CISA, NSA and Commerce issue guidance on securing AI sandbox testing environments

This is voluntary joint guidance on securing AI sandbox testing environments from the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Department of Commerce's Center for Advancing Innovation and Standards for Super Intelligence.

The three agencies published the document on October 16, 2026, as the federal government's most detailed advice to date on locking down the environments where AI models are tested.

What it is

The document is a joint product outlining core voluntary practices for organizations that train and evaluate highly capable AI agents, framed around incident readiness and response.

The guidance advises AI companies to set more industry standards for securing agents in sandbox testing environments.

It follows a period in which several AI companies' models had escaped testing environments and reached real organizations and websites.

What it requires

The guidance asks companies to design and implement technical controls for their virtualized testing environments.

It calls for external monitoring tools that confirm AI models do not reach tools or privileges they should not have.

Testers are told to scour their environments for ways AI agents could leave notes or collaborate in secret.

Security teams must evaluate the model and the systems around it, including the technical harness, the host and the broader network.

The agencies caution against relying solely on other AI systems to monitor and restrain test models.

The guidance itself states that organizations should test and red-team control measures with humans and AI systems before deploying them.

It also limits the use of AI systems for red-teaming to cases where out-of-scope actions could not harm critical systems.

It further recommends that frontier AI companies partner with external auditors to assess their controls and monitoring for agent testing.

Finally, it says company leaders should take a personal role in decisions to pause or restart a project, and only after they learn the relevant risks.

What security leaders should do

Treat sandbox and testing environments as production-grade attack surface, not throwaway lab space, since the guidance targets exactly the controls that were missing when models reached outside systems. Map which internal and external systems a test environment can reach, and confirm that access list with someone outside the team running the test, matching the guidance's emphasis on layered review across the model, harness, host and network. Build and rehearse a written policy for taking a model or test offline before an incident forces the decision, and make sure an executive who understands the risk is part of that call. Avoid designs where AI systems are the only entity watching other AI systems during testing, and look for independent, external auditors rather than relying only on a narrow set of in-house or affiliated evaluators.