When an agent follows injected instructions and acts, stop its access first, then preserve evidence, then scope the damage. Revoke the agent's credentials, not just the chat session, keep the logs, and list every tool call it made. Fixing the root cause comes after the bleeding stops.
Minute 0 to 10: contain
Cut what the agent can do before you work out why.
- Disable the agent's runner or pause its queue.
- Revoke the tokens and keys it holds. Stopping the conversation does not stop a token. If the agent used per user tokens, revoke those for affected users.
- If a tool server is involved, disable the tool or the connection to it.
- Do not delete the agent, its memory or its logs. You need them.
Revoking access is the one step that really contains harm. This is why scoped and revocable credentials matter before an incident.
Minute 10 to 30: preserve
- Export the audit log for the agent, the tool servers and the downstream systems for the whole period.
- Save the prompts, retrieved documents and tool results around the event, including the suspected hostile content, in a restricted place.
- Snapshot the agent's memory or state if it keeps any.
- Note the configuration version of the agent and the tool list at the time.
OWASP's definition of excessive agency applies regardless of cause, so do not wait to prove it was an injection before you preserve evidence.
Minute 30 to 50: scope
Using the logs, build a list of every tool call after the first suspicious one.
- Which tools were called, with which arguments?
- Which data was read, and where did it go?
- Which changes were made, and are they reversible?
- Did any call go to an external address?
- Which users' data or permissions were involved?
Separate actions that were approved by a person from those that were automatic. Check whether the agent reached anything its task never needed, which points to a permission problem.
Minute 50 to 60: decide and communicate
Decide whether the event triggers notification duties. Do not guess the threshold here: involve whoever owns legal and privacy, with the facts from the scope list. Tell affected internal owners what to watch. Start undoing reversible changes in a controlled way.
After the hour: fix the path
- Find the entry point. Which document, page or message carried the instructions?
- Find the reachable tools. Which ones did the agent not need?
- Narrow credentials and add approval steps for the actions that did harm.
- Add the hostile content as a regression test.
- Review the audit log gaps you ran into and add the missing fields.
Practice it
Run a tabletop with a scenario where an agent emails data to an outside address. Time how long it takes to revoke its access. If the answer is hours, work on that first.
Where Safeguard fits
Safeguard includes agent identity, policies and an MCP Guardrail, which give you a place to see and cut an agent's access. Autonomous remediation fix PRs are off by default with every category on Manual, so a person reviews any change.
Quick check
Should I wipe the agent's memory right away?
No. Preserve it first, because it may hold the hostile content and the trail of what the agent believed.
Sources
Last reviewed: 19 October 2026.
