AI agent incident response

When an AI agent incident occurs, you need a structured response. An agent that sent an unauthorized email, exfiltrated data, or executed a destructive command requires fast action. This guide covers the response process.

Phase 1: Detection

An incident is detected through:

• Sentinel anomaly alert
• Manual observation by an operator
• User report ("the agent did something unexpected")
• Downstream system alert (unusual API calls, failed transactions)
• Receipt chain audit (discovered during routine review)

Phase 2: Containment

Stop the damage from spreading:

1. Kill the session: Trigger the kill switch for the affected agent session
2. Revoke credentials: Rotate the agent's API keys, tokens, and database credentials
3. Isolate the agent: If running as a service, stop the agent process
4. Notify affected parties: Alert users whose data may have been impacted
5. Preserve evidence: Lock the receipt chain and logs for investigation

# Kill the session
curl -X POST https://control-plane/api/sessions/sess_abc123/kill \
  -H "Authorization: Bearer ${ADMIN_API_KEY}"

# Lock receipts for investigation
curl -X POST https://control-plane/api/receipts/lock \
  -d '{"sessionId": "sess_abc123", "reason": "Incident investigation"}'

Phase 3: Investigation

Analyze the receipt chain to understand what happened:

1. Timeline: Walk the receipt chain chronologically. When did the agent's behavior change?
2. Root cause: What triggered the change? A prompt injection? A compromised tool? A policy gap?
3. Impact assessment: What actions did the agent take after the trigger? What data was accessed or sent?
4. Blast radius: Did the incident affect other agents or systems?

# Export receipts for the session
curl https://control-plane/api/receipts?session_id=sess_abc123 > incident-receipts.json

# Verify chain integrity (was the audit trail tampered with?)
curl https://control-plane/api/receipts/verify?session_id=sess_abc123

Phase 4: Remediation

Fix the underlying vulnerability:

• If prompt injection: update Aegis patterns, add scanning to the exploited input path
• If policy gap: add missing rules, test with shadow evaluation
• If tool misuse: tighten argument restrictions
• If credential compromise: rotate all credentials, implement shorter-lived tokens
• If multi-agent propagation: add inter-agent scanning

Phase 5: Recovery

Restore normal operation:

1. Deploy the updated policy
2. Verify the fix with testing
3. Restart the agent with fresh credentials
4. Monitor closely for recurrence (lower Sentinel thresholds temporarily)

Post-incident review

After every significant incident:

• Document the timeline, root cause, and remediation
• Identify what the detection and response system missed
• Update the incident response playbook
• Share findings with the team (blameless post-mortem)