Incident Response and Forensics

A vetted self-hosted forensic model, evidence preserved from ephemeral contexts, and third-party notification rehearsed.

Minimum bar (L2). Agent-specific scenarios in the IR plan. A tested kill switch that halts an individual agent, an agent class, and the entire agent estate, with documented time-to-effect for each. Evidence preservation defined for ephemeral runtimes.

14.1 Controls #

ID	Control	Minimum bar (L2)	Enforced state (L3)
RESP-1	Self-hosted forensic model	The IR plan names the specific analysis capability the team will use on malicious artifacts, and confirms it is reachable without an external approval step. A self-hosted model need not already be running, but one is selected, its hosting requirements are costed, and the decision to stage it carries an owner and a date.	A vetted, staged, self-hosted forensic model. This is the least-implemented and most immediately actionable control in the framework. Analysis of a real intrusion requires submitting attack commands, exploit payloads, and command-and-control artifacts to a model. Hosted providers’ safety classifiers cannot distinguish an incident responder from an attacker and will refuse those requests—as Hugging Face discovered mid-incident in July 2026, ultimately running their forensics on an open-weight model inside their own infrastructure.⁵ The secondary benefit is equally important: attacker data and the credentials it references never leave the environment.
RESP-2	Elevated-access programs in advance	The IR plan names which model or provider is relied on for triage at each stage, and records whether current terms and access permit the analysis of malicious content. Gaps are identified and owned before an incident rather than discovered during one.	Parallel provisioning of elevated-access programs with your primary providers, applied for in advance.⁴ The objective is redundancy, not selecting between hosted and self-hosted.
RESP-3	Runbook tested on real artifacts	The IR runbook covers agent-specific scenarios and is walked through at least annually. Testing may use representative rather than live malicious artifacts, provided the limitation is recorded—the refusal behavior it fails to surface is then a known and accepted gap, not an unknown one.	IR runbook tested against genuine malicious artifacts, not sanitized samples. The refusal behavior only appears with real payloads.
RESP-4	Evidence preservation	Defined retention for agent action logs, authorization decisions, and context sufficient to reconstruct a task after its runtime is gone, with retention exceeding the expected detection window. A manual snapshot procedure is documented for a suspected incident.	Evidence preservation from ephemeral execution contexts, including automatic snapshot-on-anomaly before a container is destroyed.
RESP-5	Third-party notification process	Documented criteria for when an incident involving your agent requires notifying an external party, with a named decision owner and a legal review path. Contact routes for major counterparties are identified in advance, because finding them mid-incident is its own delay.	Defined criteria and a rehearsed process for third-party notification when your agent affects an external party—the reciprocal of the Hugging Face position.
RESP-6	Authorization-focused post-incident review	The post-incident review template includes the agent’s full action sequence and the authorization decisions that permitted each step, not only the initial entry point. Findings are assigned owners and closure dates.	Post-incident review that examines the authorization decisions that permitted each step, not merely the entry point.

14.2 Evidence to Request #

The name and location of the staged forensic model, and the date of its last test.
Kill-switch test results with measured time-to-effect.
Rehearsal records for the Tier 1 drills and Tier 2 tabletops in Section 19.3, with findings and closure dates.

14.3 Failure Modes #

IR plans that assume a frontier model API will be available for triage, untested against the artifacts an actual incident produces.
Kill switches that exist in the orchestrator but not for agents running in SaaS platforms, third-party tools, or developer environments.
Forensic evidence destroyed by the ephemeral runtime design that was adopted as a security control.

14.1 Controls #

14.2 Evidence to Request #

14.3 Failure Modes #

References cited in this section