A new draft from the National Institute of Standards and Technology (NIST) is putting a sharper focus on a problem that becomes more important as artificial intelligence systems gain the ability to plan, use tools and carry out multi-step tasks: how do you protect an AI system when someone deliberately tries to manipulate it?

Published on November 9, 2026, NIST’s draft report, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, organizes the language and methods used to describe attacks on advanced AI systems. The public comment period is open through December 18, 2026. The document is a draft for feedback, not a final regulation or a certification that a product is safe.

What NIST is trying to clarify

Adversarial machine learning is the study of ways an attacker can exploit weaknesses in a machine-learning system. The attack may target the data used to train a model, the information supplied to it while it is operating, the model’s behavior or the way the system connects to other tools.

NIST’s draft focuses on advanced and agentic systems: AI that can work through tasks, interact with software or services, and make decisions across multiple steps. That creates a wider attack surface than a chatbot that only responds with text. An agent may read a document, interpret instructions, call a tool and then take an action. If an attacker can influence one part of that chain, the result may affect the whole workflow.

Three attack patterns worth understanding

Prompt or input manipulation: An attacker may place misleading instructions in text, a web page, an image or a document that an AI system is asked to process. The goal is to steer the model away from the task its operator intended.

Data poisoning: If malicious or misleading material enters a model’s training or reference data, it can influence what the system learns or retrieves. The risk depends on the system design and how data is collected, checked and updated.

Tool and workflow abuse: An agent that can send messages, access files or interact with business software can create consequences beyond a bad answer. Security teams need to consider permissions, confirmation steps, logging and limits on what an agent is allowed to do.

Why this matters to companies and everyday users

For businesses, the document is a reminder that adding an AI agent to an existing workflow should be treated as a security decision. A company should know what data the system can access, which actions it can perform, who approves high-impact actions and how activity can be audited. Giving an agent broad access simply because it is convenient can turn a model error into an operational incident.

For consumers, the practical lesson is simpler: do not assume that an AI assistant can safely handle every document, link or request just because it sounds confident. Avoid sharing sensitive information unless you understand the service’s data practices, and review any consequential action before an AI system completes it.

What happens next?

NIST says the draft is intended to establish shared terminology and help inform future standards and practice guides. Comments are due by December 18, 2026. That means the current document should be read as a framework under review, not a final checklist that every organization is legally required to follow.

The larger shift is clear: AI security is no longer only about preventing someone from breaking into a server. It also means testing how a model responds to hostile inputs, limiting what an agent can do, and making sure people can detect and correct unsafe behavior. As AI tools move deeper into everyday work, those safeguards will matter as much as the model’s headline capabilities.

Sources: NIST draft announcement (November 9, 2026); NIST’s adversarial machine-learning publication.