Tag
#incident-response
3 posts
-
Tabletop: a malicious MCP server in your engineering org, with the kill-switch question every team fails
A 60-minute tabletop built from the postmark-mcp case. Five injects, a scoring sheet, and the question most teams cannot answer yet - how fast can you turn one MCP server off on every machine?
-
Your agent installed a known-bad package: the first hour, including the credentials you forgot it could reach
Isolate the machine, preserve the agent's logs and configs, rotate every secret the agent could read from a clean device, check memory files and persistence, then scope. A minute-by-minute runbook.
-
The agent decision log: what auditors, insurers and incident responders will ask your coding agents to prove
After an agent incident, everyone asks what was installed or fetched, under which policy, and who approved it. A minimum log schema, mapped to hook and telemetry fields, lets you answer with a query.
