Summary: Wiki pages for raw/AI-incident-response/ — how incident response changes when the system under attack is probabilistic, agentic, and produces harmful output at machine speed.
Sources: raw/AI-incident-response/ (4 files, ~4.7k words)
Last updated: 2026-07-28
Pages
| Page | Source |
|---|---|
| ai-incident-response | Synthesis across all four sources — the concept, what breaks, containment, clocks |
| microsoft-ir-readiness | Microsoft Zero Trust / SFI pattern — three-stage remediation, trade-offs, success factors |
| cosai-framework | CoSAI AI Incident Response Framework v1.0 — CACAO playbooks, ATLAS mapping, autonomy ladder |
| aiid-incident-responses | AI Incident Database — public disclosure responses and what they consistently omit |
The term means three different things
- Using AI to accelerate IR (Wiz) — behavioural detection, automated timeline generation, AI-guided triage.
- Responding to incidents targeting AI systems (Microsoft, CoSAI) — the one this vault cares about.
- A public official statement by the responsible entity (AIID) — a disclosure artefact, not a process.
Meanings 2 and 3 share a name and nothing else. Keep them apart.
The core problem, in one sentence
“Traditional incident response assumes deterministic systems… A gap in a safety classifier can produce thousands of harmful outputs before any reviewer sees the first one” (source: raw/AI-incident-response/Incident response for AI systems.md).
Six things to take away
- Severity cannot be record count. Weight by “deployment domain, affected population, and content nature.”
- Root cause may not exist as a single defect. Behaviour emerges from training data × fine-tuning × retrieval × user context. Manage stakeholder expectations shaped by traditional defect analysis.
- A single test pass does not verify a fix. Watch periods after each remediation stage are mandatory, because the system is non-deterministic.
- Capture prompt logs, inference activity, tool executions, and memory state changes. CoSAI’s telemetry list. The last two are what agentic incidents are made of, and what most teams don’t log.
- Containment is architecture-specific — roll back the model, purge memory, or rebuild the vector store are different answers to different incidents.
- Responder wellbeing is a capacity decision, not a nicety. Rotation reduces effective team capacity on purpose.
Regulatory constraint that belongs in every playbook
AI Act Art 73(6): you may not alter the system in a way that affects subsequent cause evaluation before informing the competent authorities. Model rollback and memory purge are exactly such alterations. Notification goes in the first hour, alongside the 60-minute containment target. See serious incident reporting.
Reporting clocks
| Regime | Trigger | Deadline |
|---|---|---|
| Code of Practice C9 | Critical infrastructure disruption | 2 days |
| AI Act Art 73(3) | Widespread infringement / Art 3(49)(b) | 2 days |
| Code of Practice C9 | Serious cybersecurity breach | 5 days |
| AI Act Art 73(4) | Death | 10 days |
| AI Act Art 73(2) | General | 15 days |
Gaps
- The CoSAI framework PDF itself is not in
raw/— only the announcement post. The CACAO playbooks, the five architecture patterns and the ATLAS mappings are the valuable parts and are unread. - Both previously-listed gaps are now closed: MITRE ATLAS (whose 63 case studies double as ready-made tabletop scenarios) and OWASP Top 10 for LLMs (which Microsoft cites for severity adaptation).
- The Wiz source is half vendor marketing. The comparison table (conventional vs AI-driven IR) and the automated-vs-AI-driven distinction are the usable parts.
Cross-collection links
- AI Attack Techniques — what you are responding to
- AI Act Art 73 — the legal obligation
- GPAI Code of Practice — Commitment 9’s faster clocks and required root-cause schema
- Root index
Log
See log.