A complete guide for detecting, classifying, containing, and recovering from AI security incidents. Covers data leakage, prompt injection, AI agent compromise, and more.
Updated March 2026 · 7-phase response framework · 3 real-world AI scenarios
An AI security incident is any event in which AI tools, models, or agents are involved in a data breach, policy violation, or security compromise — whether through intentional attack, accidental misuse, or system failure.
Unlike traditional security incidents, AI incidents introduce unique dimensions: the attacker may be an employee with no malicious intent; the breach vector may be a natural-language prompt; the impact may include training data poisoning or model manipulation that is difficult to detect and reverse.
This playbook covers four primary AI incident types. Each requires a response process that goes beyond traditional incident response to address AI-specific evidence, containment, and remediation needs.
Sensitive data (PII, financial records, IP, credentials) submitted to an AI tool or model without authorisation.
Malicious instructions embedded in user input or retrieved content that manipulate an AI system into unsafe behaviour.
An autonomous AI agent performs actions outside its authorised scope — accessing systems, sending communications, or modifying data.
A fine-tuned or hosted AI model produces systematically harmful, biased, or adversarially manipulated outputs at scale.
Assign a severity level immediately on detection. This determines escalation, response timeline, and notification obligations.
Examples: Large-scale PII exfiltration, AI agent with system access, customer-facing prompt injection in production
Escalation: CISO + CEO + Legal notified within 1 hour
Examples: Confidential IP submitted to external AI, prompt injection with limited data access, unauthorized AI agent action without data breach
Escalation: Security Manager + CISO notified
Examples: Shadow AI tool usage with internal data, failed prompt injection attempt, policy violation without data exposure
Escalation: Security team lead notified
Examples: Unsanctioned AI tool usage with public data, potential phishing using AI-generated content
Escalation: Logged and assigned to analyst
Speed is critical. The goal is to stop the bleeding — prevent further data exposure or agent actions before the full scope of the incident is known.
Work through each category methodically. Document your findings in a secure incident record. All evidence must be preserved in its original form.
Use these templates as starting points. Adapt to your organisation, the incident type, and the audience. All external communications should be reviewed by Legal before sending.
Subject: [SECURITY INCIDENT] AI Incident — [Severity Level] — [Date]
Team,
We have identified an AI security incident requiring immediate attention. Please treat this communication as confidential.
Incident Summary: [Brief description — what happened, what AI tool/system is involved]
Severity: [P1/P2/P3/P4]
Time of Detection: [Date and time]
Data Involved: [Type of data, estimated volume, classification level]
Current Status: [Containment in progress / Contained / Under investigation]
Immediate Actions Required:
- [Action 1 required from this team]
- [Action 2]
Incident Commander: [Name]
Next Update: [Time]
Incident Bridge/Channel: [Link or number]
Do not forward this message or discuss outside of this distribution list.
Subject: Important Notice Regarding Your Information — [Company Name]
Dear [Customer/Individual Name],
We are writing to inform you of a security incident that may have affected your personal information.
What happened: [Plain-language description. Avoid technical jargon. Do not mention specific AI tools unless legally required.]
What information was involved: [List specific data types: name, email, phone, etc.]
What we have done: [Steps already taken to contain and address the incident]
What you can do:
- [Recommended action 1, e.g. monitor your accounts]
- [Recommended action 2, e.g. change your password]
For more information: Contact our privacy team at [email] or [phone].
We sincerely apologise for this incident and any concern it may cause.
[Signature — Name, Title, Company]
Regulatory Notification Timing
Australia NDB: Notify OAIC and affected individuals as soon as practicable (typically within 30 days of becoming aware). EU GDPR: Notify supervisory authority within 72 hours. US: State-specific timelines apply. Always engage Legal before sending regulatory notifications.
Fix the root cause, not just the symptom. Remediation must close the control gap that allowed the incident to occur.
Patch the vulnerability
Address the technical gap — update AI tool policies, fix prompt injection filter, restrict agent permissions.
Update DLP and monitoring rules
Deploy new detection rules targeting the attack vector observed. Test rules with synthetic data before enabling in production.
Retrain affected staff
Targeted retraining on data classification and AI usage policy. Document completion in the incident record.
Restore operations
Re-enable AI tools or agents with enhanced controls. Define enhanced monitoring window (30–90 days).
Request vendor data deletion
For third-party AI services, submit data deletion requests. Obtain written confirmation where possible.
Conduct within 5 business days of resolution. Document all findings in a Post-Incident Report (PIR).
Tip: Store PIRs in a searchable format. Over time, your PIR library becomes the most valuable input for AI security program improvement — showing patterns across incidents that individual reviews miss.
These three scenarios cover the most common AI security incidents in enterprise environments. Each includes detection signals, containment actions, and remediation steps.
Scenario
A customer support agent pastes a spreadsheet containing 500 customer names, email addresses, and phone numbers into ChatGPT to draft a bulk email campaign. The tool is not on the approved list and the data is classified as Confidential.
Detection Signals
Containment Actions
Remediation
Regulatory Note
Under Australia's Notifiable Data Breaches scheme, this may be notifiable if likely to result in serious harm. Engage Legal within 30 days of becoming aware.
The best incident response is one you never need to run. Aona AI detects Shadow AI usage, enforces data protection policies, and provides real-time monitoring across every AI tool in your organisation.
Deploys in under 5 minutes. No agents required.