AI Incident Response Playbook

Bottom line

Respond to an AI incident by stopping consequential actions, preserving prompts, retrieved sources, model and tool versions, identities and approvals, rotating exposed credentials, scoping affected outputs, and requiring a regression test before restoring automation.

The central decision is how to contain, investigate, recover, and learn from unsafe outputs, data exposure, prompt injection, or unintended tool actions. Start with the operating boundary, not a vendor matrix. Write down who initiates a run, which identity reaches each system, what evidence enters the model, which actions can change external state, and who owns a failed result. A product is only a fit when those responsibilities remain clear during normal operation and recovery.

Deleting a conversation or changing a prompt can destroy evidence while leaving copied outputs, tool side effects, and compromised credentials unresolved. Treat that warning as a testable procurement requirement. The selection record should show the official claim, the local test used to verify it, the observed result, the remaining limitation, and the owner who accepted that limitation.

What the current source record supports

The shortlist in this guide uses official documentation and maintained project sources reviewed on July 18, 2026. It includes AgentScope, System Prompts Leaks, Browser Harness, but the tools are reference points at different layers rather than interchangeable products.

• AgentScope: observable agent framework.
• System Prompts Leaks: prompt-security research corpus.
• Browser Harness: adaptive browser execution harness.

Reference option	Role in the decision	Evidence to collect
AgentScope	observable agent framework	Validate documented scope, permissions, failure behavior, and current terms
System Prompts Leaks	prompt-security research corpus	Validate documented scope, permissions, failure behavior, and current terms
Browser Harness	adaptive browser execution harness	Validate documented scope, permissions, failure behavior, and current terms

Declare the incident from observable impact or unresolved agency; do not wait to prove whether the model, connector, data, or application was the root cause. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Define the job before the product

Record the reporter, first-known time, affected workflow, request identifiers, model and tool versions, actions already taken, and a named incident commander. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

In the first fifteen minutes, stop expansion: disable the narrowest dangerous capability, revoke exposed credentials, freeze mutable artifacts, and preserve logs. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Set severity from impact and remaining authority. External messages, payments, code merges, cross-tenant retrieval, and unknown persistence demand faster escalation. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Separate documented capability from operating control

Create an evidence manifest for prompts, retrieved passages, tool arguments and results, policy decisions, approvals, application logs, and downstream records. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Match containment to the failure: isolate an injected source, revoke data access, disable an action, reconcile downstream state, or route provider failure to a validated fallback. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

For AI incident response, require a failure diagram. Show what happens when a provider times out, a document cannot be parsed, a browser page changes, a tool returns a partial result, or a reviewer never responds. Specify retry limits, idempotency keys, queues, dead-letter handling, and the state visible to an operator.

Build the evaluation scorecard

Scope by identifiers and common conditions rather than the first report. Search retries, asynchronous jobs, connector versions, content sources, tenants, and failure signatures. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Preserve authorization evidence: initiating identity, delegated credentials, resolved scopes, approval requirements, and the exact service principal used for every external action. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Begin recovery only after the defect, affected boundary, containment status, and validation test are explicit. A patch that fixes one example is not sufficient evidence. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Run a controlled pilot

Restore in stages: named users and read-only access first, reversible writes behind approval second, and high-impact actions last with published rollback criteria. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Communicate confirmed facts, uncertainty, user action, and the next update time from one shared record; avoid speculative claims about model or attacker intent. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Route contractual, privacy, and regulatory notification decisions immediately to the responsible owners instead of embedding a universal deadline in this technical playbook. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Security, privacy, and governance questions

Measure reviewer time, disabled-workflow time, customer remediation, forensic effort, provider support, and engineering rework to expose the full incident cost. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Separate trigger, failed control, and organizational condition. An injected page may trigger the event, excessive tool authority may enable it, and missing ownership may prolong it. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Assign every corrective action an owner, due date, completion evidence, and verification method. ‘Improve the prompt’ is not a control and cannot close an incident. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Cost and portability

When policy permits, retain a sanitized regression case that faithfully represents the failure and add it to release evaluation and tabletop exercises. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Run table-top exercises after material model, connector, permission, or incident-tooling changes, including incomplete telemetry and partially completed external actions. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Decision record

Verify actual log retention, identifiers, export access, clock alignment, kill switches, and escalation contacts; provider documentation alone does not prove local readiness. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Keep the closure record concise: severity, scope, affected data and actions, causes, containment, recovery evidence, communication, residual risk, owners, and approver. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

Source and limitation note

Do not close on service restoration alone. Reconcile downstream state, complete required notices, pass recovery tests, and track corrective work before closure. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.

The minimum viable capability is an on-duty chain, a kill switch per high-impact surface, durable identifiers, protected evidence, adversarial tests, and staged recovery. The incident commander must capture the decision, supporting evidence, owner, timestamp, and condition for the next transition. Preserve uncertainty rather than converting an early hypothesis into a confirmed cause.