Call the Wolf

Kill, rotate, purge, quarantine, preserve. The first hour for a compromised agent, in that order, staged before it happens. Your runbook assumes an attacker, and three of the four incidents this summer did not have one.

October 12, 2026 · 11 min read · Jayesh Bapu Ahire

There is a scene in Pulp Fiction that every incident responder I know can quote, and most of them do not realize they are quoting a runbook.

Jules and Vincent are driving through the Valley with Marvin in the back seat, and then Vincent's gun goes off, and there is no more Marvin, and the inside of the car is a problem that cannot be driven around. They pull into Jimmie's garage in Toluca Lake. Jimmie's wife is due home from work in about an hour and a half. Nobody has a plan. So Marsellus Wallace makes one call, and the man who answers is wearing a tuxedo at a party at eight in the morning. "I'm Winston Wolf. I solve problems." Jimmie's house is thirty minutes away. "I'll be there in ten." A title card counts it: nine minutes thirty-seven seconds later, he is in the driveway.

What I love about the Wolf, what Tarantino understood better than most people who write about crisis, is that he does not bring a philosophy. He brings a sequence. He walks the car once, asks the questions he needs and none he does not, then issues orders in an order: the back seat first, the worst of it, then the upholstery. Blankets and comforters from the linen closet, the thick dark ones, no whites, because they are going to line the seats and be ruined. The hose in the yard for the two men, and Jimmie's spare clothes. He knows the sequence because he has done it before, and he says it fast because the clock is the point. When Jules balks at the tone, the Wolf tells him, with courtesy so exaggerated it is a threat, "Pretty please, with sugar on top, clean the [expletive] car."

Everyone watching has been in the room where nobody knows what to do first. The mess is never the hard part. The hard part is that the things you must do have an order, the order is not obvious, and the clock is running.

In July 2026, some of the most capable defenders in this industry found themselves in Jimmie's garage.

Nobody had the Wolf's number

The Hugging Face intrusion has been written up from every angle, so I want to stay on one detail from the team's technical timeline that nobody has treated as the headline. When HF's responders sat down with roughly 17,600 recovered attacker actions and asked closed-source commercial models to help analyze them, the models refused. Helping analyze an intrusion looked, to the safety layer, like helping conduct one. The team fell back to an open-weights model, GLM-5.2, ran it themselves, and recovered about four times more secrets than raw log review.

Good defenders, facing an intrusion with no precedent at that scale, improvised their forensic tooling mid-incident because the tooling they reached for first said no. They were not underprepared by any normal standard, only by the standard this incident invented.

So the thesis is short. Agents need their own first hour. The runbook for a compromised laptop does not transfer, for reasons I will name one at a time. And if the forensic tooling you plan to use will refuse when you need it, you have a plan for incidents that do not happen.

Your runbook assumes an attacker

An enterprise IR runbook has a shape: identify, contain, eradicate, recover, learn. Every step rests on an assumption that held for thirty years and fails for agents.

It assumes an attacker. PocketOS lost its production volume and every backup in about nine seconds to its own coding agent holding an over-scoped token, with no attacker anywhere in the story. Your runbook's first page says "identify the adversary," and there is none. There is your agent, still running.

It assumes persistence lives on disk. For agents, it lives in memory, skills, and schedules. Rehberger's "Agent Commander" work from March showed indirect prompt injection installing durable backdoors in OpenClaw, Kimi Claw, and NanoClaw through heartbeat and scheduled tasks. The C2 layer was a prompt. Reimage every host and the backdoor comes back the next time the agent runs its schedule.

It assumes the evidence is honest. In the HF transcripts, about seven percent contained a tool call the agent pretended to issue while running something else, and I spent a whole essay on what that does to a log. The suspect wrote the record.

It assumes telemetry is on. During the HF phase, the intruding agent ran with --no-logs-no-support to suppress its own telemetry, and built its C2 from pastebins and a Hugging Face Space repurposed as a CORS relay, on the victim's own infrastructure.

And it assumes you can revoke the identity. This week's Claude session-cookie campaign rode OAuth grants from personal accounts into corporate Gmail and Drive, grants no enterprise administrator can revoke. Step two of your runbook says "disable the account." Whose account?

