What happened
NIST’s Super Intelligence program published the initial public draft of SP 2400-102e2026, titled “Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations.” NIST says the draft provides a taxonomy of concepts and defines terminology in adversarial machine learning, focusing on attacks on agentic SI systems and corresponding mitigations. The agency released it on November 9, 2026, and is accepting comments through December 18, 2026.
The taxonomy is arranged as a conceptual hierarchy. NIST says it covers key types of machine-learning methods, stages in the attack life cycle, and attacker goals, objectives, capabilities, and knowledge. The report includes an SI Attacks Taxonomy Index and a new Agentic SI Attacks Taxonomy index to support navigation and fine-grained references. That structure is intended to make the material easier to navigate and cite, rather than to prescribe a particular product architecture.
NIST says the draft draws on an extensive literature review, discussions with adversarial machine-learning experts, and research by NIST’s own experts. It describes challenges across the life cycle of SI systems and corresponding methods for mitigating and managing the consequences of attacks. The terminology is presented as consistent with the adversarial machine-learning literature and is supplemented by a glossary of terms associated with SI-system security.
The agency describes the intended audience as people and groups responsible for designing, developing, deploying, evaluating, and governing SI systems. It says the taxonomy and terminology are meant to inform other standards and future practice guides for assessing and managing security. NIST invites feedback during the open comment period and directs questions and comments to SP-2400-102@nist.gov. The announcement does not describe a software release, certification, or binding requirement.
What the archive adds
New Runtime’s earlier coverage has followed adjacent security taxonomies: CrowdStrike’s taxonomy of 222 prompt-injection techniques (October 31, 2026) and proposed NIST-directed work on AI distillation-attack standards (November 4, 2026). This is a new draft and a new fact on the broader security thread: NIST is now inviting public comment on a taxonomy focused on agentic systems.
Trend signal
This supports the broader security concern captured by agent security moving to runtime boundaries: agent security needs to account for system behavior and attack surfaces, not just prompt wording. The draft is a taxonomy, however, not evidence that runtime controls have been adopted or validated in deployed systems.
Why now
NIST says the document is intended to establish common language in a rapidly developing adversarial machine-learning landscape and to inform future standards and practice guides. The comment window runs through December 18, 2026, giving practitioners a defined opportunity to influence the draft before that process closes.
Why it matters
A shared vocabulary can make threat modeling more actionable across teams that build, evaluate, deploy, and govern agents. If security reviews use inconsistent names for attacks, it is harder to compare controls, assign ownership, or communicate gaps between product and risk teams. NIST’s hierarchical framing may help teams organize those conversations around attack stages, attacker capabilities, and objectives, while its indexes could make specific concepts easier to reference.
The practical value is still contingent on how the taxonomy is used. It does not itself block attacks, prove a mitigation works, or tell a team which controls are sufficient for its system. Builders should treat it as a framework to test against their own architecture and threat model, not as a substitute for red-teaming, implementation controls, or operational monitoring. The public comment period is the immediate opportunity to flag omissions or ambiguities from real deployment experience.
Limits and uncertainty
NIST’s announcement does not quantify attack prevalence, mitigation effectiveness, or the cost of applying the proposed taxonomy. It does not establish that the draft has been independently evaluated as a complete account of agent threats, nor does it describe a certification or compliance regime. The draft is explicitly open for comment, so its terminology and coverage may change. Teams will need to consult the document itself and assess how well its categories map to their own systems and threat models.
Skill to build now
Use the draft’s categories to run a short threat-model review of one agent workflow this week. For each step, record the relevant attacker goal, capability, and attack stage, then note which existing control addresses it and what evidence you have that the control works. Where a category is unclear or a real attack path does not fit, turn that gap into a precise comment to NIST before December 18.
Reader takeaway
NIST’s draft does not ship a security control; it proposes shared terms and an organized way to discuss attacks on agentic systems. For builders, the immediate value is to test whether that framework exposes gaps in threat models—and, while comments remain open, to tell NIST where its categories need refinement.