NIST published its first draft analysis of AI data-center security on July 27, 2026. The document borrows from high-performance computing, then accounts for the parts of AI infrastructure that change the threat surface: gateways that route inference requests, outside movement of models and data, and autonomous agents operating inside the environment.
And one sentence in the draft carries the shift: “The recent advancement in agentic AI and the autonomous nature of the agents make them ‘insiders’ as well.”
What changed
NIST Special Publication 800-239 is an initial public draft, with comments due September 25. Its stated job is to analyze threats and security gaps in AI data centers and offer basic recommendations. The scope covers the computing environment used to access, manage, run, and store AI workloads. The site perimeter, buildings, power and cooling systems, supply chain, and personnel sit outside this document and are being handled through related work.
Within that boundary, NIST treats an autonomous agent as a principal that may already have legitimate access. That changes the security question. A team has to know which agent identity reached a model or dataset, what permissions it held, what it did across processes, and which version was active at the time.
The draft recommends monitoring usage and access patterns, data and model access, version history, and lateral communication between processes. It also calls for human oversight and final approval for critical actions. Model promotion to production is the concrete example.
Why it matters
Because an agent can act inside a system without looking like the human insider most security programs were built to recognize, there may be no stolen badge, strange visitor, or employee account behaving badly. The actor may be an authorized service with more room to move than anyone has inventoried.
So a basic control check is useful now. List each agent identity, the resources it can reach, the actions it can take, and the records it leaves behind. Then identify the changes that still require a person to approve them. These checks do not prove an agent is safe, but they give an operator something concrete to inspect after the session ends.
But NIST does not claim that agent-caused incidents are common, and it does not describe agents as human employees or inherently malicious. “Insider” is a threat-model category here. The draft also remains incomplete and nonbinding.
Watch next
The next useful signal is specificity. Later guidance could turn broad recommendations into testable requirements for machine identity, durable logging, permission review, and approval evidence. The companion work on physical infrastructure, operational technology, supply chain, and personnel may also show where an agent-centered security model stops and the wider data-center risk picture begins.
For now, the practical question is narrow: if an authorized agent takes a critical action tonight, can the organization identify it, reconstruct the path, and show who approved the change?
Primary source: NIST SP 800-239 initial public draft, July 27, 2026