AI agent runaway action
an autonomous agent (Claude · GPT · Gemini · Copilot · custom MCP) takes actions outside its prompt scope — reads credentials it shouldn't, exfils data, installs persistence, calls an MCP tool a human wouldn't have approved. evidence is the tool-call trace, the prompt-action divergence, and the OAuth grant ledger — not the prompt itself. distinct from llm-prompt-injection (malicious input) and insider-threat (human actor).
entry point: ai agent tool call execution trace reconstructor. work the primary tools top-down — all local, no upload.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this case type.
- ai agent tool call execution trace reconstructordrop agent run log · reconstruct tool-call sequence + state mutations · runs locally
- ai agent prompt vs action divergence detectordrop agent run log · detect actions taken inconsistent with prompt · runs locally
- ai agent autonomous action accountability tracerdrop agent run log · trace responsibility for each autonomous action · runs locally
- ai agent credential handling auditdrop agent run log · audit credential usage + leakage risk · runs locally
- mcp tool call graph reconstructordrop mcp client + server log set · reconstruct tool-call dependency graph · runs locally
- ai agent persistence mechanism detectordrop agent + system state · detect persistence implanted by agent · runs locally
- ai agent network exfiltration pattern detectordrop agent network log · detect data exfiltration via agent · runs locally
also useful · secondary tools
supporting and follow-up tools. surface as the investigation widens.
- ai agent multi step transaction graph builderdrop agent run log · build graph of agent actions across steps · runs locally
- ai agent file system modification trace builderdrop agent run log + filesystem snapshot · reconstruct fs changes attributable to agent · runs locally
- mcp server permission escalation detectordrop mcp server audit log · detect over-permissioned tool exposure · runs locally
- anthropic mcp claude tool call attribution tooldrop claude tool call log · attribute each tool call to model decision · runs locally
- microsoft copilot 365 audit forensic extractordrop m365 copilot audit log · parse prompts + app context · runs locally
- Microsoft Copilot artifact forensic analyzeranalyze Microsoft Copilot artifacts including prompts, coding sessions, and AI-assisted workflows · runs locally
- GitHub Copilot usage artifact analyzerreconstruct GitHub Copilot usage, completions, and AI-assisted coding workflows · runs locally
- llm tool call injection forensic analyzerdrop agent tool call log export · parse injected args + unauthorized tool invocations · runs locally
- casb oauth token abuse detectordrop casb oauth grant export · detect excessive scope grants · runs locally
- saas overprivileged oauth scope detectordrop saas oauth grant export · detect excessive oauth scopes · runs locally
- fatcousin multi tool super timeline correlatordrop any fatcousin findings csv/json · unified timestamp-sorted timeline · runs locally
- fatcousin cross export ioc hash correlatordrop hash/ioc csv from any fatcousin tool · shared indicator intersection report · runs locally
proof & methodology
synthetic reference investigations and investigation playbooks for this case type — fixture-locked goldens, local binders, evidence order, and tool paths.
investigation guide: AI agent runaway action — methodology →
side-by-side: compare case types →
run as a case-kit pipeline
no curated stack for this case type yet. tracked in the forensics rollout — pipelines roll out one case type at a time.