US AI Agent Security Bill

Overview

The Stop Rogue AI Act is a United States federal bill addressing security and visibility problems associated with AI agents operating within organizational networks. Its legislative identifier is H.R. 10362 in the 119th Congress, second session. The official long title is: To provide for certain artificial intelligence agent discovery and security standards, and for other purposes. The GovInfo legislative record identifies an Introduced in House version dated September 14, 2026. Josh Gottheimer is the sponsor, and Michael Lawler is the cosponsor.

The proposal would direct the National Institute of Standards and Technology, or NIST, to develop standards, guidelines, and best practices for discovering, verifying, and controlling AI agents. Its central objective is to help organizations identify agents on their systems, establish who built and operates them, observe their behavior, and control their authority. Federal agencies and contractors form part of the proposed adoption pathway. The instrument is a bill under legislative review; its proposed safeguards are described as prospective measures rather than current obligations under an enacted law.

Technical Concepts

The proposal addresses AI-enabled agents operating within organizational systems and undertaking actions or interactions. The operational settings described in the sponsors' announcements include agents activated by employees, embedded in third-party software, or deployed by vendors. These deployment routes matter because an organization may need to discover agents introduced through several different channels rather than relying on a single purchasing or installation process. The concepts in this section explain the proposal's security approach without assigning a statutory definition to every automated tool or software assistant.

A continuous agent inventory is an ongoing record used to identify and track agents on organizational systems. Verifiable identity and provenance concern information and verification mechanisms that establish who built and operates an agent. Runtime monitoring observes agent behavior during operation. Revocable authorization allows an organization to withdraw permission for access, actions, or interactions. These concepts perform different functions: discovery establishes presence, identity and provenance support attribution, monitoring evaluates conduct, and authorization determines what an agent may do.

Governance and Institutional Framework

NIST is the principal standards-development institution identified for the proposal. Its contemplated work covers national standards, guidelines, and best practices for AI agent discovery and security. The institutional approach centers on technical safeguards that organizations can use to maintain visibility and control over agents. The official Gottheimer announcement also identifies the Cybersecurity and Infrastructure Security Agency, or CISA, as a partner in incorporating the standards into existing federal cybersecurity guidance.

Congressional consideration involves the House Committee on Science, Space, and Technology and the House Committee on Oversight and Government Reform. H.R. 10362 was referred to both committees on September 14, 2026, for consideration of provisions within their respective jurisdictions. Committee referral is a legislative-review milestone, distinct from implementation by executive agencies. The governance structure therefore has two separate dimensions: congressional review of the proposed instrument and the proposed assignment of standards-development and cybersecurity-guidance responsibilities to NIST and CISA.

Agent Discovery and Verified Identity

The proposal's first operational priority is visibility into agent activity. The sponsors describe guidance for finding and tracking every AI agent operating on organizational systems through a continuous, easily readable inventory. The emphasis on continuity distinguishes an ongoing discovery capability from a one-time list assembled when a system is purchased or installed. An agent inventory would help an organization understand what agents are present and provide a foundation for connecting each agent to its operator, permissions, and observed activity.

Discovery is paired with verifiable identity and provenance. The stated objective is to establish who built and operates an agent rather than relying solely on a vendor's assertion. This connects technical visibility with accountability: knowing that an agent exists is different from knowing which developer, vendor, or operator is responsible for it. Together, inventory and verified attribution address an operational blind spot created when agents enter networks through employee activity, third-party software, or vendor deployments without adequate organizational visibility.

Runtime Monitoring and Security

The proposal also emphasizes real-time monitoring of agents while they operate. The sponsors identify prompt injection, data theft, and behavior outside approved limits as detection objectives. Runtime monitoring complements discovery by addressing conduct rather than presence alone. An organization may know that an agent is operating on its systems while still needing to observe whether that agent is handling information appropriately, responding to malicious instructions, or taking actions beyond its approved authority.

