What the Draft Changes

On November 9, 2026, the National Institute of Standards and Technology (NIST) released Special Publication 2400-102 E2026 as an initial public draft, with comments due December 18. NIST says it builds on the AI 100-2 series; AI 100-2 E2025 remains listed as final, with no withdrawal notice.

The draft does not list its changes from the 2025 edition, so this comparison is our own. The 2025 edition gave agents two paragraphs (page 54). The draft PDF gives them Section 4 (pages 58 to 71), with a reference architecture, an attack taxonomy, and seven new index identifiers, NISTAML.061 to NISTAML.067, covering agent hijacking, memory poisoning, malicious tools, skills and agents, resource exhaustion, and decomposition attacks (pages xi and xii).

Reading the Threat Boundaries

The taxonomy covers adversarial attacks only. Unintended behavior, such as models reaching the internet from test environments, is "outside the scope of the taxonomy" (page 58). The multi-agent section sets aside collusion and miscoordination arising without an adversary (page 69). For auditors, the draft maps threats to task instructions, planning, execution, and observation (pages 60 and 61). It notes that a malicious tool's description enters the agent's context even if the tool is never invoked (page 68), and that agent guardrails "must also be evaluated against attackers who tailor their attacks to the defense" (page 65).

Limits

The draft calls itself voluntary, without the force of law (page viii), and makes no recommendation on risk tolerance (page xiii). It is neither a final standard nor a certification scheme, and it may change after comments.