# Government Buyers Strengthen AI Agent Security

An article on third-party AI skills identifies software supply-chain risks for AI agents, including prompt injection, excessive permissions, unauthorized data access, and hidden network activity. It describes no specific solicitation, award, or procurement action, but gives government buyers and contractors concrete security considerations for evaluating AI systems and drafting related contract requirements.

- Buyers can assess skill provenance and security testing, and specify least-privilege access, isolated execution, and monitoring in evaluations or contract terms.
- Human approval controls may help limit the effects of unauthorized or unexpected agent actions.
- Contractors providing AI systems or skills can address these concerns by documenting component provenance and security controls; the signal does not identify a particular compliance mandate or deadline.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Artificial Intelligence
**Published:** October 28, 2026

### Government Entities
- National Institute of Standards and Technology (NIST)

### Sources
- [How to Secure AI Agents: Identifying Hidden Risks in Third-Party AI Skills](https://www.rebellionresearch.com/how-to-secure-ai-agents-identifying-hidden-risks-in-third-party-ai-skills) - Rebellion Research