agent-incident-response

To respond to a compromised AI agent, initiate immediate containment by isolating affected sessions, then preserve forensic evidence and guide recovery through credential rotation and hardening.

AI agent incident response involves a phased workflow: containing threats by terminating sessions, collecting forensic timelines, rotating exposed credentials, and applying post-incident hardening checks.

Investigate unexpected behavior or credential exposure by establishing evidence collection, defining the scope of the compromise, and performing root-cause analysis using forensic timeline logging.

Yes, this incident response workflow explicitly applies to modified CLAUDE.md files, supporting containment, forensic investigation, baseline rebuilding, and post-incident hardening to secure the agent.

Harden AI agents post-incident by rotating credentials, auditing MCP configurations, rebuilding security baselines, and updating runbooks to prevent recurrence and reduce the blast radius.

No dependencies are required to run the AI agent incident response workflow; it relies on internal references to guide containment, forensics, recovery, and reporting phases.