# AI Security Incident Response Plan ## 1. Executive Summary `support-agent-prod` appears to have been influenced by an indirect prompt injection embedded in an incoming customer email. The email contained instructions attempting to override the agent's intended behavior and cause it to retrieve CRM information and transmit that information externally. Logs confirm that the agent: 1. Processed the malicious email. 2. Accessed the CRM. 3. Made an unexpected outbound HTTP request. At this stage, **customer-data exfiltration is suspected but not confirmed**. **Initial severity: HIGH** The severity should be raised to CRITICAL if investigation confirms that sensitive customer information was transmitted externally or that credentials/tokens were exposed. --- ## 2. Immediate Containment Execute these actions in order: ### P0 — Immediately * Disable outbound HTTP access for `support-agent-prod`. * Disable or quarantine the affected agent workflow if support operations can continue safely without it. * Preserve logs before applying destructive remediation. * Identify and preserve the malicious email. * Freeze automated CRM retrieval until the affected workflow is validated. * Prevent the agent from processing additional untrusted emails. ### P1 * Review the agent's active credentials and tokens. * Rotate credentials if the external HTTP integration had access to secrets. * Review all outbound requests generated by the agent during the incident window. * Identify whether any other agent processed the same email or retrieved the same malicious content. --- ## 3. Evidence Preservation Prioritize: | Priority | Evidence | Purpose | | -------- | --------------------- | ------------------------------------------- | | P0 | Agent execution logs | Reconstruct agent behavior | | P0 | Outbound HTTP logs | Determine whether data left the environment | | P0 | CRM audit logs | Identify records accessed | | P0 | Original email | Preserve attack source | | P1 | Agent prompts/context | Determine instruction injection | | P1 | Tool-call logs | Identify unauthorized actions | | P1 | Authentication logs | Identify credential use | | P2 | Network/DNS logs | Identify external infrastructure | Preserve data for at least: `2026-08-08 14:00 UTC` through `2026-08-08 15:15 UTC` to provide investigation buffer around the known window. --- ## 4. Investigation ### Determine what CRM data was accessed Compare CRM audit events against the agent's normal behavior. Identify: * Customer IDs * Fields accessed * Number of records * Queries issued * Access timestamps ### Determine whether data was exfiltrated For every outbound request during the incident window, collect: * Destination * URL * HTTP method * Request headers * Request size * Response * Response status * Request body, where available * Authentication mechanism Determine whether request bodies contained: * Customer names * Email addresses * Account identifiers * Support history * Authentication information * Internal identifiers **Important:** CRM access proves data exposure capability, not exfiltration. Exfiltration should only be classified as confirmed if outbound telemetry demonstrates that customer information was transmitted. --- ## 5. Attack Path Current evidence supports: `Malicious Email` → `Agent Ingestion` → `Indirect Prompt Injection` → `Unexpected Agent Behavior` → `CRM Access` → `Unexpected External HTTP Request` The final step is currently classified as **suspected data exfiltration** until outbound request contents are verified. --- ## 6. Root Cause Likely contributing factors: 1. Untrusted email content was processed as agent context. 2. The agent had access to CRM data. 3. The agent had unrestricted outbound HTTP capability. 4. Sensitive actions were not sufficiently isolated from untrusted instructions. 5. Tool authorization appears to have been broader than required for the support workflow. --- ## 7. Eradication Before restoring the workflow: * Remove the malicious email from the agent's processing queue. * Review other messages for similar injection content. * Remove unnecessary outbound HTTP capabilities. * Restrict CRM access to the minimum fields required. * Add authorization checks around CRM retrieval. * Require approval for sensitive external actions. * Review agent instructions and tool definitions. * Validate that retrieved email content is treated as data rather than trusted instructions. --- ## 8. Recovery Gates Do not restore normal operation until: * Outbound HTTP access has been restricted. * CRM access scope has been reviewed. * Relevant credentials have been evaluated and rotated where necessary. * Logs are confirmed operational. * Detection rules are active. * Malicious content has been quarantined. * Prompt-injection tests have passed. * Unauthorized tool invocation tests have passed. * Sensitive outbound actions require appropriate authorization. --- ## 9. Preventive Controls ### Architecture Separate untrusted email processing from privileged tool execution. ### Authorization Use least-privilege permissions for CRM and external APIs. ### Agent controls Require explicit authorization before high-impact actions. ### Monitoring Alert on: * Unexpected external destinations * Unusual CRM access volume * Agent tool calls outside normal workflows * Large outbound requests * Sensitive data appearing in external requests * Repeated prompt-injection patterns ### Testing Add adversarial tests for: * Direct prompt injection * Indirect prompt injection * Malicious email content * Data-exfiltration attempts * Unauthorized tool calls --- ## 10. Action Items | Priority | Action | Owner | Evidence | | -------- | --------------------------------------- | -------------- | ---------------------- | | P0 | Disable unrestricted outbound HTTP | AI Platform | Network policy | | P0 | Review outbound requests | SOC | Request investigation | | P0 | Review CRM audit logs | SOC/CRM | Audit report | | P1 | Rotate affected credentials if required | IAM | Rotation record | | P1 | Reduce CRM permissions | Engineering | IAM/tool configuration | | P1 | Add outbound-data monitoring | Security | Detection rule | | P1 | Add indirect-prompt-injection tests | AI Engineering | Test results | | P2 | Review all production agents | AI Security | Agent inventory | ## 11. Residual Risk The primary unresolved question is whether customer information was transmitted through the unexpected HTTP request. The incident should remain **HIGH severity** until outbound request contents and CRM access logs have been correlated.