iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Contain first. As soon as an AI agent may be compromised, freeze the agent or workflow, block its identity, and revoke active credentials. Then preserve evidence, inventory every secret and trust grant the run could reach, issue least-privilege replacements through a controlled issuer, and investigate audit logs from the earliest possible exposure. Do not wait for a complete forensic explanation before cutting access.
What to revoke first
Start with the credentials that can still be used right now and the identity that can mint or obtain more credentials. In practice, the first actions are:
- Freeze the agent, connector, workflow, runner, or deployment suspected of compromise. Stop scheduled runs and disable automated retries so the incident does not continue while you investigate.
- Block the agent principal. Disable its service account or apply an IAM deny policy to that principal. If the platform supports it, preserve the identity in a disabled state rather than deleting it; investigators can then correlate historical events to the same principal.
- Revoke immediately usable tokens and keys. Revoke API keys, OAuth access and refresh tokens, GitHub App credentials, OIDC trust grants, cloud access keys, package-registry tokens, signing keys, and model-provider keys associated with the agent or affected run.
- Preserve volatile evidence before cleanup. Export prompts, model responses, tool-call records, shell history, environment snapshots, workflow logs, deployment records, and provider audit events. Record the suspected exposure time and the exact credential identifiers.
NIST’s authenticator guidance requires a cloud service provider to “suspend, invalidate, or destroy compromised authenticators from the subscriber’s account promptly following compromise detection.” OWASP’s incident-response guidance likewise says to “revoke or rotate the credential immediately.” Those are containment requirements, not steps to postpone until attribution is certain.
Why an AI agent needs a wider revocation plan
An agent rarely uses one secret in isolation. A single task can pass from a model provider to a tool connector, source-control application, CI runner, cloud role, package registry, and deployment system. Prompts and traces can also contain credentials that were never intended to leave a runtime. Rotating only the key named in an alert therefore leaves alternate paths open.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Inventory both credentials and trust relationships. A credential is something that authenticates directly; a trust grant may let a principal exchange a token, impersonate a service account, install an application, or create another identity.
| Surface | What to check | Typical containment action |
|---|---|---|
| Agent and runtime | Environment variables, mounted files, .env files, shell history, tool arguments, prompts, traces, logs, caches, and agent memory or state |
Freeze the runtime, preserve copies for evidence, remove secrets, and revoke every exposed value |
| Cloud IAM | Service-account keys, role bindings, token-creator permissions, workload-identity federation, newly created principals, and access policies | Deny the suspect principal, disable or revoke keys, remove unexpected bindings, and investigate token minting |
| Source control | App installations, OAuth grants, deploy keys, webhook secrets, repository tokens, and changed workflows | Suspend the app or grant, rotate repository secrets, remove unauthorized keys, and review commits and workflow edits |
| CI/CD and build systems | Project variables, workflow artifacts, caches, build logs, runner tokens, deployment manifests, and container layers | Stop affected jobs, revoke runner and deployment credentials, quarantine artifacts, and rebuild from a known-good revision |
| Registries and signing | Package-publishing tokens, image-registry credentials, code-signing keys, and provenance records | Revoke publishing and signing access, inspect published artifacts, and invalidate or replace compromised signatures where supported |
| External and model services | Model-provider keys, SaaS API keys, OAuth refresh tokens, connector credentials, and downstream webhooks | Revoke tokens at each issuer and notify owners of downstream systems that may have accepted the credential |
Step 1: Declare and contain the incident
Freeze execution without destroying evidence
Disable the trigger that can launch the agent: a queue consumer, schedule, webhook, pull-request workflow, or human approval automation. Isolate the runner or container from outbound access if your response plan allows it, but first capture volatile records that disappear on shutdown. Preserve the original timestamps and use a tamper-evident location for exported logs.
Disable or deny the identity
Choose the narrowest control that stops use while retaining investigative value. A disabled service account or explicit deny policy usually gives responders a stable principal to search for in audit logs. If a provider cannot suspend an identity, revoke all of its active sessions and credentials, remove its role bindings, and block the workload, network path, or connector that can authenticate as it.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Revoke token classes, not just one string
Revoke access and refresh tokens separately where the issuer distinguishes them. A stolen refresh token can mint new access tokens after an access token expires. Revoke application installations and OIDC trust grants that can obtain replacement tokens, not merely the token already seen in a log. Include model-provider keys and signing credentials even when the suspicious activity occurred in a different system; the same run may have exposed them.
