If an AI agent takes an unintended action, first stop further effects with the safest available control, preserve logs and system state, and identify what the agent touched. Then coordinate containment, recovery, escalation, and any notifications with the people responsible for the affected systems. The right response depends on whether the action is still running, whether it reached an external system, and whether sensitive information may have been exposed.
First determine whether harm is continuing
Check whether the agent is still acting, whether a tool call is in flight, and whether the action has already affected another system. An agent’s unintended action can result from model error, ambiguous instructions, or direct or indirect prompt injection; broad permissions, many connected tools, and high autonomy can increase the potential impact. OWASP describes these risks in its AI Agent Security Cheat Sheet.
![Claude AI for Beginners Bible: [5 in 1] The Ultimate Guide to Automate Your Work, Save Hours Every Week, and Use AI for Real-World Results](https://m.media-amazon.com/images/I/415+fSJacsL._SL160_.jpg)
If there is credible ongoing harm or compromise, use the control designed for that component and business function. Depending on the situation, that could mean stopping the workflow, suspending the session, restricting a tool, or switching to human review or reduced functionality. Do not assume that killing the agent is always safest: a stop or isolation action can disrupt a service or leave downstream work in an inconsistent state. Choose the preplanned control that limits harm without creating a worse operational failure. OWASP’s Agentic Skills incident response guidance and an AWS incident-response presentation hosted by NIST both emphasize situational response rather than a single universal stop procedure.
Preserve evidence before cleanup or restart
When feasible, retain relevant logs and system state before restarting, deleting, or rolling back anything. Record the agent and session identity, timestamps, tool calls, targets, parameters, results, approvals, and affected resources when those details are available. Capture the observed inputs, outputs, and actions so the investigation can reconstruct what happened.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11#1 Best Overall
A model-generated explanation of why it acted is not proof of its internal intent. Treat it as one piece of context, not a substitute for tool logs and system records. OWASP recommends preserving tamper-evident evidence and maintaining chain of custody; AWS recommends mapping available logs to investigation questions and business functions. See the OWASP incident response playbook and the AWS presentation hosted by NIST.
Establish what the agent touched
Trace the action through the agent’s connected systems rather than looking only at the chat or agent interface. Identify completed and in-flight actions, resources changed, credentials or permissions used, and possible follow-on activity. Check for data exposure, account or configuration changes, external messages or publication, financial actions, deletions, and cascading effects. The relevant systems and checks depend on the integrations in use.
Robert Saul, General Manager of the AWS Customer Incident Response Team, put the governance issue this way in the AWS presentation hosted by NIST: “If you can’t describe its identities, its data flows, and its failure modes right now, you don’t have governance over it.” The presentation is conference guidance, not a NIST standard.
Choose containment and recovery with system owners
Stopping an agent, revoking a credential, disabling a tool, isolating a component, rolling back a model or data state, restoring a resource, and switching to a fallback are different interventions. Before choosing one, assess whether the action is ongoing, what the control actually stops, whether it can be reversed, what it could disrupt, whether it preserves evidence, and who can authorize the operational cost.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Response option | What it may limit | Trade-off to check |
|---|---|---|
| Stop or suspend the workflow | Further actions by the active agent or session | May interrupt dependent work or leave downstream state incomplete; confirm whether tool calls already in flight continue. |
| Restrict or disable a tool, or revoke access | Use of a particular integration, permission, or credential | May affect other workflows sharing that tool or credential; confirm the scope and authorization to make the change. |
| Isolate or disable a component | Communication or activity from an affected service or system | Can disrupt dependent services; determine whether isolation protects evidence and whether owners approve the outage. |
| Roll back or restore affected state | Some changes already made to a model, dataset, or resource | May be irreversible or overwrite useful evidence; establish what changed and verify the recovery point before proceeding. |
| Switch to a fallback or human-reviewed mode | Autonomous operation while preserving a controlled service path | Requires a workable fallback and clear approval boundaries; check whether the fallback still has access to affected systems. |
These are options, not universal instructions. Involve the owners of the agent, credentials, tools, and affected systems to decide which consequences are acceptable. AWS recommends preparing component-level decision trees that connect containment choices and their costs to business functions.
Escalate and communicate according to impact
Use your organization’s incident process and bring in the teams relevant to the facts: typically security, operations, and system owners, with privacy, legal, compliance, supplier, or communications teams involved as warranted. Consider whether users or other affected people need notification if a system may be compromised or sensitive information may have been exposed. The responsible organization should assess applicable duties in light of the data, impact, and jurisdiction; no single notification rule applies to every agent incident.
Rank #4
Fix the control weakness before restoring autonomy
Review how the action became possible. Possible causes include excessive permissions or functionality, unexpected or manipulated input, missing approval, a compromised tool, or another failure. Correct the relevant weakness and review the incident before re-enabling the affected capability.
- Grant only the permissions and tool access the agent needs, scoped as narrowly as practical.
- Enforce authorization in the downstream system rather than asking the model to decide whether an action is allowed. OWASP’s guidance is explicit: “Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not.” See OWASP Excessive Agency guidance.
- Require human approval for high-impact actions and ensure the approval applies to the specific action being taken.
- Improve logging and monitoring so identities, data flows, tool use, and outcomes can be reconstructed.
- Re-enable autonomy only after the responsible owners have reviewed the incident and verified the revised controls.
OWASP’s incident-response playbook addresses skill-security incidents, so its workflow is useful structure, not a universal service-level commitment or response-time target. Exact stop controls, credential actions, restoration steps, and reporting duties depend on the platform, connected services, affected data, and jurisdiction.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
