NIST opens consultation on adversarial machine-learning taxonomy focused on agentic systems

NIST’s draft adversarial-machine-learning taxonomy focuses on agentic systems. Comments close December 18, 2026, with no implementation deadline specified.

Source published: 2026-11-09

Audience / jurisdiction: United States technical publication; relevant to practitioners designing, deploying, evaluating and governing agentic systems, including international readers.

What NIST has published

NIST has opened a consultation on an updated adversarial-machine-learning taxonomy, with a focus on attacks against agentic systems and corresponding mitigations. Published on November 9, 2026, SP 2400-102 E2026, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, is an initial public draft. Comments are due December 18, 2026.

The development gives AI security and assurance teams a proposed vocabulary to examine, rather than a new set of mandatory controls to implement. For organizations designing or deploying agentic systems, the immediate opportunity is to compare how they describe threats, document assumptions and discuss mitigation options.

Sources: [2], [1]

A common language for attacks and mitigations

The publication record says the draft builds on the historical NIST AI 100-2 series and introduces an agentic-system attack taxonomy index. Its emphasis is on organizing attacks and associated mitigations. It should not be described as a finalized replacement for the earlier series.

NIST’s announcement describes a classification organized around machine-learning methods, stages in the attack life cycle, and attackers’ goals, capabilities and knowledge. The intended value is a shared language that can inform later standards and practice guides. That purpose is different from establishing a certification scheme or prescribing an organization’s complete security-control framework.

For practitioners, the distinction matters: a taxonomy can help teams describe the same problem consistently, but reviewing terminology is not the same as demonstrating that a mitigation works.

Sources: [2], [1]

Who should consider reviewing it

NIST identifies the intended audience as people responsible for designing, developing, deploying, evaluating and governing these systems. Within an organization, that makes the consultation relevant to developers, AI security leads, risk owners and assurance teams reviewing agentic deployments.

As an editorial suggestion, those functions could review the draft together rather than assigning it only to a technical specialist. A developer may recognize an attack scenario, while an evaluator may identify a gap in testing and a risk owner may need a clearer explanation of the remaining uncertainty. A joint review can focus feedback on practical differences in interpretation rather than simply adopting new labels.

Sources: [1]

Publication status, dates and limits

The issuer is NIST, a United States federal technical publisher. This item is a draft technical publication, not an ISO standard. November 9, 2026 is its publication date; December 18, 2026 is the deadline for consultation comments. Neither date should be presented as a legal compliance deadline.

The consulted pages specify no implementation effective date or transition period. They do not establish a new US, UAE or EU legal duty. The confirmed development is the availability of an initial public draft for review, with its terminology and coverage still subject to consultation.

The announcement and publication record support the broad scope and status reported here. They do not support conclusions about detailed attack categories, the effectiveness of individual mitigations or section-level requirements without reviewing the full draft.

Sources: [2], [1]

Practical next steps before the comment deadline

A proportionate next step is to assign an AI-security owner to coordinate a focused review against the organization’s actual agentic use cases. The following are editorial suggestions, not NIST requirements: compare existing threat-model terminology with the proposed taxonomy, record unclear mappings and identify scenarios that deserve closer testing.

Teams could keep a short comparison record showing the internal term, the proposed NIST term, any difference in meaning and the consequence for a threat model or test plan. Avoid automatically rewriting controls merely to match draft terminology; first establish whether the difference changes the security analysis.

NIST specifically requests input on emerging attacks, effective mitigations and terminology needing standardization. Organizations considering a submission can use their review to identify concrete examples and explain where the proposed vocabulary helps or leaves ambiguity. Planning that work around the December 18 comment deadline keeps the response tied to the consultation rather than an assumed implementation obligation.

Sources: [2]

Sources

1. Adversarial Machine Learning Taxonomy and Terminology — Draft NIST SP 2400-102e2026
2. SP 2400-102 E2026, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations

Your experience

Which agentic-system attack scenario should your organization test first, and who owns the evidence that its mitigation works?

Related reading

• NIST releases privacy-preserving machine-learning testbed and genomic benchmark
• Building an AI inventory: record the use, assign an owner and keep it current
• NIST proposes design tenets for managing AI-agent identities and access

About the author

AdviseISO Editorial Team

The AdviseISO editorial team prepares practical, source-based guidance on standards, auditing and compliance.