First, stop the agent from continuing the unauthorized action using the safest available override or access control. Then preserve evidence, determine what it did and could reach, secure affected accounts and integrations, and recover only after fixing and validating the cause. The right containment step depends on how the agent is connected and what other services depend on it; an indiscriminate shutdown can cause additional disruption.
What should you do first?
Treat an agent’s unauthorized action as a security incident, even if it appears accidental. A model may produce the instruction, but the agent’s tools, identities, and permissions are what let it change systems or expose information. NIST advises treating agent security as part of cybersecurity while accounting for the extra risks created when model outputs are combined with software capabilities.
As an Amazon Associate I earn from qualifying purchases.
- Stop or limit the action. Use a tested human override, disable the relevant tool or connector, isolate the affected component, or disengage the agent under your incident plan. If you can do so safely, first consider which dependent functions a shutdown would interrupt and follow the designated decision sequence and escalation authority. NIST’s AI RMF Playbook recommends bypassing, disengaging, or deactivating when risks exceed tolerance or cannot be mitigated in time, while considering the effects of that choice.
- Preserve evidence before cleanup. Save relevant activity and tool-call records, prompts or instructions, approvals, identity and access events, connected-system logs, timestamps, and records of resulting changes. Note who discovered the event and what responders did. Keep original materials intact; do not delete or overwrite evidence during remediation.
- Establish the scope. Identify what happened, when it happened, whether it is continuing, which accounts and systems were involved, what data was viewed or changed, who received anything externally, and any financial or operational effects. Keep an incident record and involve security or IT, system and business owners, and legal or communications teams as appropriate.
- Secure the access path. Review the agent’s privileges and every connected identity or integration. Suspend or revoke the relevant authorization through the provider or administrator process, and rotate exposed secrets when appropriate. If an account may itself be compromised, use the provider’s account-recovery steps as well.
- Fix and validate before restoring. Correct the permission, configuration, integration, or workflow that enabled the action. Check for other affected resources, then test the correction and set risk-appropriate criteria for recovery or redeployment.
- Escalate and communicate. Notify internal incident leadership and affected service providers as appropriate. If personal information may have been exposed, identify the information and people potentially affected, consult qualified counsel, and determine which legal or sector-specific rules apply.
- Review and improve controls. Record lessons and update monitoring, access limits, override paths, and the incident plan. NIST calls for communicating incidents and errors to relevant AI actors, including affected communities, and tracking response and recovery.
This sequence aligns with the incident-handling lifecycle described in NIST SP 800-171 Rev. 3: preparation, detection and analysis, containment, eradication, and recovery. That publication concerns protecting controlled unclassified information in nonfederal systems; the sequence is useful here as general incident-handling guidance, not as a claim that it governs every agent deployment.
How should you stop the agent without making things worse?
Choose the narrowest action that reliably stops continued harm, but do not leave a dangerous action running merely to preserve business continuity. The appropriate scope depends on whether the problem is isolated to one tool, a component, or the agent as a whole.
| Containment choice | When it may fit | Trade-off to assess |
|---|---|---|
| Pause or disable one tool or connector | The unauthorized behavior is tied to a specific integration and disabling it blocks further access. | Other agent capabilities may remain active; confirm they cannot continue the same action by another route. |
| Isolate an affected component | A component can be separated from other systems while responders investigate. | Dependent services may be interrupted, and isolation must actually prevent further access or changes. |
| Disengage or deactivate the full agent | The scope is unclear, the agent is still acting, or narrower controls cannot reduce risk quickly enough. | Dependent workflows may stop. Follow the deployment’s shutdown and escalation plan where possible. |
NIST’s AI RMF Playbook recommends planning for bypass, disengagement, and deactivation, including documenting decisions and considering the downstream consequences. A shutdown is containment, not proof that every connected identity, session, or external system has been secured.
What evidence should you save?
Preserve enough information to reconstruct the agent’s decisions and effects. Relevant evidence varies by deployment, but may include:
- Agent activity history, tool calls, prompts, instructions, and approval records.
- Identity, authorization, and access logs for the agent and connected accounts.
- Logs from affected applications, services, and infrastructure, including timestamps.
- Records of data viewed, created, changed, sent, or deleted, and any recipients.
- A timeline of discovery, containment steps, decisions, and the people who took them.
Preserve originals and avoid cleanup that could erase useful records. The FTC’s U.S. business data-breach guide warns businesses not to destroy forensic evidence during investigation and remediation. Forensic, regulatory, or legal review may require records beyond the agent’s own activity log.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow do you revoke an AI agent’s access?
There is no universal control path: permission settings, audit logs, and revocation steps depend on the agent provider, connected service, and deployment. Use the actual provider or administrator process to disable the authorization or integration the agent used, then verify that it no longer works. Review each connected identity rather than assuming that pausing the agent also cancels its access.
If an account may be compromised, the FTC’s consumer guidance recommends changing its password, signing out of all devices, enabling two-factor authentication where available, and checking recovery details and account activity. These account-recovery measures address the account; they do not replace revoking the specific agent authorization or integration.
Do you need to notify anyone if the agent exposed data?
Notify internal incident leadership and relevant service providers as appropriate. If personal information may have been exposed, establish what information was involved and who may be affected, then consult qualified counsel about the laws and sector rules that apply. Duties and timing depend on the facts and jurisdiction; there is no single notification deadline that applies to every incident.
For organizations, the FTC’s U.S.-oriented breach-response guide recommends notifying appropriate parties and affected individuals when required, and communicating clearly without putting people at further risk. It is general guidance, not a determination of an organization’s legal obligations.
Recommended Free Tools
When is it safe to turn the agent back on?
Do not restore operation just because the immediate action has stopped. Resume only through a defined recovery and change-management process, after the cause is understood and the correction has been validated. Set criteria suited to the system’s risk and document the decision.
- Confirm the unauthorized behavior has stopped and relevant access has been suspended or corrected.
- Check the agent, its connected identities and tools, affected systems, and relevant data for additional impact.
- Test the fix in a controlled way before restoring the affected capability.
- Document the recovery decision and update monitoring, permissions, override paths, and response procedures as needed.
NIST AI RMF 1.0 calls for post-deployment monitoring plans that include appeal and override, decommissioning, incident response, recovery, and change management. The framework is voluntary and NIST says it is being revised, so use it as guidance alongside the requirements and procedures applicable to your deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
