Responding to a confirmed prompt injection incident follows a specific sequence: contain the immediate exposure, understand exactly what happened and how far it spread, close the specific gap that let consequence follow from the injection, and confirm the fix actually holds. Each step depends on the traceability and enforcement infrastructure running throughout this content series being in place before the incident, since this response happens under time pressure and can't wait for that infrastructure to get built during the incident itself.
Contain the immediate source if it is still active
If the injection source, a specific document, a specific external content feed, a specific ongoing interaction, is still actively accessible or ongoing, contain it first: remove or quarantine the specific poisoned content if it was a document-based injection, or use the kill switch covered in operational readiness guidance to pause the specific affected agent or capability if the injection is exploiting an ongoing vulnerability that's still reachable.
Determine what actually happened, distinct from what was attempted
Using the investigation approach covered in incident investigation guidance, determine specifically what the injection caused: did it produce only an undesired response, or did it result in an attempted or completed unauthorized action. This distinction directly shapes the severity and scope of the required response, and it should get established with evidence from the audit trail rather than assumed based on the injection technique's apparent sophistication alone.
Trace the injection's actual reach
Search for the specific injection pattern or its variants across other sessions, documents, and identities, using the scope-tracing approach covered in investigation guidance, to determine whether this was an isolated attempt or one that succeeded repeatedly before anyone noticed, particularly relevant for indirect injection through a poisoned document that might have been retrieved by many different queries over time.
Identify and close the specific containment gap
Rather than only patching the specific injection phrasing that succeeded, which the next novel phrasing will likely bypass again, identify what containment gap let this specific injection translate into a real consequence: a tool with insufficient authorization checking, a missing output validation step, an over-broad data access grant. Fix this containment gap directly, following the defense-in-depth principle running throughout prompt injection guidance, since this is what actually bounds the impact of the next injection attempt, regardless of its specific phrasing.
Address the specific content path that carried the injection
Separately from the containment fix, address the specific path the injection traveled through: tightening access control on a document source, restricting a browsing tool's allowed domains, adding review to a previously unreviewed content feed. This addresses the entry point, while the containment fix addresses the consequence, and both are needed since neither alone provides complete protection against a recurrence.
Update the security test corpus with this specific technique
Add the specific successful injection technique to the accumulated test corpus covered in testing guidance, making sure this specific pattern gets included in future regression testing so a later change can't silently reopen the same vulnerability without getting caught.
Check for the same gap in similar systems
Following the investigation guidance covered elsewhere, check whether other AI systems in the organization share the same containment gap or content path vulnerability, since a successful technique against one system is often applicable against a similar system with a similar architecture.
Communicate with affected parties if the incident's scope warrants it
If the injection resulted in unauthorized access to another party's data or an unauthorized action affecting a customer, coordinate with legal and communications functions on appropriate notification, following the incident reporting guidance covered elsewhere, based on the actual, traced scope of impact rather than a preliminary, potentially incomplete assessment made before the investigation wrapped up.
Verify the fix through testing before considering the incident closed
Before closing the incident, run the specific injection technique, along with variants, against the fixed system to confirm the containment fix and content path fix both actually hold, rather than assuming a code change addressed the issue with no direct verification after the fix.
Where TELEON fits
TELEON's audit trail, applied through the gateway or supported middleware, supports tracing an injection's actual reach across sessions and identities, and its policy enforcement, once containment gaps are identified, provides a place to implement stronger tool authorization or approval requirements as part of the fix.
Determining the specific containment gap, fixing the content path vulnerability, and coordinating communication with affected parties remain incident response work that has to be performed directly by the team responding to the specific incident.
A short checklist
- Contain the immediate source if it remains actively accessible.
- Determine actual consequence using audit trail evidence, not
assumption based on technique sophistication.
- Trace the injection's actual reach across other sessions and content.
- Identify and close the specific containment gap the injection
exploited.
- Separately address the content path that carried the injection.
- Add the specific technique to the accumulated regression test corpus.
- Check for the same gap in other, similar systems.
- Verify the fix through direct testing before closing the incident.
Prompt injection incident response works through a specific sequence, contain, understand, close the containment gap, close the content path, verify, since fixing only the specific phrasing that succeeded leaves the underlying gap available for the next technique that comes along.