Step 2: Build a credential and trust inventory
Create one record for every credential, grant, and copy. Assign an owner who can revoke it and record the exact method, because responders should not have to rediscover provider-specific controls during an incident.
| Inventory field | Why it matters |
|---|---|
| Credential or grant identifier | Prevents a broad label such as “deployment key” from hiding multiple keys or installations |
| Issuer and principal | Identifies where revocation occurs and which identity appears in audit logs |
| Privilege and resources | Defines the possible blast radius and whether a replacement can be narrower |
| Environment and location | Lists regions, services, jobs, files, images, caches, logs, and prompts containing a copy |
| Last-seen use and exposure time | Sets the start time for log queries and helps distinguish pre-incident activity |
| Expiration and lifetime | Shows whether a token may still work and whether waiting for expiry is safe |
| Replacement owner and revocation method | Turns the inventory into an executable response checklist |
Search the agent’s complete data path
- Inspect environment variables, mounted volumes, temporary files, shell history, command arguments, prompts, tool payloads, traces, debug output, and persistent agent state.
- Search CI/CD variables, artifacts, caches, build logs, deployment manifests, container layers, package registries, and signing systems.
- Review cloud service accounts, access keys, role bindings, workload-identity federation, token-creator permissions, and principals created during the run.
- Check source-control applications, OAuth grants, deploy keys, webhook secrets, repository variables, and workflow files changed by the agent.
- Ask each downstream system owner whether the workflow used a shared credential or a credential copied into another service.
OWASP’s AI-agent guidance recommends a dedicated agent identity, scoped short-lived tokens, and no long-lived production credentials in the environment, prompts, or configuration files. Treat any secret appearing in a prompt, response, trace, or log as exposed even if there is no proof that an attacker read it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Step 3: Issue and deploy replacements safely
Choose the replacement type
| Credential approach | Revocation speed | Lifetime and scope | Auditability and effort |
|---|---|---|---|
| OIDC or workload identity | Usually centralized; revoke the trust relationship or principal | Short-lived and task-scoped when configured correctly | Strong issuer and subject attribution; requires provider integration |
| Secrets-manager-issued dynamic secret | Central policy can revoke or expire leases | Short lease with automatic renewal controls | Good access records; requires a secrets platform and rotation integration |
| Static API key | Depends on the provider’s disable and delete controls | Often long-lived unless an expiration is configured | Simple to deploy but larger blast radius and more copy locations |
| Cloud service-account key file | Disable, then delete at the issuer | May remain valid until disabled or deleted | High operational risk if copied into images, runners, or repositories |
Prefer OIDC or workload identity and a secrets manager over static keys. Separate read-only and write-capable identities, keep agents out of administrative roles, and set the shortest practical lifetime for the task.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsUse a controlled rotation sequence
- Create a replacement through the authoritative issuer with only the permissions the job actually needs. Give it a distinct identifier so logs cannot be confused with the exposed credential.
- Store it in the approved secrets manager or workload-identity configuration. Do not paste it into source code, prompts, tickets, images, or a shell command that will be logged.
- Deploy it to every service, job, region, runner, and connector that used the old value. Search configuration and templates for missed copies before testing.
- Run authentication and authorization checks, health checks, representative read and write operations, and rollback checks. Confirm that the new identity cannot perform unrelated administrative actions.
- Disable the old credential while watching dependent services for authentication failures. This overlap window verifies that all consumers have moved without leaving the old key usable indefinitely.
- Delete or permanently revoke the old credential after dependencies are confirmed. Remove copies from code, logs, images, caches, artifacts, and agent state, then verify that searches no longer find it.
Google Cloud service-account key sequence
For a Google Cloud service account, the documented safe order is to create and deploy a new key, disable the old key to verify that the new one works, delete the old key, revoke token-creator permissions if abuse is possible, and wait for already issued tokens to expire before re-enabling a service account that was disabled. Apply the same principle elsewhere: test the replacement while the old credential is disabled, and account for tokens that remain valid after a key is removed.
Step 4: Scope the blast radius in audit logs
Query every issuer from the earliest plausible exposure time, not merely from the first alert. Search by credential identifier, principal, app installation, source IP or region, user agent, and resource. Preserve the raw events and the query definition so another responder can reproduce the result.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Authentication: token exchanges, refreshes, failed logins, unusual regions, IP addresses, devices, and session creation.
