DCC summary, not a translation. This practice guide is copyrighted by the TC260 Secretariat. The structured summary below is DCC’s own paraphrase grounded in the published text; specific clauses should be checked against the guide.
Published by: Secretariat of the National Information Security Standardization Technical Committee (全国网络安全标准化技术委员会秘书处).
Document No.: TC260-PG-20266A. Version 1.0, July 2026. Drafters include CESI, CNCERT, Tsinghua, the Pujiang and Zhongguancun laboratories, the CAC Data and Technology Support Center, Zhejiang University, Alibaba Cloud, Huawei Cloud, Volcano Engine, Tencent Cloud, China Mobile and several security vendors.
Scope
The guide provides security guidance for deploying and using AI agents across five stages — assessment, preparation, deployment, use and decommissioning — and applies to preventing security risks in agent deployment and use, including as a reference when choosing commercial agent services. An agent (智能体) is an intelligent system with autonomous perception, memory, decision-making, interaction and execution; the guide specifically addresses large-model-based agents for personal-assistant scenarios that require users to grant relatively high permissions, generally as software. Tools are standardized interfaces that give the agent external capabilities, and skills are standardized instruction sets for specific tasks that package best practice, procedures and domain knowledge. Users should apply chapters 6–10, check against Annex A, harden where checks fail, and follow national and organizational rules; organizations should adopt the management measures in Annex B.
Key contents
Assessment (clause 6)
Define the purpose, business scenario and tasks and assess whether an agent is necessary and reasonable; understand the agent’s technical characteristics, capability boundaries and risks and the differences between open-source and commercial agents; choose carefully, preferably a packaged solution in which the provider supplies both the agent and matching security protection, and be cautious with open-source projects that lack protection (commercial users should read the provider’s security notices and check its features against the guide; open-source users must harden themselves). Do not select a project that has had no maintenance record for more than a month with unresolved security issues, whose public security issues have gone unanswered, that has unpatched high-severity vulnerabilities, or whose provider has announced end of maintenance. Prefer agents that integrate a security sandbox, high-risk operation controls, emergency stop and a recoverable file system; do not select agents lacking basic logging, auditing and permission management. Check for serious hazards such as automatic exposure of public-network interfaces or forced upload of runtime data.
Preparation (clause 7)
Installation materials: obtain installers and container images only from the provider’s official website, app stores or other channels with a clear responsible party and release mechanism — never modified, redistributed, cracked or unknown-origin packages from cloud drives, forums or chat groups; verify authenticity and integrity by signature, hash or checksum before installing.
Environment: for direct local deployment, use a dedicated device rather than a daily-use personal or work device, back up existing files, and clear or migrate sensitive data first; for virtual machines or containers, strictly isolate them (for example by barring access to host files) so problems cannot spread to the host; for cloud deployment, choose a platform with agent identity management, access control, logging and security alerting, and confirm with the provider that its capabilities meet the guide.
Large model: use only models that have completed generative-AI service filing; where data security or privacy requirements and the necessary computing capacity exist, prefer locally deployed models; call external model services only through the provider’s official interfaces, never through unknown relays or unauthorized proxies; and match the model’s context window, capability boundary and safety level to the task to avoid mis-operation.
Gap analysis: compare the agent’s and model’s existing security mechanisms with needs and, where deficient, add security tools or services for input–output content protection; behavior control (runtime monitoring, anomaly circuit-breaking); identity and credential management; supply-chain checks on skills and tools; interception and management of high-risk operations; sandbox-based isolation; and resource-consumption and cost control.
Deployment (clause 8)
Deploy per the provider’s official documentation or verified scripts, never unknown-origin one-click scripts. Check the reliability of any plugin before installing it and reject plugins of unknown origin, with unpatched high-severity vulnerabilities, with abnormal permission demands or unrelated to the task. Do not run the agent with operating-system administrator privileges; grant only the minimum permissions the task requires. Restrict accessible directories — no default access to the user’s home directory, system directories or other important locations; create a dedicated working directory and place only necessary files in it. Configure the agent and its services to be reachable only from the local machine; if internet access is genuinely needed, use encrypted access and restrict source addresses. Turn on logging for file operations, command execution, network activity and skill calls at the finest supported granularity. Pre-define a high-risk operation list managed through the agent’s security mechanisms with second confirmation or outright blocking — stopping or disabling system services, terminating processes, formatting or overwriting disks, bulk deletion, permission changes, key changes, opening ports, firewall-rule changes, system-setting changes, password-manager access and, depending on use, transfers, payments and other operations affecting personal property.
