What should I do when a user says my agent did something they didn't authorize?

The first hours after an agent makes a purchase, sends a message, or deletes something a user says they never approved. Contain, preserve, assess, and respond.

Short answer

Treat it as an incident. Stop the behavior, preserve the evidence, and work out what the user actually authorized before you respond in detail. Then fix the cause and make sure it can't recur. Bring in counsel early, because refunds, notifications, and what you say to the user all carry legal consequences.

The first hours

1. Contain. Pause the action type involved, for the affected user or for everyone if the cause might be systemic. This is what a kill switch is for. Revoke tokens or credentials if the agent's access might be misused.
2. Preserve. Save the action log, the conversation, the model inputs and outputs, the exact screens the user saw, and any web pages or emails the agent read. Don't let log retention delete them.
3. Tell counsel and check your insurance. Many insurance policies require prompt notice of a claim or incident, and late notice can lose you coverage.
4. Acknowledge the user. Confirm you are investigating and what you have paused. Be honest, but don't admit fault in writing before you know what happened.

Work out what happened

• What did the user authorize? Compare the action to their confirmations, standing instructions, and settings. Your log is the evidence.
• Was it prompt injection? Check whether content the agent read, such as a web page, email, or document, contained instructions that drove the action.
• Was it a model error or a bug? A misread instruction, a tool called with the wrong arguments, or a confirmation step that didn't fire.
• Who else is affected? Other users with the same configuration, and third parties who received messages, orders, or deletions.
• Was data exposed? An unwanted purchase, a changed reservation, or a stray message is not automatically a data breach. It becomes a possible breach if the agent disclosed protected information to someone who shouldn't have it, or accessed an account it wasn't allowed to. Treat these as two separate questions: what the agent did wrong, and whether data was exposed.

Respond

• Money. Decide on a refund promptly, and don't make the user prove a system defect before you investigate. If the user disputes a card charge, your evidence decides the outcome. If the agent was manipulated, the loss is likely yours.
• Third parties. Cancel orders, retract messages, or restore data where possible.
• Notifications. If data was exposed, counsel works out which rules apply. There is no single deadline. State breach laws vary, commonly requiring notice without unreasonable delay, and California, New York, and Washington now set an outer limit of 30 days after discovery. HIPAA allows no more than 60 days for individual notice. The FTC's Health Breach Notification Rule, which covers many non-HIPAA health apps, generally allows no more than 60 days, with FTC notice for breaches affecting 500 or more people. Financial institutions under the FTC's Safeguards Rule must notify the FTC within 30 days of qualifying events affecting at least 500 consumers. Customer contracts often require faster notice than any of these.
• Public statements. Make sure they match the facts and your earlier marketing. Claims that the agent was "safe" or "always asks first" may need correcting.

Prevent it from recurring

• Fix the cause, and add a regression test that reproduces the incident.
• Add or tighten the confirmation step for that action type.
• Add the attack to your prompt-injection test set if it was one.
• Update your terms, disclosures, or marketing if they promised more than the product does.
• Write down what happened and what changed. Regulators and courts look at how you responded.

Checklist an agent can run against the codebase

• Find the kill switch for each action type, and confirm it works for one user and for everyone.
• Check log retention for action logs, conversations, and model inputs and outputs, and how to put a hold on deletion.
• For the action involved, find the confirmation code path and check whether it ran.
• Search the agent's inputs for the incident for injected instructions.
• List other users with the same settings or standing instructions.

If this applies to you

Contact counsel now, not at the next release. Clients on counsel on commit get same-day incident response. Afterward, an agent product review covers the authority model and confirmation gates that prevent the next incident.