CISA to AI labs: Share test-network IPs to flag rogue agents

A senior expert at the Cybersecurity and Infrastructure Security Agency (CISA) is calling on AI testing labs to publicize their IP addresses and autonomous system numbers so that cyber defenders can recognize and flag anomalous traffic and notify the labs of rogue agent activity.

Jonathan "Jono" Spring, senior technical advisor for security at scale at CISA, described this as a natural iteration of the cybersecurity community's longstanding "good neighbor" practices.

"For 20 years, it has been cybersecurity practice to help your neighbors by notifying them if you see beaconing or command and control or other malware behavior coming from their network," said Spring, who made the remarks during a session on adversarial AI at the Rubrik Public Sector Summit on Oct. 13.

If mainstream organizations can help detect when agents have escaped their testing environments, Spring added, then frontier AI labs can shut down unauthorized activity earlier and limit potential damage. Given the possibility that rogue agents could disrupt critical infrastructure, such an arrangement could theoretically help protect not just individual organizations but also essential services and society at large.

"As AI and superintelligence advance rapidly, we need ways to sound the alarm when these systems take unwanted actions," Travis Rosiek, public sector CTO at Rubrik, told TechTarget.

Good idea or non-starter? Mixed reactions from analysts

Since autonomous agents can act on the internet, they already have some form of digital provenance, said Jeff Pollard, analyst at Forrester Research. Tracking those identifiers -- from not just AI labs, but also any vendors conducting model evaluation and testing -- would be "a good extension of something that already exists," he added.

The idea might, however, be difficult to put into practice.

"I'd expect voluntary adoption will probably stay uneven until customers or regulators make attribution and disclosure a requirement," Pollard said.

Dennis Xu, an analyst at Gartner, expressed skepticism that source IP addresses and ASNs would, in the long run, prove a meaningful mechanism for detecting rogue AI activity. First, he pointed out that frontier AI labs rely heavily on public cloud service providers. So, an IP address might, for example, indicate that suspicious traffic originated from Amazon Web Services (AWS) rather than the lab itself.

"To get a fixed or static outbound IP address for certain workloads -- i.e., AWS EC2 instances -- on public cloud services is technically possible, using AWS NAT gateway and Elastic IP," Xu added. That, however, would require a frontier AI company to purposefully design its test lab to have a fixed outbound IP address.

The real challenge, according to Xu, is that powerful AI agents -- all capable of acting maliciously -- will soon be deployed far and wide. When that happens, he added, tracking an ever-changing profusion of associated IP addresses and ASNs will become impractical.

"This quickly becomes a non-starter in that future-state scenario," Xu said. Instead, he added, frontier labs will likely detect misbehavior primarily by focusing on AI's logical layers -- for example, monitoring an agent's chain-of-thought as an early warning signal.

As an alternative to IP address and ASN tracking, Rubrik's Rosiek suggested that security companies could develop detection signatures to identify activity originating from AI labs. He added that the European Institute for Computer Antivirus Research (EICAR) offers a useful model. The EICAR test file is a publicly available, harmless file designed to trigger antivirus alerts.

"A similar mechanism for detecting lab activity that reaches the internet and targets unauthorized systems could help the security community build a global early warning and response system," Rosiek said.

What public sector organizations should do now

Even as CISA's Spring pushed AI testing labs to provide cybersecurity teams with a way to identify and flag attacks by rogue agents, he also urged public sector organizations to take proactive steps to protect themselves now.

"Use these agentic AI systems as if you're the attacker to support and speed up security evaluations," Spring advised. Ultimately, that means not just finding vulnerabilities, he added, but creating a secure-by-design, AI-driven development pipeline that generates real proof-of-concept exploit code and suggests fixes on a near-hourly basis.

Finally, Spring said, public sector organizations should comply with the federal directive to prioritize patches based on risk, patch high-risk vulnerabilities within three days, and actively look for evidence that attackers have started exploiting those flaws -- on the assumption that they already have.

"Everyone's threat profile has changed, and the world has changed," Spring said. "Pretending like this won't happen to you is not going to be enough."

Alissa Irei is an Informa TechTarget news reporter covering cybersecurity.