The first 24 hours of an AI agent security incident
Brief
Most of what I read on AI agent security follows the same shape: a taxonomy of risks, a list of governance principles and a call to “adopt responsible AI practices.” That’s useful for a board deck. It’s nearly useless at 2 a. m. when an autonomous agent with live credentials has just done something nobody authorized, and someone is asking me what happens next.
I don’t want to write another framework. I want to walk through what I would actually do, hour by hour, in the first day after discovering an AI agent has been hijacked, manipulated or has simply acted outside the bounds anyone intended for it.
Why the clock runs differently for agents
I built my early incident response instincts around a human attacker moving at human speed, or malware executing a fixed set of instructions.