The security approach links an agent's identity, permissions, and behavior. An inventory can identify the agent involved in an event; provenance can associate that agent with its builder and operator; monitoring can reveal conduct that requires intervention. The proposal's emphasis is on maintaining cybersecurity and accountable operation throughout agent activity. Its principal focus is agent security within organizational systems, including visibility into interactions and delegated authority, rather than a general classification of every AI model or application.

Authorization and Human Control

The sponsors describe safeguards that would let organizations allow, deny, or revoke agent access, actions, and interactions at any time. This makes authorization an ongoing control rather than a permission granted only at initial deployment. The ability to withdraw authority is particularly relevant when monitoring identifies prompt injection, potential data theft, or behavior beyond approved limits. Revocation connects detection to an operational response by allowing an organization to stop or constrain the relevant agent activity.

The proposal's human-control objective concerns the organization's ability to determine what authority an agent receives and to change that authority during operation. Access control, action control, and interaction control address related but distinct aspects of agent behavior. A useful readiness assessment can examine whether revocation reaches connected systems and whether permissions remain consistent with approved responsibilities. Technical denial or revocation of an agent's access is an organizational security measure, distinct from a governmental penalty or an adjudicated liability determination.

Federal Implementation and Procurement

The proposed implementation pathway begins with NIST developing standards, guidelines, and best practices. Federal adoption would connect those safeguards to how agencies and contractors purchase and deploy AI agents. The official Lawler announcement describes requirements for federal contractors and agencies to build the safeguards into their purchasing and deployment practices. Procurement and deployment are therefore important routes for translating the proposed technical standards into operational expectations within the federal environment.

Organizational readiness work can include identifying agent-bearing systems, mapping responsible operators, reviewing permissions, and assessing whether authority can be revoked promptly. These activities follow the proposal's stated security objectives and should be distinguished from a presently binding duty under the bill. Federal agencies and contractors are central to the described adoption pathway. The proposed standards-development role also connects to NIST–CISA coordination so that agent-security safeguards can be incorporated into existing federal cybersecurity guidance rather than treated solely as isolated purchasing considerations.

Relationship to Existing Instruments

The GovInfo record lists references to 15 U.S.C. 9401 and 44 U.S.C. 3502. Those United States Code references form part of the bill's recorded statutory context. The proposal also connects agent-security standards to existing federal cybersecurity guidance through NIST and CISA. This integration approach places AI agent discovery, identity, monitoring, and control alongside established organizational cybersecurity practices. The legislative record and the sponsors' announcements serve different functions: the former identifies the bill and its formal legislative milestones, while the latter describes its intended safeguards and adoption approach.

Agent-security measures operate alongside cybersecurity, privacy, contracting, and sector-specific responsibilities that organizations may already have. Inventory, identity verification, monitoring, and access control are relevant to several of those operational areas. The proposal's distinctive contribution is to apply these concerns directly to agents that can act or interact within organizational systems. For implementation planning, organizations can distinguish the proposed federal agent-security framework from separately applicable legal and contractual requirements while considering how the safeguards could be integrated into existing controls.

Interoperability and Organizational Readiness

The Stop Rogue AI Act is a domestic United States proposal, with a described implementation pathway involving federal standards, agencies, contractors, and cybersecurity guidance. The Gottheimer announcement includes stakeholder support for open and interoperable agent-security standards and for vendor-agnostic discovery approaches. These statements express stakeholder preferences rather than the operative content of a statutory requirement. Interoperability is operationally relevant because agents may arrive through different vendors, software products, and deployment channels within the same organization.

A readiness assessment can examine whether existing tools provide a coherent view of agents across those channels. It can also evaluate whether identity information is linked to permissions and observed activity, whether newly introduced agents become visible to administrators, and whether revocation works across connected systems. These are planning suggestions derived from the proposal's stated objectives, not statutory testing or certification requirements. Organizations operating across borders should distinguish prospective United States federal contracting conditions from independently applicable foreign legal obligations.

Legislative Timeline

The formal introduction date is September 14, 2026. The sponsors' announcement dates are publication milestones, distinct from legislative introduction and committee referral.

Readiness Checklist

Sources and References