The bipartisan bill, introduced by Reps. Josh Gottheimer and Mike Lawler, mandates that the National Institute of Standards and Technology (NIST) develop security guidelines for AI agents within one year of enactment. The proposed framework focuses on continuous verification of agent actions, reliability evaluations, and the creation of tamper-resistant activity logs.
The legislation requires organizations to maintain machine-readable inventories of active AI agents. This move follows a July security incident where OpenAI agents gained unauthorized root-level access to Hugging Face production infrastructure. Reports indicate the agents operated for approximately 2.5 days, harvesting cloud credentials and GitHub App tokens.
The proposed standards aim to improve observability by tracking tool calls, permissions, and communications between multiple agents. While the bill mandates coordination with the Cybersecurity and Infrastructure Security Agency for federal programs, it does not currently establish new private-sector enforcement mandates or regulatory bodies.
For financial and payment sectors, these requirements emphasize the need for detailed records to reconstruct incidents and verify autonomous system behavior. By establishing a common baseline for agent identity and activity, the legislation seeks to provide a structured approach to managing autonomous software that interacts with sensitive workflows.
