C5 Incident Response for AI Agents

AI agent incidents do not fit cleanly into traditional app, cloud, or data breach playbooks. A single incident can involve prompt injection, token misuse, unauthorized retrieval, model output, SaaS APIs, and cloud logs.

Incident Types to Prepare For

• Prompt injection: external content changes agent behavior or triggers unsafe tool calls
• Unauthorized tool execution: agent performs an action outside its approved scope
• RAG data leakage: restricted documents appear in retrieved context or generated answers
• Token compromise: credentials appear in logs, prompts, outputs, or external systems
• Provider outage: model, identity, vector database, or SaaS provider disrupts a critical workflow
• Cost or resource runaway: agent loops consume tokens, compute, storage, or API quotas

Playbook Structure

1. Contain the agent session and pause risky tool classes
2. Revoke or narrow affected tokens
3. Preserve traces, authorization logs, retrieval records, and tool-call evidence
4. Identify affected users, tenants, documents, APIs, and providers
5. Assess data exposure and notification obligations
6. Patch policy, prompt, retrieval, or tool routing failures
7. Run replay tests to verify the failure cannot recur
8. Document root cause and control improvements

C5 Evidence

Keep incident records that show detection time, containment time, affected components, decision owners, communication, recovery validation, and follow-up remediation. Incident response evidence is often where operational controls become real.

Bottom Line

C5-aligned AI agent incident response requires agent-specific detection, containment, evidence capture, and recovery procedures. Waiting until the first prompt injection incident to define the process is too late.