How would you respond to an AI security or privacy incident?

Contains compromised AI capabilities, preserves evidence, scopes derived data and actions, remediates boundaries, and verifies safe recovery.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I first contain the impact by disabling the affected tool, source, model route, egress path, or feature while preserving a safe degraded mode where possible. I preserve versioned traces, audit events, approvals, tool receipts, source lineage, and provider identifiers, then determine which users, tenants, data, and external actions were affected. Credentials and compromised integrations are revoked through their normal security systems.

Full answer below

Practice focus

Incident response, AI-specific containment, evidence, data lineage, side-effect reconciliation, and recovery.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
AI incidents can affect prompts, data, indexes, tools, provider state, and external actions at the same time.
I first contain the impact by disabling the affected tool, source, model route, egress path, or feature while preserving a safe degraded mode where possible. I preserve versioned traces, audit events, approvals, tool receipts, source lineage, and provider identifiers, then determine which users, tenants, data, and external actions were affected. Credentials and compromised integrations are revoked through their normal security systems.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
The investigation distinguishes disclosure, poisoned data, unauthorized action, unsafe output, and resource abuse because each has a different scope and recovery path. Ambiguous tool outcomes are reconciled before retries, and affected recipients or resources are corrected or compensated. Privacy, legal, provider, security, and product owners join according to the incident plan rather than being discovered during the event.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Rotating the prompt and declaring the incident closed.
Retrying ambiguous actions during investigation.
Deleting evidence before the affected scope is known.

How would you respond to an AI security or privacy incident?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue practice

Next in path

Tech stacks

Skill areas

Human editorial direction

Was this drill useful?

Found this answer useful?