When a coding agent misfires, stop the session, preserve the logs, check whether a secret was exposed, list every file and system it touched, and rotate anything at risk. Then tell the owner and open an incident record. Fix the cause later; contain first.
What counts as a misfire
Examples: the agent deleted files, pushed to a branch it should not, installed an unexpected package, printed a credential, followed an instruction found in an issue, or ran a command nobody approved. Treat each as an incident until you know it was harmless.
The first hour, in order
Minutes 0 to 10: stop and preserve.
- Stop the session. Close the agent, and if it runs in CI cancel the job.
- Do not clean up yet. Copy session logs, terminal history, and the working directory state somewhere safe. Evidence disappears when people tidy.
- Note the time, the user, the agent version, and the task.
Minutes 10 to 25: scope. 4. List what changed using git status and the commit history for the branch. 5. List which tools the agent called, from the logs. See what to log. 6. Check network records for outbound connections you did not expect.
Minutes 25 to 40: secrets. 7. Ask whether any credential was in reach: files, environment variables, terminal output, pasted text. OWASP lists credentials among the sensitive data at risk of disclosure. 8. When in doubt, rotate. A rotation costs minutes. An unrotated exposed key can cost far more.
Minutes 40 to 50: protect the code. 9. If a pull request exists, block merge. If a push reached a shared branch, revert through a normal reviewed change, not a force push, unless your policy says otherwise. GitHub's documentation notes force pushes are blocked by default on protected branches. 10. If dependencies changed, remove them and review the lockfile diff.
Minutes 50 to 60: communicate. 11. Tell the repository owner and the security contact. 12. Open an incident record with what you know and what you do not. 13. Decide whether the agent stays on for others. Pause the ring if the cause is unclear. See rollout rings.
After the first hour
Find the cause. Was it a permission that was too broad, a planted instruction, an approval clicked through, or a tool flaw? Write one control that would have prevented it, and add a probe to your guardrail test list so it cannot return unnoticed.
Blameless by design
The developer who reports quickly should be thanked, not blamed. If reporting is risky for the person, the next misfire will be hidden. Say that in your usage policy.
Practice it
A tabletop of thirty minutes is enough. Use a made up scenario with a fake key and walk through each step. See how to run a tabletop exercise for a format.
Safeguard offers agent identity, an MCP Guardrail, and compliance and evidence automation, which help attribute actions and keep records for the review.
Quick check
Should we delete the agent's branch right away?
No. Preserve it first. Delete after the investigation is complete.
Do we always need to rotate secrets?
Rotate any secret that could have been read. If you cannot prove it was not, assume it was.
Sources
Last reviewed: 19 October 2026.
