The Stop Rogue AI Act asks one question. Can you name every agent you run?

The most important AI story on Sunday, September 6, 2026 for a small team is not a model. It is a bill.

On Thursday, Reps. Josh Gottheimer (D-N.J.) and Mike Lawler (R-N.Y.) introduced the Stop Rogue AI Act, a bipartisan House bill that Axios reported first and that Lawler's office reposted the same day. It does not ban anything or license anyone. It tells the National Institute of Standards and Technology to write down how an organization should deploy AI agents securely, and it names the first thing on that list: a continuous, machine-readable inventory of every AI agent you run. (Lawler, via Axios)

The notes I wrote this week were all about the vendor side. Astra at Critical, Flash and Flash Cyber, four labs gating their top slice in the same window. Every one of those was about what a lab will sell you and under what conditions. This bill points the other direction. It is about what you can see on your own side of the connection, and for most shops I talk to, the honest answer is less than they think.

What the bill actually says

I am working from the Axios report as reposted by Lawler's office, plus two pieces of analysis that quote it. I have not seen the bill text itself, so I am not going to invent section numbers or definitions.

The Stop Rogue AI Act directs the Commerce Department's NIST to develop and publish standards, guidelines, and best practices for how organizations can securely deploy AI agents. Per Axios, those standards should cover three things: how organizations continuously maintain and verify the actions agents take on their systems, how they evaluate the security and reliability of the agents, and how they generate tamper-proof logs of what the agents do. Alongside that, deployers would be called on to maintain a "continuous, machine-readable inventory of all AI agents," and NIST would work with CISA so that federal civilian agencies apply the standards inside their own security programs. NIST would have one year after enactment to get the standards out. (Lawler, via Axios)

The enforcement shape matters more than the enforcement volume. The standards would be voluntary for most organizations. The bill would push federal contractors bidding for new deals to meet them. That is the same procurement lever that turned software bills of materials and CMMC from optional guidance into contract language, and it is how a voluntary NIST document tends to become the floor for anyone who sells to someone who sells to the government. (AI2Work)

Gottheimer's framing was blunt. "AI agents are running loose in our networks, and nobody can see them or verify who built them," he told Axios, calling it "a five-alarm security risk." The bill launched with support from Palo Alto Networks, GoDaddy, Infoblox, the AI Policy Network, and the Alliance for Secure AI. Two of those companies co-author IETF drafts on agent naming and discovery, and one sells machine-identity security, so read the endorsement list as a market signal rather than an independent audit. (Lawler, via Axios, AI2Work)

It is not the only federal approach on the table, and I do not want to overstate its odds. Sen. Mark Warner has a discussion draft that would have the FTC set up independent bodies to vet agent vendors. Reps. Ted Lieu and Nathaniel Moran introduced a bill in July that would let DHS order the most powerful models slowed or shut down. One regulates the deployer, one the marketplace, one the developer. Only the Gottheimer-Lawler bill lands on the desk of the person who actually runs the agent, which is why it is the one I am writing about today. (Lawler, via Axios, AI2Work)

Why this is a small-team story

You will not be a federal contractor bidding on a new deal this quarter. Probably. The bill still describes your problem better than most of the vendor announcements did.

Here is the test I have been running with clients for the past month. Without opening a dashboard, name every agent that can touch a repo, a browser, or a customer record. Not "we use Claude Code" or "we have a support bot." The actual list: the coding agent in three people's IDEs, the CI job that opens pull requests, the browser agent someone stood up on the staging box in June, the Zapier flow that reads the inbox, the MCP server a contractor wired to the CRM, the scheduled script that calls a model and writes back to the database. Then, for each one, who owns it, what it can reach, and how you turn it off.

Nobody has passed cleanly. Not because people are careless, but because agents accumulate the way browser extensions do. Each one was a reasonable decision on a Tuesday afternoon, and nobody was assigned to keep the list.

The vendor research on this is worth reading with the usual caution. AI2Work cites a Strata Identity figure that roughly one in five organizations maintains a real-time inventory of active AI agents. Strata sells identity products into this exact gap, so treat the number as a direction rather than a measurement. But it lines up with what I see: the shops that can answer the question are the ones that decided, on purpose, that someone owns the list. (AI2Work)

The two incidents that pushed this bill are not small-team stories, and I covered them when they happened, so I will not re-litigate them here. What they share is the part that is transferable. In both cases agents were acting on infrastructure that nobody was watching, under identities nobody had registered, for long enough that the discovery was the story. A five-person shop does not have a Kubernetes cluster for an agent to roam. It has a GitHub org, a Stripe account, a shared inbox, and a database with customer rows in it. The scale is different. The blind spot is identical.

