The Stop Rogue AI Act landed in Congress in September 2026 after a summer in which autonomous AI agents stopped being a research concern and became a security incident category. Representatives Josh Gottheimer and Mike Lawler introduced the bipartisan bill to answer a question most organizations still cannot answer, which is how many AI agents are running inside their systems today, who built them, and what data they can reach.
The bill would turn AI agent discovery, identity, and control into national standards written by NIST, then push those standards into every federal contract that involves agents. Security leaders should read it less as pending law and more as a preview of the baseline auditors and buyers will expect. This guide covers what the Act says, who it binds, the deadlines it sets, and the preparation that pays off either way.
Key highlights:
- The Stop Rogue AI Act (H.R. 10362) directs NIST to publish standards for discovering, verifying, monitoring, and controlling AI agents within one year of enactment.
- Federal agencies and contractors would carry binding obligations through procurement rules, while private enterprises inherit the standards as the de facto duty-of-care baseline.
- The bill demands capabilities most organizations lack today, including a machine-readable agent inventory, cryptographically verifiable agent identity, runtime monitoring, and revocable access.
- Cycode already delivers the discovery, governance, and guardrail controls the bill describes, across both traditional and agentic development.
What Is the Stop Rogue AI Act?
The Stop Rogue AI Act is a bipartisan House bill, filed as H.R. 10362 in the 119th Congress, that directs the National Institute of Standards and Technology to develop security standards for AI agents. Gottheimer, a New Jersey Democrat, announced it on September 9, 2026, with Republican cosponsor Mike Lawler of New York, and the chamber formally received it on September 14 with referrals to the Science and Oversight committees.
The bill defines an AI agent as a software system that uses an AI model to perceive, plan, or make decisions, acts autonomously on someone’s behalf, and needs minimal human involvement beyond its initial direction. That definition covers coding agents, browser agents, and the MCP-connected assistants already spreading through enterprises. The word rogue, notably, never appears in the operative text, since the target is unmanaged agents rather than malicious ones.
- NIST drafts the standards jointly with NTIA, and CISA folds them into federal civilian cybersecurity guidance.
- Standards must stay open and vendor-agnostic, favoring DNS-based identity and cryptographic agent registries over proprietary platforms.
- The text sets no penalties and authorizes no new funding, relying on procurement pull instead.
Why Is Congress Targeting Rogue AI Agents Now?
The trigger was a string of reported incidents over the summer of 2026 in which autonomous agents took actions nobody authorized, including an OpenAI agent that reportedly breached systems at Hugging Face. Gottheimer put the problem bluntly, saying “AI agents are running loose in our networks, and nobody can see them or verify who built them.” Several security vendors and AI policy groups publicly backed the bill on the day it was introduced.
The bill also rides a wider legislative wave. Representatives Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act in July to force shutdown capabilities for advanced systems, Senator Mark Warner proposed FTC oversight of agent vendors, and NIST had already opened its voluntary AI Agent Standards Initiative in early 2026. The Stop Rogue AI Act would convert that voluntary work into a statutory mandate with hard deadlines attached.
What Does the Stop Rogue AI Act Require?
Section 2 of the bill hands NIST, working with NTIA, one year from enactment to publish standards covering eight capability areas, refreshed annually after that. Read together, the areas describe a complete lifecycle of agent oversight, from knowing an agent exists through proving what it did afterward.
Each requirement lands differently depending on whether an organization builds agents, buys them, or merely hosts the systems agents touch, and the bill explicitly covers all three cases.
| Requirement in the Bill | What It Means in Practice |
|---|---|
| Continuous discovery and inventory | A live, machine-readable record of every agent touching your systems, with standardized naming, whether built in-house, bought, or operated externally |
| Organizational control | The ability to allow, deny, or restrict any agent’s data access, actions, and interactions, revocable at any moment |
| Pre- and post-deployment evaluation | Agents assessed for security, safety, correctness, and reliability before launch and continuously afterward |
| Runtime monitoring and inline interception | Live detection of prompt injection, data exfiltration, anomalous tool use, and drift from approved behavior |
| Cryptographically verifiable provenance | Proof of who created and operates each agent, never self-attestation or a single vendor’s word alone |
| Tamper-evident logging | Standardized, portable records of material agent actions that survive scrutiny after an incident |
Two details in the text deserve more attention than they have received. Identity verification must happen at both the network and application layers, and the standards may never rely solely on self-attested claims or a single provider’s assurances. The discovery mandate also reaches agents merely interacting with your systems, so an inventory limited to the agents you deployed yourself would already fall well short of the standard the bill envisions.
Who Has to Comply With the Stop Rogue AI Act, and When?
Direct obligations fall on the federal side. Within 18 months of NIST publishing the standards, the FAR Council must formally propose acquisition rules requiring contractors and agencies that procure or deploy AI agents, or systems that interact with them, to meet the standards, with OMB and CISA issuing implementation guidance 180 days later. Contracts signed before enactment stay exempt, so the requirements reach agencies and their vendors through new awards.
