What happened
On 23 October 2026 three companion individual Internet-Drafts were submitted to the IETF BPM area by authors from China Mobile and Huawei (Yu Han, Meiling Chen, Qiguang Fan, Qin Wu): 'Benchmarking Terminology for AI Agent Security Evaluation' (draft-hcf-bpm-agent-security-benchmark-terminology-00, Informational, expires 26 Apr 2027) and 'Evaluation Profiles for AI Agent Security Assessment' (draft-hcf-bpm-agent-security-benchmark-profiles-00), plus a referenced methodology companion (draft-hcf-bpm-agent-security-benchmark-methodology). The terminology draft defines four first-level evaluation dimensions (Foundation Model Security, Interaction Security, Operational Security, Basic Security), 55 second-level security metrics, a common metric evaluation convention, and three agent security risk levels. The profiles draft fixes the System Under Test boundary and scenario for applying those metrics via four infrastructure profiles (foundation model, interaction access layer, execution/scheduling) and six scenario profiles, including profile composition rules and minimum logging fields.
Why it matters
This is an early attempt to standardise how AI agent security is benchmarked and evaluated. It establishes a shared vocabulary and a reproducible evaluation boundary/scenario scheme so that agent security results are comparable across vendors and deployments — a gap that NIST's AI Agent Security RFI, OWASP's agentic work, and MITRE ATLAS currently approach from different directions. As AI agents take on production actions, a common, quantifiable security metric set is foundational to assurance, procurement, and red-team reporting.
Action needed
Review the terminology and profiles drafts and the methodology companion; track or submit comments on the metric definitions and SUT-boundary/profile-composition rules if you benchmark agent security or plan to compare vendor agent-security results.