An AI agent did something wrong — what to do first

Stop the agent, preserve the evidence before anything is redeployed, then establish scope. The single most damaging mistake in the first hour is fixing the code before capturing the state, because that destroys your ability to explain what happened.

Get an Agent Trust Gap Brief

The first hour, in order

Contain — revoke authority, do not just stop the process. A stopped process holding valid credentials resumes on restart. Withdraw the credential. See revocation and kill switch.
Preserve before you fix. Snapshot receipts, logs, policy versions, prompts, model versions and configuration as they were. Redeploying first is the mistake that costs organisations the ability to explain themselves later.
Establish scope by action, not by time. "Everything between 14:00 and 15:30" is not scope. "These 412 actions, of which 38 produced external effects" is. Only the second supports a notification decision.
Separate attempted from effected. What the agent tried, what the provider accepted, and what actually landed are three different sets. Conflating them either overstates or understates the incident.
Assess notification duties early. Personal data, financial effect, or a regulated decision each start their own clock. Under DORA and similar regimes the clock is short and starts at detection.
Write the timeline while it is recoverable. Not the narrative — the timestamped sequence. Narrative gets contested; timestamps do not.

The questions you will be asked

Question	Answerable from receipts?	Answerable from logs alone?
What exactly did it do?	Yes	Partly
What was it permitted to do?	Yes	No
Who authorised it?	Yes	No
How many were affected?	Yes	Sometimes
Did it try anything else and get blocked?	Yes	Almost never
Can you prove the record is unaltered?	Yes	No

This table is the argument for building an evidence layer before you need one. Every "no" in the right column is a question you answer with "we believe" instead of "here is the record".

What not to do

Do not redeploy before snapshotting. It is the instinctive move and it destroys the evidence.
Do not describe scope in time windows. Regulators and customers ask about affected parties, not minutes.
Do not claim the agent "hallucinated" as an explanation. It describes a mechanism, not a control failure. The finding is that an unverified output reached an actuator — which is a governance answer, and a fixable one.
Do not let the same team that built it certify it is fixed. Recommending, executing and certifying should never be the same party.

If you are in this position now: agent incident response.

Common questions

What is the first thing to do when an AI agent misbehaves?

Revoke its authority — not just stop the process. A stopped process holding valid credentials can resume acting the moment anything restarts.

Why preserve evidence before fixing?

Because redeploying overwrites the configuration, prompts and policy versions that explain what happened. Once gone, every subsequent answer becomes 'we believe' rather than 'here is the record'.

How do you scope an agent incident?

By action, not by time. Enumerate the actions attempted, which produced external effects, and who was affected. Time windows do not support a notification decision.

When do notification duties start?

It depends on regime and effect — personal data, financial impact, and regulated decisions each carry their own clock, and several start at detection rather than at confirmation. Assess early rather than after the analysis is complete.

Is 'the model hallucinated' an acceptable explanation?

No. It names a mechanism, not a control failure. The governance finding is that an unverified output reached an actuator without a gate — which is both more accurate and more fixable.

Last verified 2026-08-07. Sources are named inline. Not legal advice.

By Julian Joseph, Founder, ApexClaw. Written from direct work operating autonomous systems under governance. Reviewed against the claims policy: sourced, first-party, or labelled.