iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If an AI agent may be acting maliciously or outside its intended authority, contain it through the systems that control its execution and access—not by asking the model to stop. Escalate through your incident-response process, limit the agent’s ability to act, preserve evidence of what it received and did, and investigate the identities, tools, data, and downstream systems involved. The right sequence and scope depend on the agent’s architecture; there is no universal hour-by-hour playbook.
What counts as an AI agent security incident?
An agent incident can affect more than a model or chat transcript. Agents may interpret inputs, call tools, use memory, and trigger actions in connected systems. A malicious prompt, unsafe tool use, compromised dependency, or poisoned memory can therefore lead to data exposure, unauthorized changes, deletion, financial actions, or activity that propagates through a workflow.
Start with the connected system: identify the agent’s runtime and owner, its identities and permissions, the tools it can invoke, the data it can reach, and the systems or people affected by its outputs. OWASP’s AI Agent Security Cheat Sheet describes risks including prompt injection, tool abuse, data exfiltration, memory poisoning, unauthorized actions, cascading behavior, and cost abuse. An unusual response or suspected prompt injection is a reason to investigate, not by itself proof of a particular level of impact.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhat should happen first?
Use your established security incident escalation path. Appoint an incident lead, involve the system owner and the teams responsible for identity, infrastructure, and affected services, and establish who has authority to suspend execution and revoke access. Preserve a record of key decisions and the people making them.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Identify the system: Record the agent, environment, owner, relevant workflows, and known integrations. Determine whether it is still running, whether other agents or shared services depend on it, and which human or service identities are involved.
- Assess immediate exposure: Look for evidence of ongoing tool calls, access to sensitive data, write or delete actions, external communications, administrative changes, or unusual resource use. Use the available telemetry; do not assume that a normal-looking conversation means no action occurred.
- Find the control points: Determine which orchestrator, runtime, identity provider, network layer, or downstream service can pause execution or restrict access. The available controls differ by architecture; a platform may not have one universal kill switch.
- Declare and coordinate: Follow your organization’s incident classification and escalation process, and bring in legal, privacy, compliance, or business owners when the facts warrant it.
OWASP’s GenAI Incident Response Guide 1.0, published July 28, 2025, recommends AI-specific procedures, clear roles and decision points, familiarity with system architecture and logging, evidence checklists, exercises, and preparation for legal and reporting scenarios. NIST SP 800-61 Rev. 3, published in April 2025, places incident response within cybersecurity risk management under CSF 2.0 and supersedes Rev. 2. Use those frameworks as a foundation, then make the runbook specific to your deployment.
How should you contain the agent?
Make containment effective outside the agent’s own decision process. A new instruction to the model is not a reliable way to revoke a token, disable a tool, or prevent a downstream service from accepting an action.
- Limit execution: Pause, stop, or isolate the suspected workflow through the controls available in its orchestrator, runtime, infrastructure, or network. If a shared platform cannot safely be stopped in full, isolate the affected session, identity, or workflow while assessing whether broader containment is needed.
- Revoke authority: Revoke or suspend agent identities, tokens, grants, and other credentials that may be compromised. Disable or narrow risky tool interfaces and downstream access. Enforce authorization in the downstream systems rather than relying on model output to decide whether an action is permitted.
- Rotate exposed secrets: Rotate secrets that interacted with the compromised workflow or may have been exposed. Coordinate revocation and rotation with evidence preservation: capture necessary records first where that can be done safely, but do not leave a live credential available just to preserve logs.
- Limit further harm: Quarantine suspect artifacts where relevant, and apply service-side controls to prevent additional actions. Rate limits, approvals for high-impact operations, and least-privilege access can reduce risk, but they do not replace incident-specific containment.
Choose the scope based on what is still happening and what the agent could do. An affected session with read-only access may call for a narrower response than a shared identity that can modify records or trigger actions across a multi-agent workflow. OWASP’s LLM06:2025 Excessive Agency guidance emphasizes least privilege, downstream authorization, approval for high-impact actions, monitoring, and rate limiting.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do you decide how broadly to contain?
