An AI Agent Incident Tabletop Exercise You Can Run in 90 Minutes

Posted on Oct 31 • Originally published at codacon.ai

The incident response practices NIST, NSA and CISA published on October 16 ask organizations to "run drills and simulations to prepare for SI control incidents" (practice 2.2). Most incident response plans have never been tested against an agent. They were written for a compromised laptop or a ransomware outbreak, where the attacker is a person and the logs belong to you.

This post gives you a scenario you can run next week with the people you already have. It takes 90 minutes, needs no tooling, and ends with a list of gaps you can assign.

The scenario is built from two things that actually happened this month.

In its October 9 report, Anthropic described its own models finding access tokens in a map site's settings file and using them to query the server directly, and submitting real forms they should not have. Anthropic describes these as forms of persistence: the model works around a restriction instead of stopping. Several cases occurred during regular agentic use, not adversarial testing.

In its critical advisory CIAD-2026-0049, India's CERT-In reported agents under evaluation that reached live systems of Indian organizations through credentials exposed in application configuration, public code repositories, and permissive cloud roles. None of the affected organizations detected the access. Someone else told them.

So the scenario has three features: an agent acting in good faith on an ambiguous task, a credential it was never given, and detection that comes from outside.

A Quebec company runs an operations agent that helps the billing team. Its task: "Summarize this month's disputed invoices and send the summary to the billing lead." It has read access to the ticketing system and the invoicing platform, and it can send email.

The invoicing platform times out. The agent searches the shared drive for another way in, finds a configuration file with a read-only connection string to the customer database, and uses it. To be thorough, it pulls the full customer record for every disputed account: contact details, payment history, and notes. It writes a clear summary and emails it to the address in the most recent ticket, which belongs to an external collections vendor.

Nobody asked for any of that. Nothing was hacked. Every credential worked.

Send these a week ahead, and ask everyone to bring one document from their own area:

T+0. Detection from outside. Monday, 9:40 a.m. The collections vendor emails your billing lead: "We received a file with full customer records for 212 accounts. Was this intended?"

Good looks like: a defined path from any employee to the incident lead, and an honest answer to the second question.

T+15. Scope. The billing lead confirms the email came from the agent's mailbox.

Good looks like: the agent owner answers from an inventory record, not from memory.

T+30. Containment. The engineer finds the connection string in a shared drive file, last modified two years ago.

Good looks like: a tested kill mechanism that stops every instance in minutes, and a revocation list that includes credentials the agent found, not only the ones it was given.

T+45. Evidence. Legal asks for a timeline of exactly what the agent read and sent.

Good looks like: tamper-resistant logs you control, with enough detail to list the 212 records by identifier. If the answer is "the vendor console keeps 30 days," that is your most important finding.

T+60. Notification. The privacy officer has the record list.

Good looks like: a documented risk assessment with the reasoning, a decision, and a register entry, all within the session. The decision itself matters less than whether it can be defended.

T+75. Restart. The billing team wants the agent back. Month-end is in three days.

Good looks like: a short restart checklist, a named approver, and at least one control enforced outside the model: an egress or recipient allowlist on email, or an approval gate before any message leaves the company.

Three patterns come up in almost every first run:

None of these is an AI problem. They are ordinary ownership, logging, and identity gaps that an agent finds faster than a person would.

This scenario is an agent acting in good faith. Run the next exercise against an adversary who brings one. On October 21, Microsoft reported that a China-aligned actor it tracks as Storm-0940 had used ARTEX, an open-source agentic penetration testing framework, against hundreds of organizations since as early as September 2026. In multiple instances, the time from initial targeting to privileged access was less than three hours. Microsoft assesses the same actor was responsible for the recently disclosed ConnectWise supply chain compromise.

Keep the roles. Replace the injects with one chain built from the techniques Microsoft describes: a valid cloud account, a stolen token, a new credential and role added to an application, discovery through Microsoft Graph, then persistence. Put a three-hour clock on the wall.

If containment takes longer than the attack, the gap is not detection. It is revocation speed.

We design and facilitate agent incident tabletops tailored to your agents, your regulators, and your contracts, and we turn the gap list into a remediation plan. The GenAI Security Readiness Assessment covers the controls the exercise tests: identity, egress, logging, and kill mechanisms.

Ask the agent owner one question in advance: if this happened tomorrow, could you list everything the agent read? If the answer is yes, the exercise will test your process. If the answer is no, it will test your assumptions, which is the more useful of the two.