- Privilege: new role bindings, policy changes, token-creator calls, service-account impersonation, and newly created users, keys, or applications.
- Data: reads, exports, downloads, repository clones, database queries, object-list operations, and access to sensitive prompts or files.
- Persistence: modified workflows, scheduled jobs, webhooks, startup scripts, new runners, cloud functions, keys, package releases, and altered deployment manifests.
- Resources: newly created compute, storage, networks, containers, repositories, packages, or billing-impacting services.
- Downstream effects: artifacts, pull requests, releases, messages, emails, or configuration changes produced under the suspect identity.
Use build provenance or an AI bill of materials to identify artifacts produced by the agent during the exposure window. Quarantine anything that may contain malicious code, poisoned dependencies, unauthorized configuration, or leaked data. Notify downstream consumers when an artifact or credential they received may be affected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Step 5: Eradicate exposure and recover
Remove every stored copy
Delete secrets from repositories, container layers, build caches, logs, traces, tickets, notebooks, prompt histories, and agent memory. Rewriting a repository does not revoke a value already present in a clone or artifact, so complete the issuer-side revocation even after cleanup.
Recommended Free Tools
Rebuild from a known-good source
Quarantine affected runners and images. Rebuild from a verified commit or base image, regenerate dependencies where necessary, and redeploy with the replacement identity. Compare the resulting configuration with the approved manifest rather than trusting a potentially modified workspace.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Verify and communicate
Confirm that old credentials fail, replacement credentials succeed only within their intended scope, audit events are attributable to the dedicated agent identity, and alerts trigger on anomalous use. Notify affected downstream parties when policy, contract, or law requires it. Record decisions, timestamps, credentials rotated, evidence preserved, and unresolved uncertainty.
How to prevent the next compromise
- Give every agent a dedicated, attributable identity; never place a developer’s personal credential in an agent runtime.
- Separate read-only and write-capable identities, and deny administrative roles by default.
- Use task-scoped, short-lived credentials with automatic expiration and rapid revocation.
- Require approval for high-impact actions such as production changes, package publication, access-policy edits, and destructive data operations.
- Centralize secrets and prevent them from appearing in prompts, logs, traces, images, and source control.
- Alert on unusual token use, privilege changes, new principals, unexpected regions, and access outside the agent’s normal task pattern.
- Store audit records in tamper-evident storage and retain prompts, responses, tool calls, and workflow history according to your incident policy.
- Exercise the written playbook at least annually with scenarios such as prompt injection, a suspicious pull request, a stolen runner token, and a malicious workflow change.
- Measure time-to-revoke from detection to blocked access, then remove delays discovered during the exercise.
Choosing a physical backup authenticator
A hardware security key can be useful for responders and administrators who must regain access after an authenticator is lost, stolen, or compromised. NIST identifies a physical authenticator as an acceptable backup or alternate authenticator in that situation. Before buying or enrolling one, confirm:
- Protocol support for the identity providers and administrator consoles you use.
- Whether the account’s assurance level accepts that protocol and authenticator type.
- Enrollment, recovery, and revocation requirements, including whether administrators can remove a lost key centrally.
- A documented backup-key policy, secure storage, durability, and who is authorized to possess each key.
- Whether the organization can test recovery without weakening normal phishing-resistant authentication.
A backup authenticator does not replace credential rotation. It protects the human recovery path; the compromised agent’s keys, grants, tokens, and downstream copies still require issuer-side revocation.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Incident checklist
- Freeze the agent, connector, trigger, and runner.
- Preserve prompts, responses, tool calls, shell history, environment snapshots, workflow logs, and audit events.
- Disable or deny the agent principal.
- Revoke access and refresh tokens, API keys, app installations, OIDC grants, cloud keys, package tokens, signing keys, and model-provider keys.
- Inventory identifiers, issuers, privileges, locations, exposure times, owners, and revocation methods.
- Query all relevant audit logs from the earliest plausible exposure.
- Issue least-privilege replacements through workload identity or a secrets manager.
- Deploy and test replacements everywhere, disable the old credentials, then delete them.
- Remove copies from code, images, logs, caches, artifacts, and agent state.
- Quarantine and rebuild affected artifacts from a known-good source.
- Verify failed use of old credentials, successful limited use of replacements, and complete audit coverage.
- Notify affected parties and update the playbook with measured time-to-revoke.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
