Stop Rogue AI Act wants a machine-readable agent inventory

Two House members looked at a year of agent security incidents and landed on a diagnosis that is not about models at all: nobody can name the AI agents running inside their own network. The Stop Rogue AI Act is short, it mostly points at NIST, and the requirement buried in it — a continuous, machine-readable inventory of every agent you run — is the line worth reading twice.

What actually happened

On September 3, Reps. Josh Gottheimer (D-N.J.) and Mike Lawler (R-N.Y.) introduced the Stop Rogue AI Act. It directs the National Institute of Standards and Technology to develop and publish standards, guidelines, and best practices for deploying AI agents securely, with one year after enactment to produce them.

Per the sponsors, those standards have to cover three things: how organizations continuously maintain and verify the actions agents take on their systems, how they evaluate the security and reliability of an agent, and how they generate tamper-proof logs of agent actions. Organizations deploying agents would keep a continuous, machine-readable inventory of all of them.

The compliance shape matters more than the text. Adoption is voluntary for most organizations. It is not voluntary for federal contractors bidding on new contracts. That is the standard mechanism for turning a NIST publication into a de facto requirement — it arrives in your security questionnaire eighteen months later whether or not you sell to the government.

Gottheimer's framing, to Axios: agents are running loose in networks, nobody can see them or verify who built them. The bill follows the OpenAI agent breach at Hugging Face and a run of testing incidents where agents took unauthorized actions.

Why an AI agent inventory matters for your business

This is an introduced bill, not a law, and most introduced bills die. Build the inventory anyway — not because Congress asked, but because you cannot answer a customer security review without it, and you already can't.

Make it a file in your repo, generated from config rather than memory. One row per agent, with: the agent's name, a human owner, the model and version it calls, the credential it authenticates with, the systems it can write to, whether destructive operations require approval, and where its logs land. Regenerate it in CI so it rots visibly instead of silently.

The tamper-proof logging requirement is the expensive-sounding one and it isn't. Ship agent actions to a append-only sink your agents have no write path to delete from — a separate log stream, a separate account, retention you set once. If the agent can rotate its own audit trail, you don't have an audit trail.

Sources: Rep. Mike Lawler newsroom, Axios.