Stop Rogue AI Act

This bill requires the National Institute of Standards and Technology (NIST) to create standards for discovering and securing artificial intelligence (AI) agents, and mandates that federal procurement contracts for AI agents or systems that interact with them comply with these standards. Sec. 2, AI agent discovery and security standards: Within one year and annually thereafter, the NIST Director, with the Assistant Secretary of Commerce for Communications and Information, must develop and publish standards for organizations to continuously discover, inventory, verify, and control all AI agents in their systems; evaluate agent security before and after deployment; enable runtime monitoring and interception of agent interactions; implement cryptographically verifiable provenance; and generate tamper-evident logs. These standards must treat agent discovery as part of cybersecurity, support open and interoperable discovery standards using existing internet infrastructure, and require organizations to maintain a machine-readable inventory, implement independent identity verification, and not rely solely on self-attested identity. The Director must also incorporate these standards into NIST frameworks, conduct demonstration projects, and coordinate with other agencies. Sec. 2(b), Federal procurement requirements for AI agent security: Within 18 months after the standards are published, the Federal Acquisition Regulatory Council must propose revisions to the Federal Acquisition Regulation requiring contractors and agencies procuring or deploying AI agents or systems that interact with them to comply with the standards. Contracts must include requirements for continuous inventory, cryptographically verifiable identity, agency-accessible discovery and verification, agency control over agent interactions, provenance information, and tamper-evident logs. This does not apply to contracts entered into before the bill's enactment. The Office of Management and Budget must issue guidance on implementation within 180 days of the proposed revisions. Sec. 2(c), Definitions: Defines key terms including 'AI agent discovery' as the capability to identify and inventory AI agents; 'AI agent' as a software system using an AI model to autonomously interact with other systems with minimal human input; 'organizational control' as the ability to allow, deny, or restrict an agent's access and actions; and other terms like 'defense-in-depth' and 'information system'.