The Cybersecurity and Infrastructure Security Agency (CISA) in its regulator and standards-setter capacity, covering joint guidance on agentic-AI security, a proposed compression of the federal critical-vulnerability patch deadline, and Five Eyes-coordinated agentic-AI guidance. CISA's guidance authority over agentic-AI security, vulnerability-disclosure timelines and supply-chain attestation is separate from its own use of AI, which is covered at CISA — Cybersecurity and Infrastructure Security Agency (AI Deployer).
Operative authorities
CISA's regulatory leverage runs through several established instruments:
- Binding Operational Directives (BODs) for federal civilian executive-branch agencies. A 3-day-patch deadline, if issued, would take this form.
- Known Exploited Vulnerabilities (KEV) catalog, which mandates remediation timelines for vulnerabilities CISA designates as actively exploited.
- Joint Cyber Defense Collaborative (JCDC), a public-private coordination vehicle and a likely path through which AI-cybersecurity-specific frameworks reach private-sector deployers.
- Sector Risk Management Agency (SRMA) role. CISA is the SRMA for several critical-infrastructure sectors and shares the role for others.
Agentic-AI guidance (2026)
CISA issued two Five Eyes-coordinated guidance documents on agentic-AI security in May 2026. On May 1, 2026, it published an agentic AI joint guide covering agentic-AI security architecture, co-published with Australia's ASD, the UK's NCSC, and Canada's CCCS (Source: covered in dev-log 2026-05-04 cluster). On May 4, 2026, CISA and the Australian Cyber Security Centre (ACSC) published joint guidance on agentic-AI deployment risks, addressing privilege creep, behavioral misalignment, and obscure event records; it was the second Five Eyes-coordinated AI-cybersecurity guidance after the May 1 document (Source: covered in dev-log 2026-05-09-0213).
The guidance is voluntary by design but has historically been cited in agency enforcement, including FTC AI-product cases. Whether the May 4 CISA + ACSC guidance acquires the force of de-facto regulation through procurement and enforcement citation within 12 months is unresolved; coverage of the May 4 guidance issued in May 2026 forecasts that it will be cited as a governance baseline in at least one FTC or DOJ enforcement action by 2027-05-31 (Source: covered in dev-log 2026-05-09-0213).
Joint advisory on AI-assisted ICS exploitation (August 2026)
On August 19, 2026 CISA co-authored joint cybersecurity advisory AA26-231A with the NSA, the FBI, the Department of Energy and the EPA, warning owners and operators of industrial control systems that threat actors are conducting reconnaissance and capability development against US-based Siemens S7 Series programmable logic controllers "using AI-generated exploitation scripts disguised as legitimate monitoring tools." The advisory names Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities as the most-targeted sectors, maps observed techniques to MITRE ATT&CK for ICS v19 and countermeasures to MITRE D3FEND v1.5.0, and sets out seven hardening actions — among them blocking TCP port 102 at perimeter firewalls entirely and monitoring engineering workstations for Python processes importing the snap7 library (Joint Cybersecurity Advisory AA26-231A — Defending Against an Active Threat to Siemens S7 Series PLCs).
The advisory is guidance rather than a directive: it urges rather than requires, and asks entities relying on systems integrators or third-party managed service providers to share it with those parties and request implementation. Its assessment of the AI element is that AI-assisted development "dramatically reduc[es] the technical expertise and time required to develop working ICS exploitation scripts," against known and patchable vulnerabilities, rather than that it produces novel ones. See AI and Cybersecurity.
Joint advisory on knowledge-distillation campaigns (September 2026)
On September 8, 2026 CISA released joint cybersecurity advisory AA26-251A with the NSA and the FBI, warning that China-based AI companies are targeting US AI companies to systematically extract proprietary models through knowledge distillation. The advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, states that the extraction has run since at least late 2024 across billions of tokens and millions of exchanges against variants of Claude, GPT, Gemini and Grok, and assesses that it likely occurs with Chinese government awareness. Its three recommendations are detection and mitigation of anomalous prompts, accounts and usage ratios; subtly altering responses to suspected distillation attempts to attenuate the payoff; and cross-organization intelligence sharing among model providers, cloud platforms and API aggregators. Acting Director Nick Andersen urged AI companies "to take immediate steps to safeguard their platforms" (Source: cisa.gov). The advisory text maps each named firm to the specific US models and capabilities it distilled, maps eight techniques to MITRE ATLAS and describes four more as absent from it, and sets out the response-alteration recommendation in operational detail, including advice not to inform suspected distillers of a downgrade while informing safety researchers and third-party evaluators of model changes (Joint Cybersecurity Advisory AA26-251A: China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns (NSA/CISA/FBI, September 2026)). Like AA26-231A it is guidance rather than a directive. See Adversarial Distillation.
Proposed 3-day patch deadline
As of May 1, 2026, CISA was considering a 3-day federal critical-vulnerability patch deadline, compressed from the previous 15-day deadline, attributed to pressure from AI-powered hacking (Source: covered in dev-log 2026-05-04 cluster). Such a deadline would be issued as a Binding Operational Directive. The proposal is positioned as the defensive counterpart to the attack-cost economics described for Claude Mythos Preview, where the threat economics are framed as forcing the defense economics. Coverage of the proposal issued in May 2026 forecasts that a Binding Operational Directive mandating a patch window of 72 hours or less for KEV-catalog vulnerabilities will be published by 2026-11-30 (Source: covered in dev-log 2026-05-04 cluster).
Overlapping AI-cybersecurity authority
AI-cybersecurity-specific authority is distributed across several bodies: CISA (defense and mitigation), NIST CAISI (Center for AI Standards and Innovation) (pre-release evaluation), Chief Digital and AI Office (CDAO) (DOD procurement), and the FTC (consumer deployment). CISA serves as the deployment-and-incident counterpart to CAISI's pre-release-evaluation role, and as the civilian-side equivalent of CDAO for non-DOD federal agencies. Per Bloomberg, May 8, 2026, a narrower cybersecurity-only AI executive order was under consideration; coverage forecasts that, if the final EO ships, it will name CISA as the operational authority by 2026-12-31, though that role could instead sit with CAISI (Source: Bloomberg, May 8, 2026). See AI and Cybersecurity, AI Pre-Release Vetting, and Procurement-Driven AI Governance.
Position on China-developed frontier models
CISA vulnerability-management official Jay Gazlay identified national-security concerns over China-developed frontier AI models and called for stronger interagency efforts against nation-state actors, in remarks published July 20, 2026 — days after Moonshot AI's Kimi K3 release intensified U.S. policy debate over Chinese open-weight models (Source: insideaipolicy.com). See Open-Weight Frontier Models.
Relationships
- regulator-counterpart-of: CISA — Cybersecurity and Infrastructure Security Agency (AI Deployer) (same org, deployer role)
- related: NIST CAISI (Center for AI Standards and Innovation) — CAISI is the pre-release-evaluation counterpart; CISA is the deployment-and-incident counterpart.
- related: Chief Digital and AI Office (CDAO) — DOD procurement; CISA's civilian-side equivalent for non-DOD federal agencies.
- related: AI and Cybersecurity, AI Pre-Release Vetting, Procurement-Driven AI Governance
- supports: Joint Cybersecurity Advisory AA26-231A — Defending Against an Active Threat to Siemens S7 Series PLCs — joint advisory CISA co-authored on AI-assisted ICS exploitation.
- related: Claude Mythos Preview — the threat actor for which CISA's guidance is the defensive response.
- related: Asd Acsc (stub — Australian Cyber Security Centre), Ncsc Uk (stub), Cccs (stub) — Five Eyes peers.