Every AI Policy Ever · open in the interactive register

Published (non-binding, current)Non-binding · Guidelines / framework

Cybersecurity Standard Practice Guide — Security Guidelines for the Deployment and Use of Agents

网络安全标准实践指南——智能体部署使用安全指引

Record CN-26 · TC260-PG-20266A

Issued by
National Cybersecurity Standardization Technical Committee (TC260) Secretariat
Jurisdiction
China
Level · region
National · East Asia
Published / adopted
2026-07-01
Language
Chinese
Official identifier
TC260-PG-20266A

Summary

TC260 practice guide on the security of deploying and using agents: large-model-based AI agents for personal-assistant use that need high user permissions. For the assessment, preparation, deployment, use and decommissioning stages it advises against unmaintained projects and agents that open public interfaces automatically, and calls for installation materials from official channels, a separate device or isolated environment, large models that have completed generative AI service filing, no administrator rights, limited directories and network exposure, full logging, a high-risk operations list with second confirmation or blocking, and emergency stop.

Language

No English version of this instrument was found. The English title and the summary are the register's own, written from the sources below; for the exact wording use the Chinese text.

Safety topics

human oversightgeneral-purpose / frontier AI

Status notes

Version v1.0-202607, released with notice 网安秘字〔2026〕80号 of 1 July 2026. It can also guide the choice of commercial agent services. High-risk operations include stopping system services, formatting disks, bulk deletion, changing permissions, keys or firewall rules and accessing password managers, and may include transfers and payments. Annex A is a security checklist; Annex B gives organisations management guidance: an internal agent-use policy with prohibited behaviour and approval steps, an agent asset register, logging and risk analysis of agent activity, and discovery of unapproved agents on internal networks.

Sources

Open the official source https://www.tc260.org.cn/tc260/sjzn/202608/67702dcf57214da792499be8518446dc/files/f3be1cc4d35d428c98a9f5d197c963ac.pdf

Secondary source: https://www.tc260.org.cn/tc260/tzgg/202607/98b6f259f8a3428b8fe1cfea3c0fb19e.shtml

Local copy

Archived. The secondary source is a bot-check or empty page (The page has very little readable text (599 characters); it probably needs JavaScript). Last attempt 2026-10-18 00:45:31 UTC

Official source (third-party copy, not published) archive/_runs/2026-10-14-discover-leads-2026-10-14/C010/2026-10-14/official.pdf
Retrieved 2026-10-14 13:10:56 UTC
SHA-256 11124dbe739eebd438a6ed5e9b612fae599aa116d74ceab05a9d1c426f101ec4
Secondary source (third-party copy, not published) archive/CN-26/2026-10-18/secondary.html
Retrieved 2026-10-18 00:13:39 UTC
SHA-256 546455bcabe776d8ad12c143718a41f066014fc4c1b9b5d5ac90dec854f07c37

Warning: The page has very little readable text (599 characters); it probably needs JavaScript

Verification

B
Another official source, such as an announcement by the issuer, confirms the title, date and status. checked 2026-10-18 · alternative-official-url-fetched
Recheck of 18 Oct 2026. Read the guide's PDF from tc260.org.cn (version v1.0-202607; stored 14 Oct 2026, and identical when fetched again on 18 Oct 2026) and TC260's release notice 网安秘字〔2026〕80号 (tc260.org.cn, stored 18 Oct 2026 as the record's secondary source). The PDF confirms the title, the number TC260-PG-20266A, the TC260 Secretariat as issuer, the version and the contents; its cover gives only July 2026 (2026年7月), and the day, 1 July 2026, comes from the notice. The archiver flags the notice copy because the page has little readable text; the notice text itself is complete. The summary follows the Chinese text. No English version was found; the guide's statement reserves translation to the TC260 Secretariat's written authorisation.
Second check: Independent check by Claude Code (claude-sonnet-5-5), 2026-10-18: 7 field(s) supported.

History

  1. 2026-10-18related: [{"id": "CN-27", "slug": "tc260-pg-20267a-security-guide-for-individual-ai-users → [{"id": "CN-27", "slug": "tc260-pg-20267a-security-guide-for-individual-ai-users — two-way link added: CN-19 link(s) to CN-262026-10-18-fix-related-links · Claude Code (claude-opus-5-5)
  2. 2026-10-18verification.level: A → B — level computed from the evidence by tools/pipeline.py2026-10-18-recheck-east-asia-1 · Claude Code (claude-opus-5-5)
  3. 2026-10-14related: [] → [{"id": "CN-27", "slug": "tc260-pg-20267a-security-guide-for-individual-ai-users — TC260 practice guides of one series or referring to each other, as the checker of run 2026-10-14-discover-leads-2026-10-14 named them (checks/C003.json; C011's own text refers to TC260-PG-20266A)2026-10-14-discover-leads-2026-10-14 · Claude Code (claude-opus-5-5)
  4. 2026-10-14Added to the register — found in pipeline run 2026-10-14-discover-leads-2026-10-14, candidate C010 (CN/ministries)2026-10-14-discover-leads-2026-10-14 · Claude Code (claude-opus-5-5)

Related records

TC260-PG-20267A (security guide for individual AI users) China · Published (non-binding, current)

TC260 draft guide on agentic AI system development security China · Draft / proposed

Citation

National Cybersecurity Standardization Technical Committee (TC260) Secretariat. Cybersecurity Standard Practice Guide — Security Guidelines for the Deployment and Use of Agents [TC260-PG-20266A]. 2026-07-01. https://www.tc260.org.cn/tc260/sjzn/202608/67702dcf57214da792499be8518446dc/files/f3be1cc4d35d428c98a9f5d197c963ac.pdf. Status: Published (non-binding, current); verified 2026-10-18 (level B). Local copy archive/_runs/2026-10-14-discover-leads-2026-10-14/C010/2026-10-14/official.pdf retrieved 2026-10-14 13:10:56 UTC, SHA-256 11124dbe739eebd438a6ed5e9b612fae599aa116d74ceab05a9d1c426f101ec4. Every AI Policy Ever, version 1.18 (snapshot 2026-10-18), record CN-26.

Improve this record

Know of an amendment, a status change or an error? Report news or an error on GitHub; the form opens with this record filled in.