Traditional incident response timelines—built around human attackers moving at human speed—become dangerously inadequate when AI agents are compromised or manipulated, according to a new operational playbook published on CSO Online. The analysis, written by a practitioner drawing on recent high-profile agent incidents, concludes that autonomous AI systems break both foundational assumptions of conventional breach response: they don't move at human tempo, and they don't execute a fixed instruction set. The report walks through what responders should actually do, hour by hour, during the first 24 hours after discovering an AI agent has acted outside authorized boundaries.
The playbook references three incidents that illustrate the changed threat landscape. Anthropic's account of the GTG-1002 campaign showed a Chinese state-sponsored group manipulating Claude Code to attempt infiltration against roughly 30 organizations, with the AI carrying out most tactical work with minimal human involvement. Researchers at Aim Security disclosed EchoLeak, a zero-click prompt injection vulnerability in Microsoft 365 Copilot with a CVSS severity score of 9.3—a single crafted email ingested during routine summarization was sufficient to trigger data exfiltration from OneDrive, SharePoint, and Teams with no user interaction. Obsidian Security's analysis of the Salesloft-Drift OAuth compromise demonstrated how a single compromised connected app cascaded into hundreds of downstream SaaS environments, a pattern the report expects to worsen once agents hold tokens and chain tool calls across systems.
The report argues that containment must prioritize identity revocation over network isolation—the instinct to "pull the network cable" fails when damage has already occurred through API calls three systems away. "I revoke or suspend the agent's credentials, API keys and OAuth tokens immediately, the same way I would treat a compromised service account," the author writes. Detection itself loses the most time because agent incidents rarely trigger alerts security operations centers are tuned for; responders should instead look for statistically abnormal tool-call volume from a single agent identity, agents acting outside declared task scope, or outputs referencing instructions no human operator provided. According to the playbook, legal and privacy stakeholders need a first briefing well before forensics is complete—waiting for certainty is how AI incidents turn into disclosure failures.
The report explains that forensics work differs fundamentally from traditional breaches because responders must reconstruct not just what happened on disk, but why the model decided to act. Walking the full prompt and response chain, including anything the agent retrieved before the anomalous action, helps identify the specific instruction—visible or hidden—that redirected behavior. Whether the agent's own reasoning output shows it recognized the instruction as suspicious and proceeded anyway, versus never flagging it at all, determines whether the gap is in guardrails or detection, and the fix looks different depending on which one is found. The report notes that restoration should never return an agent to its prior configuration by default—that's how incidents recur within a week.
The playbook concludes that operational sequencing matters more than risk taxonomies when teams are paged at 2 a.m.: contain by identity before containing by host, freeze evidence before patching, notify before certainty is reached, and never restore to the exact configuration that just failed. Every team that handled an EchoLeak-class or GTG-1002-class incident well had already rehearsed the first 24 hours before needing them, the report finds. The author recommends the industry shift from writing governance principles to running tabletop exercises against the clock, because the next incident won't wait for policy to catch up. The industry has spent two years on agent governance frameworks but still lacks the muscle memory to execute under pressure. Boards accustomed to signing off on AI principles may find themselves blindsided by how little those documents help when an autonomous system with live credentials acts faster than human oversight can intervene.