This checklist is for a confirmed prompt injection incident, not a suspected one. Someone, a user report, a monitoring alert, or an unexpected agent action, has already established that injected content changed model behavior in a way that mattered. It's built for whoever is on-call when that confirmation lands: a security engineer, an on-call responder, or whoever owns the affected agent, and it assumes containment has to happen before the full investigation wraps up. Work through it top to bottom rather than jumping straight to root cause, because the first priority is stopping any ongoing exposure. Only after that does it make sense to spend time understanding exactly what happened and why the system let it happen in the first place.

Immediate containment

  1. If the injection source is a specific document, feed, or ongoing interaction that's still reachable, quarantine or remove it before doing anything else.
  2. If the affected agent or capability is actively exploitable right now, pause it with a kill switch rather than waiting for a full fix.
  3. Suspend any credentials or tool grants the exploited session was using if there's a chance that same session is still live.
  4. Note the exact time containment took effect, since scope tracing and impact assessment both depend on that boundary being accurate.

Impact determination

  1. Pull the audit trail for the affected session and determine, from logged tool calls and outputs, whether the injection produced only an undesired response or resulted in an attempted or completed unauthorized action.
  2. Treat "attempted" and "completed" as different severities. An unauthorized action that an independent check blocked is a near miss, not a breach, and the response should reflect that.
  3. Resist judging severity from the injection technique's apparent sophistication alone. A crude injection that reached a real tool is worse than an elegant one that didn't.
  4. Identify every identity, session, or downstream system the affected interaction touched, since impact isn't limited to what the model said back to the original user.

Scope tracing

  1. Search logs and stored content for the specific injection pattern and close variants of it, not just an exact string match.
  2. If the injection was indirect, planted in a document, page, or message that gets retrieved, check how many other sessions might have pulled that same poisoned content before anyone noticed.
  3. Check whether the same content source feeds other agents or pipelines beyond the one where the incident surfaced.
  4. Establish a rough timeline for how long the poisoned content was live and reachable, since that shapes how wide the remediation net needs to be.

Remediation

  1. Fix the specific containment gap that let this injection produce a real consequence: a tool call missing an independent authorization check, an output that reached a system without validation, or a permission grant broader than the task needed.
  2. Separately, fix the content path that carried the injection: tighten access to the document source, restrict a browsing tool's allowed domains, or add review to a previously unreviewed feed.
  3. Don't stop at patching the exact phrasing that succeeded. That string is the least reusable part of the attack, and a new phrasing will get past a fix aimed only at it.
  4. If the gap is architectural, a trust boundary that was never properly enforced, flag it for a broader review rather than treating this as a one-off patch.

Closure

  1. Add the specific technique, along with any variants found during scope tracing, to the accumulated regression test corpus so a future change can't silently reopen it.
  2. Re-run the original injection and its variants directly against the fixed system before considering the incident closed. Don't rely on a code review alone to confirm a fix holds.
  3. Check whether other agents or systems share the same containment gap or content path, since a technique that worked once against one architecture often works against a similar one.
  4. Document the incident with enough detail, source, technique, consequence, fix, that it's useful to whoever handles the next one, even if that's a different person.

Where TELEON fits

TELEON's audit trail, when the gateway or supported middleware sits between the agent and its tools and model calls, gives responders the session-level record needed to separate an undesired response from an unauthorized action and to trace an injection pattern across sessions and identities. Its runtime policy enforcement is also where a newly identified containment gap gets closed in practice, by adding or strengthening an authorization check at the tool-call boundary.

Determining the specific containment gap, fixing the vulnerable content path, and deciding who needs to be told about the incident are still work the responding team has to do directly. TELEON's logging and enforcement support that work rather than perform it.

The checklist in short form

  1. Quarantine the source and pause the agent if it's still exploitable.
  2. Suspend live credentials tied to the exploited session.
  3. Use audit trail evidence to separate undesired response from unauthorized action.
  4. Trace the injection pattern and its variants across other sessions and content.
  5. Check how far indirect injection through a shared content source spread.
  6. Close the specific containment gap, not just the phrasing that succeeded.
  7. Fix the content path that carried the injection.
  8. Add the technique to the regression test corpus and verify the fix directly before closing.

A confirmed prompt injection incident rewards a specific order of operations. Contain first, because an exposure that's still open is more urgent than understanding why it opened. Then measure actual impact from evidence rather than guesswork, trace how far it spread, and close both the containment gap and the content path that carried it. Skipping straight to a narrow patch, without tracing scope or verifying the fix directly, is how the same injection technique quietly resurfaces a few weeks later against a system everyone assumed was already fixed.