What we investigate
A suspicious prompt is a starting point, not proof of a successful compromise. Reconstruct what the application received, the actions it attempted and the actions that actually succeeded.
Response work to agree
- Identify the original message, retrieved document, webpage or tool result and preserve its version.
- Correlate orchestration traces with tool, identity and destination-system logs.
- Review the affected tool permissions and approval boundaries. Authorised owners can suspend the compromised route while preserving evidence.
- Validate the corrected trust boundary with representative legitimate and adversarial inputs in an approved environment.
What safe recovery requires
Replacing a system prompt alone does not resolve an excessive permission or untrusted-output execution path. Recovery criteria must cover the downstream action and the identity that performed it.
Start with a non-sensitive brief
Use the incident brief builder or contact the team. Describe the affected service, observed impact and whether activity is ongoing. Availability, authority and delivery scope are confirmed before response begins.
Turn observations into investigation questions
| Observation | Evidence to seek | Decision to resolve |
|---|---|---|
| An internal document contains instructions unrelated to its business purpose | Source version, retrieval reference and run context | Did the application treat that material as an instruction? |
| A tool was requested after suspicious content was read | Tool arguments, approval decision and destination event | Was the operation denied, attempted or completed? |
| Information appeared in an output or outbound request | Output record, recipient and delivery evidence | Which information was actually disclosed, and to whom? |
Validate the permission boundary
A response can look correct while a tool still retains excessive authority. Test the repaired input path together with the tool approval and destination permissions. Include an ordinary business request so a fix is not accepted solely because it disables every useful operation. Preserve the test conditions and resulting state.
What we agree to deliver
The scope identifies the questions to answer, records available, customer owners and permitted changes. Typical outputs include an event timeline, the affected boundary, approved containment actions, recovery checks and unresolved risks. The deliverables page explains how findings connect to evidence.
Continue with investigating prompt injection, or compare response engagement options.
