Checklist

How do you respond when an agent is involved in an incident?

For decades, incident response plans were built to account for people and software, each with its own processes and challenges. Software is deterministic; its failures are rooted in code. Humans make mistakes or misbehave, but they can at least try to explain themselves.

AI agents are different from both humans and traditional software. The same instruction produces different actions on two different runs, and asking an agent for an explanation is pointless, as it’s a new output generated after the fact rather than a record of what actually drove the action.

The non-deterministic nature of agentic activity means one more thing: if a run caused an incident, it doesn’t mean another run will; or that an incident it causes will be the same.

So what do we do when the clock is running, and the triage points at an agent? First of all, don’t just delete it. You need its memory and transcripts. Also, ideally, you already know the agent's owner, since you’ve followed our agentic governance checklist. You’ll need them, because oftentimes they’re the only ones who can stop the agent.

Every row in the checklist is a decision someone has to make.

Phase 1: Contain, in the first hour

The agent is suspended

Owner or Security? Both
A named on-call pulled the agent
Suspension requires the owning team's sign-off, even after hours

The suspension covers the queue & trigger, not just the process

Owner or Security? Owner
Stopping the agent drains queued tasks and disables its schedules and webhooks
You stopped the container, but something started it again

The credentials are killed at the issuer

Owner or Security? Security
Access tokens are invalidated, refresh tokens killed, and sessions dropped
The secret was rotated in the config while a live token kept working

Whatever the agent delegates to is stopped

Owner or Security? Both
You know what this agent spawned or handed work to, and those are down as well
The parent is down, but the sub-agents carry on

The business owner is on the call, and the outage a calculated decision

Owner or Security? Both
Somebody with the authority to accept a broken process is present and says so
Security suspends and the business restores it an hour later without writing anything down

The state is captured before everything restarts.

Owner or Security? Security
Memory contents, session transcripts, tool-call history and the running config are snapshotted before restart
A clean image goes out, deleting the evidence

Phase 2: Scope

You have every run of the agent listed

Owner or Security? Security
An enumerated set of runs with corresponding triggers
You only looked at the alert transcript

Two runs are not assumed to have done the same thing

Owner or Security? Security
Each run's tool calls are read separately
One transcript is treated as representative of all runs

The scope window includes time before the alert

Owner or Security? Security
Your scope starts at the last change you can trust
The scope window starts when the alert is fired

The entry point is named, and you know if it is still open

Owner or Security? Both
The document, tool, or MCP server that carried the instruction is known, along with everyone else who reads it
Containment stops at the agent and not the source of its payload

Reads are scoped as well as writes

Owner or Security? Security
You know what the agent pulled and how much of it, by volume
The deletion was investigated, but not the export before it

Identities sharing the blast radius are checked

Owner or Security? Security
Other agents on the same credential, server, or memory store are examined
The investigation is scoped to the one alerting agent

Phase 3: Eradicate and recover

Memory and retrieval stores are cleaned, not just the agent

Owner or Security? Both
Poisoned entries are removed from long-term memory and from every index the agent reads, including reworded versions
The agent is restarted and reads the payload again

Reversals happen in a decided order, with named owners

Owner or Security? Both
A sequenced list of undo actions exists, each with a person against it
Several people undo things at once, and changes are impossible to isolate

Irreversible actions get a human remediation

Owner or Security? Owner
Someone is responsible for correcting the actions
"Cannot be undone" is written down instead of action items

The config is rebuilt from a known-good version

Owner or Security? Owner
The config is restored from a stored version, with the diff kept
Someone edits the system prompt until the behavior stops

Restart is gated on a written condition

Owner or Security? Both
What has to happen before the agent runs again is agreed to, in writing
The agent is back because the business needed it back

It runs supervised before it runs free

Owner or Security? Owner
A defined period at reduced scope or with write approvals, and someone reviews the transcripts
Full autonomy is restored the moment the agent is declared clean

Phase 4: Close out

You can say what it did and on whose authority, or say plainly that you cannot

Owner or Security? Security
There’s a written answer for each material action including named gaps
A narrative assembled from inference

Notification is assessed on what the agent did, not only on what leaked

Owner or Security? Security
Someone checks if it sent emails, changed records, or made decisions
Only the data exposure question is interesting to stakeholders

The people the agent acted toward are told

Owner or Security? Both
If the agent wrote to a customer or acted in their name, they hear it from you
The incident stays internal because no data left the building

The fix is a permission change or an intent change

Owner or Security? Both
The corrective action is visible in the agent's scopes or intent statement
The system prompt is edited to tell the agent not to do this again

The same class is checked across the fleet

Owner or Security? Security
You ask which other agents hold that tool, read that store, or run that pattern. Then you fix those
One agent fixed

The gaps go back into the other checklists

Owner or Security? Both
What you couldn't answer becomes a logging item, what you couldn't stop becomes a permission item
The post-mortem is a document that gets filed and forgotten