A plain guide to AI agent incidents
What AI agents are, how they go wrong, and what an investigation adds. No technical background needed.
What an AI agent is
An AI agent is software that takes actions, not just answers questions. It runs on an AI model, is given tools such as email, databases, or payment systems, and is given a task.
It chooses which tools to use and in what order, often without a person approving each step. Common examples are assistants that answer customer requests, write code, or handle routine internal work.
What an agent can reach
An agent works under an account with permissions, the way an employee does. What it can reach depends on those permissions, not on the task it was given.
An agent that can read every customer record can read every customer record, even when the task needs only one.
How agents go wrong
Misdirected by content
An agent reads text from a web page, email, or document. If that text contains instructions, the agent may follow them. This is called prompt injection, and OWASP ranks it first in its Top 10 for LLM Applications (LLM01:2025).
Too much access
An agent holds more tools or permissions than its task needs, so a mistake or a misdirection can reach further. OWASP calls this excessive agency (LLM06:2025).
Plain mistakes
An agent misreads a task or acts on bad data, and takes a plausible action that is wrong.
Change over time
Behavior can change after new instructions, saved memory, or tool updates.
Words that do not match actions
An agent's own explanation of what it did does not always match what its tools did. Research has found that models often use information without saying so in their written reasoning (Chen et al., 2025). That is why records of actions matter.
What tools exist, and what they are for
Vendors sell agent management, monitoring, and guardrail tools. They record what agents do and can restrict them while they run. Organizations running agents should use them.
They are built for normal operation. After an incident, someone still has to establish what happened and what made it possible, from the records, without assuming a cause.
What an investigation adds
An investigation starts after something has happened. It preserves the evidence, rebuilds the sequence of events, measures what was affected, and checks the surroundings for what made it possible. It ends in a written report.
Terms used on this site
Agent
Software that takes actions using tools, working toward a task.
Tool call
A request an agent makes to a tool, such as reading a file or issuing a refund.
Prompt injection
Text written to make an AI follow instructions its owner did not give it.
Context
Everything an agent has in view while it works: instructions, messages, and content it has read.
Permissions
What an account is allowed to do. An agent's reach is set by its permissions.
Chain of custody
A record of who handled each piece of evidence, and when.
Fingerprint
A short code computed from a file. If the file changes, the code changes. We record one for every copy we make.
Have a specific situation?
Describe what you are seeing. We will tell you whether an investigation makes sense.