Use (clause 9)
Re-check installation and configuration: whether the user can see the agent’s execution status, manage its operations through allow and deny lists, and stop it quickly. Use skills from reliable sources, test them fully, and prepare for risk when using untested skills. When the agent is internet-connected, protect sensitive data: apply the minimum-necessary principle to personal information, be cautious with biometric and family-privacy data, never supply third parties’ personal information or sensitive data without their authorization, and never supply business data or IP-protected content the user is not licensed to use. Periodically review the necessity and security of any public-network interfaces and close unnecessary ones. Comply with cybersecurity law when using the agent to obtain online information services or take part in social-media discussion. Back up valuable data in the agent’s environment regularly. Manually review the contents of long-term memory files periodically, remove personal information, private data and internal information that should not be stored, and adjust the memory policy. Promptly withdraw sensitive permissions, clear unused skills and sensitive conversation records, and enable multi-factor authentication. Investigate and handle alerts from deployed security tools and re-check deployment against new threat intelligence. Follow the security bulletins of agent operators and security firms and upgrade, downgrade or pin versions as advised, avoiding long-term use of versions with known vulnerabilities or ended maintenance.
Decommissioning (clause 10)
Stop the main program and all associated services and background processes and confirm full exit. Back up session records, configuration files, knowledge-base files and logs that must be retained. Then clean the environment by deployment type: locally, use the official uninstaller and check for residual processes, ports and connections, or reset the operating system if there is no uninstaller; in the cloud, close public-network access, delete unused working files and the agent’s knowledge base, logs, long-term memory, plugin and skill configuration, and revoke API keys, service-account credentials and third-party authorizations; in virtualized environments, preferably retire the environment itself or otherwise clean it as for local deployment. After decommissioning, confirm termination of services, cancel subscriptions and auto-renewals, and watch for abnormal model-API charges.
Annexes
Annex A is a checklist of about thirty items across the five stages, each rated by importance (three stars for essentials such as choosing agents with built-in protection, obtaining installers from accountable channels, configuring network exposure and logging, securing skills and personal data, and lawful use; two stars for items such as maintenance checks, integrity verification, non-administrator operation, directory limits, high-risk lists, backups, memory review and bulletins).
Annex B gives organizational management guidance: an internal agent-use management system with prohibited conduct (for example, no connection of internal data or system interfaces to unapproved agents), use boundaries under least privilege, and an application–assessment–approval–filing process covering purpose, boundaries, planned skills and tools and safeguards; an agent asset register recording name, purpose and business owner, deployment location and identifiers, deployer and responsible person, model name, version and access method, installed skills and plugins, accessible internal systems and data, permission configuration and last security review; activity management through logging of high-privilege commands, sensitive-data access, internal-system access, outbound data transfer, permission changes, tool calls and anomalies, AI- or rule-based behavior risk analysis, and periodic log review; discovery of unapproved agents by scanning typical agent service ports, analyzing traffic for agent communication, identifying hosts talking to known model API endpoints and searching endpoints for agent processes, followed by isolation, privilege reduction or process blocking; and staff security education on prompt injection, supply-chain risk, credential and data leakage, unauthorized access and liability for misuse.
How it fits the regime
The guide arrives as the State Council’s Opinion on Standardized Application and Innovative Development of AI Agents and local programs such as Beijing’s agent measures push agents into enterprise and consumer use, and it supplies the security half of that agenda from the user’s side. It borrows the filing requirement from the Generative AI Interim Measures (only filed models may power an agent), reflects the risk taxonomy of the AI Safety Governance Framework 2.0, and translates personal-information minimization and third-party-data rules from the PIPL into concrete prompts about what to feed an agent. For multinational IT and security teams it functions as a de facto policy template: the Annex B register and approval process, the high-risk operation list and the shadow-agent discovery techniques map directly onto internal controls, and the July 2026 version number signals that TC260 expects to iterate as agent architectures change.