AI Incident Response Checklist
Prompt injection, data leaking through an AI feature, an agent misusing its tools, or a poisoned model, plugin or MCP server. Work through 35 steps: kill switch, tool cut-off, prompt and trace preservation, scoping, rollback, re-testing and notification.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
A working checklist for incidents in AI features and agents: prompt injection, data leakage, agent or tool misuse, and poisoned models, plugins or MCP servers. Use the kill switch, cut tool access, preserve prompts and traces before anything restarts, scope what actually left, roll back, re-test with the real attack, and notify. The sample shows a fictional analytics company whose sales agent used a malicious MCP server.
Your context
Incident summary
1. Detect, triage and declare
AI incidents look like product bugs at first. Decide early whether this is a security incident.
Classify the incident: direct or indirect prompt injection, data leakage through an AI feature, agent or tool misuse, poisoned model, plugin or MCP server, or harmful outputmaterial
Record when you became aware and how (user report, guardrail alert, cost spike, vendor advisory)material
Identify the system: owner, model and provider, model version, system prompt version, tools and their permissions, data sources, users
Declare an incident with a commander, and bring in privacy and legal if personal or customer data may be involved
Identify which users, tenants or customers use the affected feature or agent
2. Contain: kill switch and tool cut-off
Stop the agent acting before you investigate. A model you cannot switch off is the incident you cannot contain.
Use the kill switch: disable the AI feature or agent with a feature flag or by revoking its credentials, without deleting its configuration or logsmaterial
Revoke and rotate every credential the agent or its tools held: API keys, OAuth tokens, service accounts, MCP server credentialsmaterial
Disable high-risk tools until the cause is fixed: write actions, outbound email, web fetch, code execution, payments
Remove or block the suspect model, plugin or MCP server everywhere it is installed, and block its network destinationsmaterial
Quarantine poisoned inputs: retrieved documents, tickets, emails, web pages or memory entries carrying the injection
Put a safe fallback in place for users (human handling, read-only mode, or a clear "temporarily unavailable" message)
AI components in scope
Every model, agent, tool, plugin, MCP server and data source involved, and what you did about it.
3. Preserve evidence
AI evidence is unusually perishable: prompts and traces often sit in short-retention logs or only at the provider.
Preserve prompts, model outputs, tool calls and tool results, retrieved documents and session identifiers for the affected windowmaterial
Snapshot the configuration: system prompt version, model version, tool definitions and scopes, guardrail settings, MCP server versions and manifests
Snapshot vector stores, agent memory and caches before cleaning them
Ask the model or platform provider to preserve their logs for the request IDs involved, and note their retention period
Handle preserved logs as sensitive: they contain user prompts and personal data. Restrict access and record chain of custody
4. Investigate and scope
Find the vector: the injection payload and where it came from, or the malicious code path in the componentmaterial
Separate what the model or agent could reach from what it actually returned or sent, using tool-call logsmaterial
Identify affected people and sessions: whose data appeared in outputs or was sent out, and which users saw it
Hunt for the same payload or component elsewhere: other agents, other tenants, shared prompt libraries, document stores
Review the AI supply chain: model and adapter hashes, plugin and MCP server provenance, how the component was approved
5. Eradicate, roll back and recover
Roll back to the last known good model, system prompt and tool configuration, or fix forward with a reviewed changematerial
Tighten permissions: least-privilege tool scopes, human confirmation for write and send actions, separate trust boundaries for untrusted content
Re-test with the actual attack and close variants before re-enabling; record the resultmaterial
Re-enable in stages with heightened monitoring of tool calls, egress and guardrail hits
Introduce an allow-list and review process for models, plugins and MCP servers
6. Notify and communicate
If personal data was exposed, run the data breach process: deadlines from awareness, regulators, affected individualsGDPR Art. 33material
Tell affected users and customers what happened, what data was involved, and what to do
Report the issue to the model, platform or component provider and, for a malicious public component, to the registry that lists it
If you provide a high-risk AI system in the EU, check serious-incident reporting duties and whether they apply yetEU AI Act Art. 73
Brief staff: what not to paste into AI tools, how to report odd AI behaviour, which components are approved
7. Post-incident
Hold a post-incident review and track actions to closure
Update the AI threat model and add tests for this attack to the release pipeline
Add detections: unusual tool-call volume, new egress destinations from agent hosts, guardrail-hit spikes, cost anomalies
Update the AI incident playbook and rehearse it in a tabletop
What this template gives you
- Covers four AI incident types: prompt injection (direct and indirect), data leakage through AI features, agent and tool misuse, and poisoned models, plugins or MCP servers.
- Containment comes first: a kill switch for the feature or agent, revoked tool credentials, high-risk tools disabled, and the suspect component removed everywhere it is installed.
- Prompts, outputs, tool calls and traces are preserved before anything restarts — AI evidence is short-lived and often held only by the provider.
- Scoping separates what the model could reach from what it actually returned or sent. Notification decisions rest on the second.
Frequently asked questions
What is an AI incident?
Any event where an AI feature or agent behaves in a way that harms security, privacy or safety: it is manipulated by injected instructions, reveals data it should not, takes an action nobody approved, or runs a compromised model, plugin or MCP server. Many start as "weird output" bug reports.
What should an AI kill switch do?
Stop the feature or agent from acting — new requests and scheduled runs — without deleting its configuration, memory or logs. In practice that is a feature flag plus the ability to revoke the agent's API keys and tool tokens at the identity provider. Test it before you need it.
Is a prompt injection that leaked data a data breach?
If personal data was disclosed to someone who should not have it, it is generally treated as a personal data breach, and the usual notification rules and deadlines apply from when you became aware. Confirm with counsel.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.