Outcome#
You can stop unsafe activity, contain impact, preserve useful evidence, report through the correct path, and remain responsible for commands suggested by software or AI agents.
Concept#
Continuing to experiment after a suspected credential, confidentiality, access, or data-loss incident can increase harm. Likewise, fluent agent output is not proof that a command ran or a result is correct.
Worked Example#
The answer preserves evidence, contains risk, uses the private reporting path, and leaves accountability with a person.
A correct example uses these decisions:
- Put the first incident-response actions in order. Stop the risky action and preserve evidence. -> Contain or revoke what can cause further harm. -> Report through the private incident path. -> Document verified facts and follow-up.
- Who owns an action taken by an AI coding agent? The person who authorized and reviewed the action.
- A mistaken Euler job is consuming resources. Put the immediate actions in order. Record the job ID and stop it with scancel. -> Confirm with squeue or sacct that it stopped. -> Inspect the script and first meaningful error before resubmitting.
- The only copy of a result was left in scratch and is now missing. What is the honest response? Stop creating new files there, check approved recovery options, report the loss, and reconstruct only from recorded inputs if possible.
Common Trap#
Trying to make the incident look harmless before preserving evidence or notifying the owner.
If Blocked#
If one scenario resembles a real current event, stop writing the assessment answer and select This is a real incident. The Passport leaves the exercise without collecting incident details and opens the private reporting choices in the incident guide. The incident scenarios lab provides additional safe examples.
Useful references:
Understand Before Accepting AI Output#
An AI tool must not decide whether an incident is harmless, erase evidence, or contact external services with protected details. You remain responsible for stopping, preserving safe evidence, submitting the report, and verifying that the documented incident path was followed.