Containment is a trade-off between stopping harm and avoiding unnecessary disruption. Use these questions to make the decision; they are practical decision aids, not an official severity matrix.
| Question | What to establish | How it affects containment |
|---|---|---|
| Is harm continuing? | Whether tool calls, data access, external messages, or resource use are still occurring. | Ongoing activity may require immediate suspension or broader isolation; if activity has stopped, preserve evidence and investigate residual access. |
| What scope is affected? | Whether the issue is limited to one session, or involves a shared identity, multi-agent workflow, or platform. | Broader shared access may require suspending more than one workflow while responders identify the boundary. |
| What actions were possible? | Whether access was read-only or allowed writes, deletion, financial activity, administrative changes, or externally visible actions. | Greater potential impact supports tighter restrictions and closer review of downstream effects. |
| Did the activity create downstream effects? | Whether it produced artifacts, changed records, or affected dependent systems or consumers. | Containment may need to include affected services and artifacts, not just the agent runtime. |
| What evidence is at risk? | Which logs or records may expire or change, and whether a credential remains usable. | Preserve volatile evidence where safe, but do not delay revoking access that could enable continuing harm. |
What evidence and logs should you preserve?
Establish the likely time window, then trace activity across the identities, sessions, tools, and services involved. Preserve original records where possible, protect them from routine expiry or alteration, and document collection and handling. The exact evidence set depends on the system design and the type of incident.
- Agent interaction: Prompts and other inputs, model responses, relevant conversation or workflow context, and the timestamps and identifiers needed to connect them.
- Identity and execution: Agent and human principals, sessions, token or grant activity, runtime and orchestrator audit records, and available execution or network logs.
- Tools and data: Tool invocations and results, data or resources accessed, permission decisions, and records from the downstream systems that received actions.
- Effects and artifacts: Files, messages, code, configuration changes, transactions, or other outputs produced or changed during the suspected run; include relevant records from dependent systems.
- System context: Architecture and integration details, logging configuration, relevant policies, and component or dependency information needed to interpret the activity.
- Learning-related evidence: If training data or continual learning may be involved, preserve the relevant data and a model snapshot where appropriate. OWASP’s guide identifies training data and snapshots of continuously learning models as examples to secure and evaluate when relevant.
Coordinate evidence capture with containment so responders do not inadvertently overwrite records or introduce exposed credentials into new logs. Do not delay urgent access revocation merely to collect a complete record.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How should you investigate impact and remove the cause?
Use the preserved activity trail to separate what the agent was asked to do, what it actually did, and what connected systems accepted. Identify the initiating input or change where possible, but do not assume that a prompt alone explains the event: permissions, tool design, dependencies, memory, and downstream controls can all contribute.
Recommended Free Tools
- Reconstruct the activity: Correlate agent identity, human principal, session or workflow, tool invocation, data access, and downstream action wherever telemetry supports it.
- Map the impact: Determine which information was exposed, which records or systems changed, whether external parties received outputs, and whether other agents or consumers used affected artifacts.
- Remove the cause: Remove malicious configuration, unauthorized persistence, compromised extensions or dependencies, and affected credentials as applicable. Restrict the capability that enabled the incident before restoring normal operation.
- Handle affected outputs: Assess whether artifacts or downstream changes should be quarantined, recalled, corrected, or rebuilt. Confirm that dependent systems are not continuing to rely on a suspect output.
- Verify the recovery conditions: Check that credentials, policies, integrations, and relevant components are trustworthy and that the agent’s permissions are appropriately limited before restoring access.
OWASP AISVS 1.0 Appendix C describes controls for compromise in AI-in-pipeline workflows, including credential revocation, secret rotation, artifact quarantine, evidence preservation, provenance tracing, and exercises. Those controls are particularly explicit for AI-in-pipeline incidents; they should not be treated as a complete universal playbook for every agent deployment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Who should be notified, and when?
Use your organization’s escalation procedures for legal, privacy, customer, and regulator notification. Whether notice is required, whom to notify, and the deadline depend on the incident facts and applicable jurisdiction. Neither OWASP’s guide nor AISVS establishes a universal notification deadline. Ask your organization’s legal and compliance teams to assess the specific event rather than assuming one timeline applies everywhere.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should change after the first day?
Update the incident record with the timeline, scope, containment decisions, evidence sources, impact findings, and unresolved questions. Use the response to improve the system-specific runbook: clarify who can suspend execution and revoke access, where relevant logs live, how evidence is preserved, and how downstream effects are traced. Rehearse the revised procedures, including legal and reporting scenarios, so teams can make decisions under pressure.
CISA and its partners’ May 1, 2026 guidance on careful adoption of agentic AI services emphasizes autonomy limits, strong identity, layered defenses, oversight, threat modeling, monitoring, and assessment. These are adoption and risk-management principles, not a prescribed first-day incident schedule.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
