An agent incident may begin with a familiar alert: unusual data access, an external message, a privileged API call, or an unexpected configuration change. The difference is the investigation path. A single action can depend on a user task, retrieved material, tool descriptions, delegated work, policy decisions, and provider credentials spread across several systems.
The first objective is to stop further harmful effects while preserving enough evidence to determine what happened. Treat the agent as an executing workload with authority to contain, not merely a conversation to close. Ending the chat window may leave background jobs, refresh tokens, and downstream sessions active.
Establish what is known
Record the triggering observation and distinguish it from inference. A blocked export is an attempted action. A provider-confirmed export is an executed action. An alert that a response contains sensitive text may not establish that the response left the protected environment. Preserve these distinctions in the initial incident statement.
Identify the organization, workload, human initiator where known, session, connection, destination, and time window. Use provider request identifiers and authenticated identities to correlate events. A model-generated summary is useful for navigation but should not replace original event records.
NIST SP 800-61 Rev. 3 places incident response within broader cybersecurity risk management [1]. The agent-specific runbook below is an operational application of that principle, not a separate incident-response standard or a claim of regulatory compliance.
Contain authority on every active path
Disable the workload's ability to start fresh actions. Revoke or suspend runtime credentials, remove connection grants, cancel queued work, and invalidate pending approvals or permits where supported. If the provider token was exposed or can be used outside the mediated path, revoke or rotate it at the provider.
Scope containment to the evidence and consequence. A compromised shared connection can affect several agents; a single poisoned document may affect many sessions. Conversely, stopping an entire organization when one isolated workflow is involved can cause unnecessary damage. Record the reason and expected effect of each containment action.
Test the result. Attempt a controlled request through the suspected route and relevant alternatives. Confirm that no fresh downstream effect occurs. Separate successful containment from the recovery of actions already accepted by an external service, which may require a provider-specific cancellation or reversal.
| Evidence | Investigative question | Handling |
|---|---|---|
| Original task and source records | What was actually requested? | Preserve origin and timestamps |
| Tool calls and policy revisions | What authority was evaluated? | Keep normalized arguments and decision IDs |
| Provider audit and request IDs | What actually executed? | Reconcile uncertain outcomes |
| Memory and configuration changes | Can the behavior recur? | Snapshot before remediation |
Preserve evidence without spreading the exposure
Snapshot relevant configuration, policy revisions, connection mappings, tool metadata, and memory records. Preserve the original suspicious content and its source identifier. Store sensitive payloads in a restricted evidence location, with access logging and retention appropriate to the investigation.
Avoid pasting complete prompts, credentials, or customer records into broadly visible tickets. Use masked excerpts, hashes, and protected references where possible. Evidence collection can create a second disclosure if the incident tooling has weaker access controls than the affected system.
Record collection times, clock assumptions, and known gaps. A transcript may omit hidden retries or asynchronous provider work. A gateway may see only routed traffic. A missing event should remain a visibility gap until another source establishes whether the action occurred.
Reconstruct the causal path
Build a sequence from initial input to observed effect. Identify which content the agent encountered, which tool it selected, how arguments were formed, what policy was applied, and what the provider accepted. Include delegation and background jobs rather than assuming a session is a single linear conversation.
Investigate both malicious influence and ordinary configuration failure. A broad grant, wrong tenant binding, stale permission cache, or retry bug may explain the event without a prompt injection. The presence of suspicious text is not by itself proof that the text caused the downstream action.
Where causal attribution is uncertain, replay a minimized synthetic version in an isolated environment. Compare behavior with and without the suspected input while holding the rest of the configuration stable. Preserve the distinction between a plausible reproduction and proof of the exact production sequence.
Determine the blast radius from resources
Enumerate the credentials and connections available to the workload during the affected window. Check downstream audit records for actions beyond the first alert. Follow shared memory, shared retrieval corpora, and delegated agents that may have carried the same untrusted material into later sessions.
For disclosure, identify the data actually accessed, the data confirmed at the destination, and the data that remains potentially exposed. For mutations, reconcile the changed objects against authoritative provider state. Do not infer a full database compromise from one attempted query, or dismiss an uncertain export because the model later refused to discuss it.
Track business impact with the relevant owners. Security can establish technical effects while legal, privacy, customer operations, and service owners assess obligations and recovery. Use established organizational processes rather than inventing notification thresholds inside the agent runbook.
Restore service with a tested boundary
Remove or quarantine the triggering artifact where justified, but also fix the authority failure that allowed the effect. A cleaner prompt alone is insufficient when the agent still holds a credential that can export everything. Reduce grants, repair resource checks, close bypass paths, and correct retry or approval binding defects.
Restore a limited workflow first. Run legitimate tasks and the incident's regression case with synthetic data. Confirm both task completion and denial of the harmful effect. Document residual uncertainty and the monitoring needed during the return to service.
Close the incident only when the team can explain the evidence, containment, downstream outcome, and verified change. Convert the failure into a durable regression test and a specific ownership improvement. The value of the investigation is the narrower, more observable execution boundary left behind.