SimpleA plain explanation, one diagram and an analogy, with where the analogy breaks.
Guess first: is switching the agent off enough? Show the answerNo. Its keys may still work, and what it changed stays changed. Lock it out and check what it did.
Sooner or later an agent will be fooled or broken. Plan for that day before it comes.
First, stop it: pause the agent and switch off its keys and tokens, so it cannot keep acting.
Then look at its log: every tool it called, every file it changed, every message it sent. That shows what it touched.
Find how it was fooled, such as a poisoned web page, a bad tool or a stolen key, and close that door.
Finally, restore what was changed, tell the people affected, and tighten the agent's limits so the same trick fails next time.
Steps when an agent goes wrong
Stop: pause the agent
Revoke: its keys and tokens
Trace: read its action log
Fix: close the way in
Recover: restore and tell people
Like: A fire drill for a robot employee: know where the off switch is and which doors to lock. Where it breaks: A fire stops when it runs out of fuel. A hijacked agent keeps acting until someone cuts its access, and it may have copies of keys elsewhere.
How it worksAn interactive demo first, then the mechanism: light maths, pseudo-code and trade-offs.
Prepare. You can only investigate what you recorded: log every tool call with inputs, outputs, the model's context sources and the identity it acted as. Keep a kill switch per agent, and an inventory of each agent's credentials and permissions.
Contain. Pause the agent, revoke or rotate its tokens and keys, disable its tool servers and any scheduled triggers, and quarantine memory or context stores that may hold injected instructions.
Investigate. Reconstruct the sequence from logs: which content carried the injection, which tools ran, what data was read or sent. Check for persistence such as altered configuration, poisoned memory, or new credentials it created.
Recover and learn. Restore changed systems from known-good states, notify affected parties as policy and law require, and remove the leg that made the attack possible. General incident-response practice applies; the agent is one more identity and one more system.
Trade-offs
Detailed logs make investigation possible but may contain sensitive data; protect and expire them.
A hard kill switch stops damage but can leave tasks half-done; plan safe stopping points.
Rotating every credential is slow; an up-to-date inventory makes it fast.
ResearchWhere the simple picture breaks, open problems and primary sources.
Practice. NIST's revised incident-response guidance places response inside overall risk management, which applies to agents as to any system (NIST SP 800-61r3, 2025).
Agent-specific threats. OWASP's Top 10 for Agentic Applications (December 2025) and its earlier agentic threat list cover memory poisoning, tool misuse and privilege compromise, each of which changes what responders must check (OWASP, 2025; OWASP, Feb 2025).
Cases. A destructive prompt planted through an overscoped build token shipped in an AI coding extension release; the vendor says it was malformed and did not run, revoked the credentials, pulled the version and shipped a clean update (AWS-2025-015).
Open questions. How to log model context without storing too much sensitive data, and how to prove an agent's memory is clean after an incident.
Security on this concept: 2 threats Pending expert review
Attackers run AI agents against their targets Pending expert review
Exposed
Coding and computer-use agents that can run scans and exploits
Organisations targeted at machine speed
Attacks
Splitting an intrusion into small, harmless-looking tasks for an agent
Letting the agent do most of the reconnaissance and exploitation, with people approving only key steps
The agent loop Plan, act with a tool, observe the result, and repeat until the goal is met.
Agent harnesses The program wrapped around a model that turns it into an agent: it runs tools, asks permission, manages context and keeps memory.
Coding agents Agents that work inside a code repository: read files, make edits, run commands and tests, and iterate until the checks pass.
Computer & browser use Agents that operate a screen like a person: look at a screenshot, then click, type and scroll.
Multi-agent systems Several agents with different roles or contexts work together on one task.
Agent permissions & sandboxing Giving an AI agent only the tools, data and network access a task needs, running it in a sandbox, and asking a person before risky actions.