Hours 1-4: Scope the blast radius
Now I am answering what the agent actually touched. I pull the full tool-call log, every API invoked, every parameter passed, every response received, and I cross-reference it against the agent’s entitlements to see what it could reach versus what it did reach. I also check whether the agent’s own actions created new artifacts along the way: A scheduled task, a forwarding rule, a new API key, because autonomous agents are often better at persistence than the people who built them. If the entry vector looks like indirect prompt injection, I try to identify every other session that ingested the same poisoned content. This is rarely a single-victim event.
Hours 4-8: Notify before I am certain
Legal, privacy and executive stakeholders need a first briefing well before forensics is complete. I’ve learned that waiting for certainty is how AI incidents turn into disclosure failures. I give leadership three things: what the agent could access, what the evidence currently shows it did access and what’s still unknown. I loop in legal early if the agent touched regulated data. And I make an explicit call on whether other agents built from the same base configuration or tool integration need to be paused as a precaution, since a single vulnerable pattern can be replicated across an entire agent fleet before anyone notices.
Hours 8-16: Reconstruct the decision chain
This is the forensics work I find genuinely different from a traditional breach. I’m not just rebuilding what happened on disk. I’m rebuilding why the model decided to do it. I walk the full prompt and response chain, including anything the agent retrieved before the anomalous action, and I try to find the specific instruction, visible or hidden, that redirected its behavior. I also check whether the agent’s own reasoning output shows it recognized the instruction as suspicious and proceeded anyway, which points to a guardrail gap, versus never flagging it at all, which points to a detection gap. The fix looks different depending on which one I find.
