🚨 INCIDENT RESPONSE PLAYBOOK

Your Agent Just Went Rogue.
Now What?

The average AI agent incident costs $4,700 and takes 47 minutes to resolve manually. This runbook cuts that to under 30 seconds with AgentMolt.

Sources: IBM Cost of Data Breach 2025, Deloitte AI Risk Survey
Detect
<5s
Contain
<10s
Diagnose
<30s
Fix
<2m
Verify
<5m
Post-mortem
auto
1

Detect the Incident

⏱ Manual: 15-45 min • AgentMolt: <5 sec

A runaway loop means your agent is repeating the same action endlessly — burning tokens, hammering APIs, and racking up costs every second it runs.

❌ Without AgentMolt
You notice when the bill arrives. Or when a downstream API rate-limits you. Or when a customer reports broken data. Average detection time: 47 minutes.
✅ With AgentMolt
Real-time anomaly detection flags the loop within 5 seconds. You get a Slack/email/PagerDuty alert with the agent name, loop count, and estimated cost impact.
2

Contain — Stop the Bleeding

⏱ Manual: 5-20 min • AgentMolt: 1 click

Kill the runaway agent immediately. Every second of delay costs money and compounds damage.

❌ Without AgentMolt
SSH into the server. Find the process. Hope it's the right one. Kill it. Pray nothing else breaks. If it's serverless, find the function, navigate the cloud console, disable it.
✅ With AgentMolt
One-click kill switch in the dashboard. Or it fires automatically — AgentMolt's budget circuit breaker halts any agent that exceeds its cost threshold. MCP connections severed instantly.
3

Diagnose — What Happened?

⏱ Manual: 30-60 min • AgentMolt: instant

Understand the root cause: what triggered the loop, when it started, and what damage was done.

❌ Without AgentMolt
Grep through logs. Reconstruct the agent's decision chain from scattered outputs. Hope you logged enough. Spend an hour piecing together the timeline.
✅ With AgentMolt
Full audit trail: every tool call, every LLM request, every file access — timestamped and searchable. AgentMolt shows the exact decision point where the agent went off-track, with token costs per step.
4

Fix — Patch and Prevent

⏱ Manual: varies • AgentMolt: guardrails in 30s

Apply the fix so it never happens again. Add guardrails, not just patches.

❌ Without AgentMolt
Write custom retry logic. Add hardcoded loop counters. Deploy a new version. Hope you caught all the edge cases. No guarantee it won't happen differently next time.
✅ With AgentMolt
Set a loop detection rule in the dashboard: max iterations, max cost per task, max duration. Apply across all agents or per-agent. Deploys instantly — no code changes needed.
5

Verify — Confirm Resolution

⏱ Manual: 15 min • AgentMolt: real-time

Confirm the agent is operating normally and the fix holds under load.

❌ Without AgentMolt
Manually trigger test runs. Watch logs. Wait. Check costs the next day to make sure the spike stopped. No confidence until hours pass.
✅ With AgentMolt
Live dashboard shows agent health returning to green. Cost rate normalizes in real-time. Automated smoke test confirms the guardrail triggers correctly.
6

Post-Mortem — Learn and Share

⏱ Manual: 2-4 hours • AgentMolt: auto-generated

Document what happened for the team and for compliance. EU AI Act requires this for high-risk systems.

❌ Without AgentMolt
Write a post-mortem manually. Collect screenshots. Interview team members about what they saw. File it somewhere nobody will read it.
✅ With AgentMolt
One-click incident report: timeline, root cause, cost impact, actions taken, guardrails added. Exportable for compliance (SOC 2, EU AI Act Article 26). Auto-shared to your incident channel.

The Cost of Slow Response

47 min → 30 sec
Average manual incident response vs. AgentMolt automated response
$4,700
avg cost per incident (manual)
$12
avg cost per incident (AgentMolt)
392x
cost reduction
Estimates based on IBM CODB 2025 extrapolated to agent-specific incidents

Don't Wait for the Next Incident

Set up AgentMolt in 2 minutes. Free tier covers up to 5 agents.
Kill switches, cost alerts, and audit logs — working before your next deploy.

⚡ Get Early Access — Free
📊 Check your governance score first →