The National Institute of Standards and Technology (NIST) has released a draft taxonomy of adversarial machine-learning attacks and mitigation approaches, with a particular focus on threats targeting agentic AI systems. 

The November 9 draft, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, aims to establish a common vocabulary for assessing and managing security risks across predictive, generative and agentic systems.

The initial public draft (NIST SP 2400-102e2026) organizes attacks according to the machine-learning methods involved, the stages of the system lifecycle and the goals, capabilities and knowledge of attackers. 

NIST intends the taxonomy to inform future standards and practice guides for AI security. The public comment period closes December 18, 2026.

The draft examines several categories of attacks against machine-learning systems, including data poisoning, model poisoning, privacy attacks and evasion techniques. For generative AI, it covers supply-chain attacks, direct and indirect prompt injection, information extraction and model tampering.

Taxonomy Covers Data Poisoning, Prompt Injection and Agent Hijacking

Its agentic AI section addresses threats arising from the way agents interact with external data, tools, skills and other agents. These include attacks involving untrusted data, malicious tools and skills, multi-agent workflows and long-running tasks.

One concern is that agents may retrieve information from external sources such as websites, files, knowledge bases and persistent memory. Malicious instructions embedded in this material can enter an agent’s context and influence its behavior. 

NIST also describes memory-poisoning attacks, in which adversaries insert malicious content into information an agent may retrieve in later sessions.

The draft discusses potential defenses, including separating trusted instructions from untrusted content, restricting information flows, using access controls and least-privilege permissions, sandboxing and audit logging.

Data Integrity Becomes a Core AI Governance Concern

The taxonomy has direct relevance for chief data officers (CDOs) as organizations expand their use of generative and agentic AI. Data poisoning, malicious external content and compromised knowledge sources can affect the information an AI system uses and the actions it takes.

Data leaders will need to work with security and AI teams to establish controls around the sources agents can access, the reliability of retrieved information and the permissions attached to tools and connected systems. Monitoring how data moves through agent workflows, maintaining appropriate access restrictions and distinguishing trusted information from untrusted inputs are also important governance considerations.

These controls form part of the broader AI governance practices required as organizations move toward more autonomous systems.

NIST says the draft is intended for people and organizations involved in designing, developing, deploying, evaluating and governing these systems. It is voluntary and does not establish legal or regulatory requirements. The agency is inviting feedback on emerging attacks, effective mitigation approaches and terminology that may need standardization before the document is finalized.