Four figures from the Hugging Face intrusion: 17,600 attacker actions over four and a half days, thirteen hours to cluster-admin, 136 keys in one object, and 181 enrollments. — The clock is the whole argument for staging this in advance.

Kill, rotate, purge, quarantine, preserve

Five steps, in the order you run them, which is not the order of their importance.

First, kill. Not "investigate, then decide." A brake that operates at machine speed, because the thing you are braking does. Anthropic's August 31 post-mortem describes the pattern built after its own unauthorized-action incidents: a real-time classifier that blocks the tool call, ends the task, and pages a human on sandbox probing or unexpected internet access. OpenAI's August 26 commitments go a step further: severe alerts must be investigated within 30 minutes or activity auto-pauses. The pause is the default; human attention buys continuation. One warning from Rehberger's Claude Code chain: after compromise, Auto Mode sometimes blocked Claude's own cleanup commands, having waved through the infection. Your kill switch has to sit outside the agent's judgment and its harness's, for the same reason a prompt is not a guardrail.

Second, rotate. Everything the agent held. Not what you think it held; what the reach graph says it could reach. In the HF timeline, one secret held 136 keys, and a harvested signing key let the agent forge EdDSA JWTs that were valid by construction. If you cannot list the credentials an agent held and where each could reach, you will learn it from the attacker's traffic. Issued scope is a promise; realized access is a fact. Rotate against the fact.

Third, purge. Memory, by origin. Not "wipe the memory," which destroys evidence and in most frameworks does not work anyway. Remove every entry written during the incident window, or derived from a source consumed during it, as a set. If your memory store does not carry origin, you cannot, and the Agent Commander backdoor survives your reimage.

Fourth, quarantine. Every skill, MCP server, and document source the agent consumed in the window. Each is a suspect, not a tool. In g0 the server half of that is g0 endpoint quarantine, which is a command rather than a runbook step because in the first hour nobody should be editing config files by hand.

Fifth, and this is the one that belongs at the top even though I have put it at the bottom, preserve. The record, before anything else touches it. Snapshot the transcripts, the tool-call ledger, the memory store, the egress logs, and the identity events into a place the agent cannot write, before the kill if preservation is automatic and immediately after if it is not. Then the rule that separates this from every prior runbook: if the agent could write to it, treat it as testimony, not as evidence. The record the agent produced is the suspect's account, which is the whole argument of an earlier essay, and the HF investigation is what ignoring it looks like.

Why last in the list and first in importance? Because the Wolf's sequence is a sequence of dependencies. You cannot rotate what you cannot enumerate, purge what you cannot trace to an origin, or quarantine what you cannot name. Each depends on a record kept from outside the agent before the incident began. The recorder has to already be on. If it was not, preservation becomes step one by default, because it is the only step left.

Five numbered steps for the first hour of an agent incident: kill, rotate, purge, quarantine, and preserve, with preserve marked as the one that must already be in place. — Four you can do in the hour. One you cannot.

What the Wolf had in the trunk

Four things belong in the trunk before the phone rings.

A locally hosted forensic model. HF's lesson in one line: the model you analyze the incident with cannot be one whose safety layer you do not control. Run an open-weights model on hardware you own and test it on real transcripts before you need it. Then do not over-trust it: METR's investigators wrote that a reasonable human researcher with enough time would not have made most of the errors their analysis agents made.

An immutable record store with a named custodian. Not a log bucket the platform writes to and administers: a store the agent cannot reach, held by a person whose name goes on the incident report as custodian of evidence.

Egress logs keyed by agent identity, not by host or pod. The HF intruder enrolled 181 unexpected Tailscale nodes, and it took workload alerts, days later, to surface anything, because a new node from a workload allowed to create nodes is not an anomaly at the network layer. It is an anomaly only at the layer that knows which agent is enrolling.

A kill switch, tested monthly. The scanner flags its absence for a reason: AA-RA-056 is no kill switch mechanism, AA-RA-060 is a kill switch the agent can bypass, AA-HO-088 is a missing kill switch implementation. All three are rated critical, and a switch that has never been thrown does not exist.

The tabletop, with a clock

A runbook that has never been walked through is a document, not a procedure. What follows is a composite: the incident beats are real, taken from HF and PocketOS and stitched into one afternoon. The response beats are what the runbook above says to do; only those and the seams are mine.

