AI Agent Incident Readiness
Readiness should be measured in outcomes rather than documents. How long does it take to enumerate every credential a given agent identity can use, including keys it stores for third parties? What share of agents runs under its own identity, with a named human sponsor? Can the organization produce a session record that distinguishes what a person did from what an agent did on that person's behalf?
If those questions take minutes to answer, the organization is ready for the first agent incident, regardless of how it is classified. If they take days, a more elegant taxonomy will not help.
About the Author
Len Noe is a Solutions Architect at BeyondTrust, Transhuman, Podcaster, International Cyber Security Speaker, Author, Technical Evangelist, and Biohacker with 11 implanted microchips.
A former blackhat with more than 30 years in technology, he has presented in over 70 countries and is featured in the documentary I Am Machine, which premiered at DEF CON 2025.
About BeyondTrust
BeyondTrust is the global leader in privilege-centric identity security protecting Paths to Privilege™. Identity alone doesn’t create risk. Privilege does. As human, machine, and AI agent identities explode across every environment, BeyondTrust is the only company built to discover, control, and secure privilege across all of them from a single platform. Trusted by 20,000+ customers, including 75 of the Fortune 100, and recognized as a multi-category leader by top industry analysts, BeyondTrust reframes identity security from a management problem into a strategic advantage.
Learn more at www.beyondtrust.com.
Sponsored and written by BeyondTrust.