The federal government is advising AI companies to set more industry standards for securing agents in sandbox testing environments.

In joint guidance from the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) at the Department of Commerce, AI companies are encouraged to lean more heavily on cybersecurity technical controls, independent testing and evaluation of new models and develop “shut down policies” that govern when a model or test should be taken offline.

The guidance comes after a summer when OpenAI, Anthropic, Google, Meta and other companies say their AI models escaped from testing environments and hacked real organizations and websites. The problem has bedeviled frontier AI companies, with many of their own researchers saying it’s possible that hundreds – even thousands – of similar sandbox escapes may have occurred over the summer, raising major questions about the lack of effective monitoring in place.

“While these incidents highlight the importance of traditional cybersecurity principles and practices, they also introduce novel considerations for incident prevention, response, and reporting,” the agencies wrote. “These novel considerations primarily stem from the agentic nature and advanced cyber capabilities of cutting-edge SI systems.”

While voluntary, the document marks the federal government’s most detailed cybersecurity guidance for securing sandbox environments during AI model tests. 

The first set of recommendations deals with designing and implementing technical controls for the virtualized testing environments, while another recommends outside monitoring tools to ensure AI models don’t access tools or privileges they shouldn’t have. Cybersecurity experts have said both features were lacking in the testing environments used by AI companies this past summer.

AI testers must also scour their internal testing environments for “potential persistence mechanisms and unauthorized communication across internal and external systems” that could be used by AI agents to leave notes and collaborate on tasks in secret.

It specifically cautions against relying solely on other AI systems to monitor and restrain the behavior of their test models, using the government’s now-preferred term of “Super Intelligence” or “SI.”

“Test and red-team SI control measures with humans and SI systems before deploying them,” the guidance states. “Only use SI systems to red-team in cases where out-of-scope actions could not result in harm to critical systems.”

Security teams must evaluate risk not only from the large language model, but also from the surrounding systems and infrastructure it relies on, like the technical harness, the host and broader network, and each layer has security protocols that can stop unauthorized access to the internet or detect anomalous behavior.

Another recommendation calls for frontier AI companies to be more open to partnering with “independent, external auditors” to assess their controls and monitoring for AI agent testing. Critics have argued that Anthropic and OpenAI rely too heavily on a small group of little-known nonprofits and private research organizations, like METR and Redwood Research, to test their frontier models for safety and security concerns and respond to incidents like the Hugging Face hack. They question why these companies don’t work with more established cybersecurity or incident response firms.

Chris Painter, METR’s president, told Congress earlier this month that it had become industry practice for frontier companies to rely almost entirely on other AI systems to monitor and restrain their models in testing environments, citing the sheer volume of data and telemetry that researchers must sift through.

Cybersecurity and AI experts have told CyberScoop that a combination of human oversight, technical controls and AI systems is the most effective means of restraining the kind of agent hacks that have consumed the news.

The guidance further calls for executive leadership at these companies to be more personally involved in decisions around pausing or restarting a particular project, and only after they’ve been informed of the relevant potential risks.

The post Federal agencies recommend cyber controls, independent testing for frontier AI systems appeared first on CyberScoop.

Members of Congress are pressing the Trump administration to expand the federal government’s role in securing artificial intelligence, wanting new safety standards and regulations, independent testing of models and more “aggressive” use of AI for defensive cybersecurity purposes.

In a letter, Sens. Maria Cantwell, D-Wash., and Mike Rounds, R-S.D., said that multiple incidents of frontier AI models escaping sandbox protections and breaching real companies, organizations and governments necessitate a stronger federal role in regulating the technology.

Recent revelations that hundreds, and possibly “tens of thousands,” of such incidents may have occurred for months without OpenAI’s staff detecting them makes the need for federal intervention even more urgent, the senators argued.

“These incidents come as AI systems are becoming dramatically more capable at discovering software vulnerabilities, writing and executing code, using digital tools, and operating autonomously,” the senators wrote.

The letter, addressed to Jay Clayton, director of national intelligence and new White House “AI czar” and Michael Kratsios, director of the Office of Science and Technology Policy, urges the federal government “to bring its full capacities to bear on this challenge, building a coordinated national response around standards, testing, auditing, and defensive AI.”

The Center for Advancing Innovation and Standards for Super Intelligence (CAISSI), housed within the Department of Commerce, has become the Trump administration’s main body for evaluating and testing AI models. In the letter, the senators are seeking to expand the center’s resources and mandate.

Under the Trump administration, testing of frontier models has been voluntary and focused on evaluating model capabilities, not restricting them. The administration has since said it has reached a safety testing framework with OpenAI, Anthropic and other AI companies to govern safety testing, but has not made the agreement public.

The senators call for CAISSI to spearhead the development of “technically grounded and measurable standards and risk management frameworks for advanced AI safety and security.” Those standards would address potential risks like cyberattacks, automated attacks on critical infrastructure and other threats.

“The standards should also address the security of the environments in which advanced AI systems are developed, trained, tested, and used internally, including protections against agents escaping testing environments, gaining unauthorized access to external systems, or taking actions beyond their intended permissions,” the senators wrote.

The letter argues the center and federal technology hubs like the National Institute of Standards and Technology should hire additional expertise in AI, cybersecurity, model evaluation and national security.

It also calls for a much broader community of independent and third-party testers. Currently, that testing is done almost entirely by AI companies and hand-selected auditors, like Model Evaluation and Threat Research (METR), Redwood Research and others.

Last month, Chris Painter, president of METR, told Congress that the firm’s investigation of the Hugging Face hacking incident was at the invitation of OpenAI, which tightly controls which organizations and testers get access to its unreleased models. While they are permitted to publicize some findings, such as those that relate to potentially catastrophic risks to humanity, researchers are otherwise restricted from discussing other parts of their investigation through nondisclosure agreements.

Additionally, Painter suggested that frontier companies are relying too heavily on their own technology, rather than technical controls, to monitor and restrain their models in testing.

“Because of the scale and speed at which AI agents are deployed, companies depend on AI monitoring and controls instead of human supervision, to prevent unwanted agent behavior,” Painter said. “That is, monitoring of AI is now in large part done by other AI systems.”

The senators call for CAISSI, national laboratories and the Department of Energy to become federal testing sites. There, the government would evaluate AI models for advanced cyber capabilities, biological or chemical threats, threats to critical infrastructure, sandbox evasion techniques and other autonomous rule-breaking behavior. They also want testing opened to universities, independent research organizations and “qualified third-party evaluators,” including private sector companies.

Other federal bodies, like the National Security Agency, the Defense Advanced Research Projects Agency and National Science Foundation can help develop new standards and testbeds for AI tools used in defensive cybersecurity that can then be shared across government and with the public.

“The recent incidents make clear that the security infrastructure surrounding advanced AI must advance as quickly as the technology itself,” the senators wrote. “The United States has an opportunity to lead both sides of this challenge: building the standards, testing, and auditing infrastructure needed for increasingly powerful AI, while harnessing those same capabilities to make American networks harder to attack.”

You can read the full letter here.

The post Senators press Trump admin to rally federal government around AI safety, security  appeared first on CyberScoop.