T plus zero. An engineering agent hits a credential mismatch, finds a broader token than it needs, and reasons that the fastest fix is to delete and recreate. Nine seconds later the production volume and its backups are gone. No alert fires, because every action was authorized.

T plus thirteen hours, on a different thread. A second agent, running an evaluation workload, achieved remote code execution in a pod thirteen hours ago; nobody knew, because workloads run code. Now it has cluster-admin and has enrolled the first of what will be 181 network nodes. Later in the same campaign, on its own operator's infrastructure, it retrieves and customizes a Linux kernel exploit for root on a worker node; CISA would go on to add that CVE to the Known Exploited Vulnerabilities catalog, the first entries attributable to an autonomous agent.

T plus five days. Workload alerts fire. Simon Willison's verdict was that they should have noticed and shut it down the moment it broke through the package proxy. Hacker News was blunter: "nobody realized what was going on for 5 days?!" Both are fair, and the only defense against hearing it about yours is the kill switch above.

T plus five days and one hour. The runbook takes over. Kill: the fleet paused. Rotate: the secret with 136 keys, the signing key, every token the reach graph names. Purge and quarantine in parallel, by a second team.

T plus five days and four hours. This is the moment to rehearse, because it is the one that breaks unrehearsed teams. An analyst notices that a command's displayed output does not match the state of the system it claims to have changed. Then another. The team pulls the raw chains of thought and finds that about seven percent of the transcripts contain tool calls the agent pretended to issue while running something else. Every timeline built in the previous three hours has to be rebuilt from records the agent could not write. If those records exist, this costs an afternoon. If they do not, every conclusion carries an asterisk that will still be there when the regulator asks.

T plus one week. The postmortem, blameless in the proper sense: never "who screwed up," always "what made this the reasonable thing for the system to do." An agent that deleted a production volume was, in its own frame, closing a ticket. The postmortem asks what gave it the token, what let the token reach the volume, and what did not stop it inside nine seconds. It also carries two lines the standard template lacks. The first is the Human of Record: the named person who authorized the agent to hold what it held, when it held it. Not to assign blame; to make the chain of authority a fact on the page rather than a debate in the room. If the line cannot be filled in, that is the finding. The second is the disclosure clock, the interval between "we knew" and "they knew," which is the number the regulator asks for first.

The wrong run

There is a cost to all of this, and it lands on you.

A kill switch that works at machine speed will sometimes kill the wrong run. A classifier that ends the task on "unexpected internet" will end tasks where the internet was expected and nobody told it. Anthropic's own Auto Mode figures show the trade plainly: the classifier caught 89 percent of dangerous commands where human reviewers caught 13.6 percent, and a classifier tuned to catch that much will also stop some of what was fine. Anthropic calls Auto Mode a best-effort classifier rather than a security boundary, which is more than most vendors will say out loud.

Our own limit is narrower. A rule that flags a missing kill switch cannot throw one; AA-RA-056 tells you before the incident that the brake does not exist, and it does not install one. And a record kept outside the agent's reach is only as good as the capture points being outside that reach in practice, which is a property of your deployment, not of our software.

We accept the false-positive trade because the asymmetry is not close. A wrongly killed run costs a retry and an annoyed engineer. A wrongly continued run cost Hugging Face five days, 181 nodes, and 136 keys, and cost PocketOS its production database in the time it takes to read this sentence. When a false positive costs minutes and a false negative costs backups, you tune for the false positive and make the retry cheap.

Nine minutes thirty-seven

At the end of the scene, the car is clean, the men are hosed down and dressed in Jimmie's spare clothes, and the Wolf drives off to breakfast without looking back. He never asks what happened in the car. What he brought was not knowledge of the crime but the order of operations, delivered fast enough to matter, by someone who had walked into a garage like that before.

Your agents are going to have a garage moment. When it comes, the difference between an incident and a catastrophe will not be how smart your responders are. It will be whether the sequence existed and the switch had been thrown at least once on purpose. Nobody calls the Wolf because they know what to do; they call him because he already knows what to do first.

The quarantine commands in g0 and the kill-switch rules it runs are steps four and one of the procedure above, checked before the phone rings. The Decision Record in Guard0 is step five: the record kept outside the agent's reach, so that when the transcripts turn out to be testimony, there is still evidence.

References

The Signal · AI Agents · Security

Jayesh Bapu Ahire

Founder, Guard0