Private enterprises face no direct mandate, yet treating that as a pass would misread how NIST standards travel. Regulated industries fold them into examinations, insurers and auditors adopt them as the measure of reasonable care, and enterprise buyers copy federal contract language into their own. Anyone selling software or AI capability to the government, or to companies that do, should expect agent inventories and identity verification to surface in security questionnaires first.
| Milestone | Deadline |
|---|---|
| NIST and NTIA publish AI agent discovery and security standards | One year after enactment, updated annually |
| FAR Council proposes procurement rules for contractors and agencies | 18 months after the standards publish, revisited annually |
| OMB and CISA issue implementation guidance to agencies | 180 days after the FAR proposal, updated annually |
| Private-sector adoption as the audit and procurement baseline | No statutory date, follows the federal rollout |
What Happens Next for the Stop Rogue AI Act?
The bill now sits in committee, and the calendar works against fast action, since the House had little floor time left before the midterm recess and leadership has said AI legislation will not be rushed. A Senate attempt to fast-track a related AI shutdown measure was blocked the same week. Watch for a committee markup, a Senate companion, or the bill’s language reappearing inside a larger package, since agent security has drawn support from both parties.
Timing math matters more than passage odds. Even if the Act became law early in 2027, its own deadlines put NIST standards in 2028 and binding procurement rules well after, so nothing here rescues a team that waits. Meanwhile the NIST AI Agent Standards Initiative keeps producing the underlying identity and discovery work regardless, and procurement teams already borrow its vocabulary, so the direction is set and only the enforcement date remains open.
How Can Enterprises Prepare for the Stop Rogue AI Act?
Preparation is worth starting now because every capability the Stop Rogue AI Act names already pays for itself as plain security hygiene, whatever happens in committee. Cycode’s State of Product Security for the AI Era 2026 report found that 81% of organizations lack full visibility into AI usage across their development lifecycle, which means most teams would fail the bill’s very first requirement today. Five moves close the gap in order.
1. Build a living inventory of every AI agent
Start with shadow AI discovery across repositories, developer machines, CI runners, and production, because agents leave traces in commit metadata, configuration files, and MCP connections long before anyone registers them. Convert the findings into an AIBOM, a machine-readable inventory of agents, models, and the credentials behind them. That artifact is precisely what the bill’s discovery standard describes, and it doubles as the evidence auditors ask for first in any review.
2. Verify who built and operates each agent
Identity comes next, since the bill rules out trust based on a vendor’s word alone. Record the responsible owner, the originating vendor or repository, and the approval that let each agent in, then prefer agents whose provenance can be verified cryptographically. Supply chain discipline transfers directly here, because an agent pulled from a public registry deserves the same provenance scrutiny as any open source dependency entering your own production build.
3. Enforce allow, deny, and revoke control
The bill’s organizational control definition, the power to allow, deny, or restrict an agent’s access and revoke it at any time, is exactly what AI governance policy enforcement provides. Maintain an authorization state for every agent and tool, block the unauthorized ones where developers work, and restrict risky MCP servers to localhost rather than production. A kill switch that exists only in a policy document fails the moment an incident starts.
4. Monitor agent behavior at runtime
Runtime monitoring in the bill names the exact attack classes security teams already see, prompt injection, data exfiltration, anomalous tool use, and drift from approved behavior. AI guardrails supply the inline interception the text calls for, screening prompts, file reads, and tool calls before secrets or sensitive data leave the boundary. The OWASP MCP Top 10 makes a practical companion checklist, since most rogue agent paths run through the tool layer.
5. Keep audit-grade logs across the pipeline
Tamper-evident logging closes the loop, and it has to cover everywhere agents act, which increasingly means the Agentic Development Life Cycle (ADLC), where agents write code, trigger builds, and touch artifacts. CI/CD security telemetry therefore belongs in the same record as IDE activity. Teams securing the ADLC end to end collect this evidence as a natural byproduct, turning a future compliance exercise into an export rather than a standalone project.
See Cycode in actionBook a demoGet Ahead of the Stop Rogue AI Act With Cycode
Cycode, the Agentic Development Security Platform, already ships the full capability set the bill describes, unifying control, context, and autonomy from prompt to cloud. AI Visibility discovers every agent, assistant, model, and MCP server across the entire development environment and maintains the AIBOM the discovery standard envisions. AI security posture management correlates those assets with risk, while policy-driven authorization states, IDE-level blocking, and localhost-only restrictions deliver exactly the organizational control the bill defines.
Monitoring and evidence follow the same pattern. Guardrails intercept prompts and tool calls carrying secrets in real time, the Context Intelligence Graph ties every agent action to ownership, reachability, and blast radius, and decision traces give the tamper-evident record the logging standard anticipates. Autonomy then closes the triad, since Cycode Maestro orchestrates AI Teammates that triage, verify, and fix what monitoring surfaces, keeping the whole operating model agent-driven and human-controlled.
The bill, in other words, asks enterprises to govern the AI layer, and Cycode covers that side while also putting AI to work for the security team. Whether the Stop Rogue AI Act passes this session or comes back renamed next year, the controls it describes are simply what safe agent adoption already requires. Book a demo to see discovery, governance, and agentic remediation running live against your own environment.