My analysis: the inventory is the load-bearing object

I think the bill's authors got the ordering right, whether or not the bill moves.

Verification of agent actions, security evaluation, and tamper-proof logging are all downstream of one question: do you know the agent exists? You cannot verify the actions of a process you have not named. You cannot evaluate the reliability of an integration nobody remembers wiring up. You cannot protect a log from an agent you did not know was writing to it. The inventory is not paperwork that sits next to the controls. It is the thing the controls hang from.

Two words in the bill's own phrasing do most of the work: continuous and machine-readable.

Continuous means a snapshot is not the deliverable. A spreadsheet that someone filled out during the last security review and has not opened since is a historical document. It tells you what you had. The bill is asking what you have. For a small team that does not mean buying an agent-discovery platform. It means the list lives somewhere that changes when the agents change, and that adding an agent without updating the list is understood to be the mistake, not the norm.

Machine-readable means a human is not the only reader. If the list is a YAML file in the repo, a table in the database, or even a structured note that a script can parse, then a check can run against it. Does every API key in the secrets manager map to a row? Does every row have an owner who still works here? Does every agent that can write to production have a log destination it cannot reach? Those are cheap questions to automate once the list is a real object and impossible to automate when it is a paragraph in a wiki.

I also want to be careful about the word rogue, because the bill's name will do some damage on its own. Almost none of the agents that hurt a small team are rogue in the sense of having escaped. They are doing exactly what they were configured to do, by someone who has since changed roles, with a credential that was never rotated, against a surface that grew wider than anyone intended. The inventory catches that failure mode just as well as it catches the dramatic one. Maybe better.

What I would do this week

I would not wait for NIST. A year from enactment is a year from a date that has not happened, and the useful part of this bill is that it tells you what a serious inventory looks like without asking you to buy anything.

I would open one page. Not a platform, not a policy document. One page, machine-readable, in the repo or the ops database, with a row for every agent that can touch a repo, a browser, or a customer record. I would fill in four columns and stop.

A named owner. One person, not a team. If that person leaves, the row is an open ticket until someone else's name is on it.

The surfaces it reaches. Which repos, which accounts, which tables, which inboxes, which browsers. Write the actual names. "Production" is not a surface. orders is.

A kill path. The exact action that stops it, and who can take it. Revoke this token, disable this workflow, remove this app from the GitHub org. If the honest answer is "we would have to ask the person who set it up," that row is red.

A log the agent cannot rewrite. Where its actions land, and confirmation that the agent's own credentials cannot edit or delete that destination. This is the part almost everyone skips and the part the bill names explicitly. Append-only storage the agent cannot reach is a Saturday of work for most stacks.

Then I would do the thing that makes the page continuous: a check in CI, or a weekly job, that compares the page against reality. Every key in the secrets manager, every installed GitHub app, every OAuth grant on the workspace, every MCP server in the config. Anything that is not on the page is not a backlog item. It is a finding.

If you sell to the federal government, or to anyone who does, I would also flag agent security language to whoever reads your solicitations. The bill is not law. Procurement offices do not always wait for law.

None of this requires believing the Stop Rogue AI Act will pass. It requires believing that the question it asks is one you would rather answer on a quiet Sunday than during an incident review. This week the labs told us what they will gate. This bill is a reminder that the gate on your own side is the one you are responsible for, and most of us have not checked whether it exists.

If you want help building that page and the checks behind it, start a project conversation.

Sources: Congressman Mike Lawler, repost of Axios, "Exclusive: New bill cracks down on AI agents after Hugging Face breach" (September 3, 2026), Axios, "Exclusive: New bill cracks down on AI agents after Hugging Face breach" (September 3, 2026), AI2Work, "Stop Rogue AI Act Would Force Firms to Inventory Every AI Agent" (September 4, 2026), AI Weekly, "Stop Rogue AI Act Would Task NIST With Agent Security Rules" (September 5, 2026)