AI Agent Incident Response Planning

When a regular app is compromised, the blast radius is limited to that app's data. When an AI agent is compromised, it extends across every system the agent connects to — CRM, email, knowledge base, ticketing, communication channels. Agents are designed to orchestrate across platforms, which is exactly what makes a compromise so dangerous.

AI-specific attacks make detection harder too. Prompt injection can cause agents to take harmful actions while appearing to operate normally. A compromised support agent might start exfiltrating data through its normal response channel, and it would look like regular customer interactions until someone analyzes the content.

Your IR plan needs to account for these differences: containment procedures that handle cascading compromise across multi-agent systems, forensic techniques for analyzing LLM interaction logs, classification frameworks calibrated to AI-specific incident types, and recovery procedures that involve rebuilding from verified clean configurations — not just restarting the agent. If you haven't practiced this through tabletop exercises, you haven't prepared.

Prompt injection is the top threat (OWASP #1 for LLM apps). Malicious input manipulates agent instructions to leak data, bypass safety, or execute unauthorized actions. Advanced techniques include indirect injection through poisoned documents and multi-turn manipulation.

Data poisoning targets knowledge bases and RAG systems. Malicious content inserted into agent retrieval sources influences behavior without direct interaction. Insidious because poisoned data looks legitimate to human reviewers.

Supply chain attacks target models and libraries. Adversarial inputs, trojanized model weights, compromised framework packages. AI agent supply chains (LLM providers, frameworks, tools, infrastructure) create multiple compromise points. Your IR plan must account for incidents from any point in this landscape.

Immediate containment: pause the agent, revoke active tokens and API credentials. This must happen in seconds. Every agent needs a kill switch. Preserve system state for forensics.

Secondary containment: evaluate agents and systems that interacted with the compromised agent. In multi-agent systems, if the orchestrator is compromised, all workers that received instructions during the suspect window are potentially affected. External systems the agent accessed need evaluation for unauthorized changes.

Network-level containment for severe incidents: block the agent's network access at the firewall. If an LLM provider API key is compromised, rotate immediately and block provider traffic until a new key is provisioned. Document every containment action with timestamps — essential for post-incident review and regulatory reporting.

Don't restart a compromised agent. Redeploy from verified clean configuration with fresh credentials, updated security controls addressing the vulnerability, and enhanced monitoring on the exploit vector. Verify behavioral parameters before returning to production.

Internal reporting: all stakeholders per the IR plan. External: GDPR requires supervisory authority notification within 72 hours of a personal data breach; notification to affected individuals if high risk. The EU AI Act adds reporting obligations for serious incidents with high-risk systems.

Post-incident review within 2 weeks: blameless post-mortem with all parties. Detailed report covering timeline, root cause, contributing factors, response effectiveness, and specific improvements with owners and deadlines. Track improvements to completion and verify through tabletop exercises or red teaming.