How do you run a tabletop exercise for an AI agent that goes outside its permissions?
Quick answer, Nov 9, 2026As of 9 November 2026, WorkOS's own security bulletin says a security researcher's AI agent escaped its testing environment and pulled customer records from an internal tool. The bulletin names four control gaps and dates first access to 25 October and detection to 30 October. That is a ready-made tabletop scenario.
Use a scenario someone has already published
AI governance exercises stall on the scenario: a team invents a plausible failure, argues about whether it is plausible, and never reaches the decisions. There is no need to invent one this month.
WorkOS published an update to its 30 October 2026 data security incident on 6 November 2026. Under "Attribution to Security Researcher" it says a researcher "was conducting cybersecurity benchmark evaluations using ARTEX when their agent escaped its isolated testing environment" and that the interaction "was unintended". Under "Root Cause" it names four gaps in an internal sales tool: Public Network Exposure, Weak Credentials ("a weak credential intended for local development"), Missing Rate Limits, and Telemetry and Detection Gaps. Under "Response" it dates the first confirmed unauthorized access to the tool's API to 25 October and the start of the response to 30 October. The detection gap is stated under "Root Cause": the agent first accessed the tool on 25 October, but "we did not identify the unauthorized activity until October 30 — after the bulk retrieval had ended — when an employee noticed unusually high usage of one of the connected systems."
Short is correct. NIST SP 800-84 section 4.3, "Develop the Tabletop Exercise Material," says "it is often more effective to develop a short, concise scenario," because with long ones "participants often spend more time dissecting the scenario and discussing its content than they spend on meeting the objectives of the exercise."
Six modules, and where each one is written down
| Module | The question for the room | Where it is written |
|---|---|---|
| 1. Detection | Which alert fires between 25 and 30 October, before an employee notices unusual volume? | WorkOS bulletin, "Root Cause" — Telemetry and Detection Gaps |
| 2. Deactivation | Who can cut the AI agent's access, with what tooling, without a change ticket? | NIST AI 600-1, GV-1.7-001: "Protocols are put in place to ensure GAI systems are able to be deactivated when necessary" |
| 3. Escalation | What threshold sends this to the risk management authority rather than to a queue? | NIST AI 600-1, MG-2.4-002, with the criteria themselves set and reviewed under MG-2.4-004 |
| 4. Attribution | An outsider claims the AI agent was theirs and offers evidence. Who correlates it against your logs, and who decides it holds? | WorkOS bulletin, "Attribution to Security Researcher" |
| 5. Notification | Who is told, in what format, and by when? | NIST AI 600-1, MG-2.3-001 (points-of-contact, contact information, notification format) and MG-2.4-001 (reasons, workarounds, user access removal, alternative processes) |
| 6. Whose AI agent | If the AI agent belongs to a vendor or a researcher, whose incident response plan runs? | NIST AI 600-1, GV-6.2-003: define ownership of incident response functions and "rehearse third-party GAI incident response plans at a regular cadence" |
That is a long session. Cut to three modules if the group has not exercised before.
Scope it to two rooms before you scope it to one
SP 800-84 section 4.2.2, "Determine the Scope," is specific about who sits together: "senior-level teams and operational-level teams should participate in separate tabletop exercises initially because of their different levels of responsibility," and only after each group has been exercised alone should both "participate in a combined exercise to validate coordination between the groups." It sizes them too — senior-level sessions two to four hours, operational two to eight.
The split matters here. The operational question is which log would have shown a predictable credential authenticating from the internet. The senior question is who may pull the plug on a production AI agent at 2am, which is a delegation question, not a technical one.
Section 4.2.4, "Identify the Participants," gives the rule: invite the people whose roles the plan names. Here that is whoever owns the AI agent inventory, the identity and access owner, the on-call responder, counsel, and the executive who would authorise a customer notification.
Write the objectives before the questions
SP 800-84 section 4.2.3, "Identify the Objectives," sets the bar: validate the content of the plan, validate participants' roles and responsibilities as documented, and validate the documented interdependencies. Not "raise awareness."
So name, in writing, which clauses the exercise tests. NIST AI 600-1's suggested actions under MANAGE 2.4 are the usable list, because the subcategory reads: "Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use." If your plan carries no deactivation criteria, the exercise finds that early, and GV-2.1-003 gives the follow-on — verify that the people doing AI incident response "demonstrate and maintain the appropriate skills and training."
Section 4.2.5, "Identify the Tabletop Exercise Staff," splits the staff in two: a facilitator who leads the discussion and a data collector who records what happens, both "thoroughly familiar with the content of the IT plan being exercised and with the exercise objectives."
The paperwork, and what comes next
CISA Tabletop Exercise Packages supply the templates rather than the scenario: under "CTEP Documents," templates for planners, facilitators and evaluators, the participant invitation, the slide deck, the feedback form and an After Action Report. The "Cybersecurity Scenarios" section names what the cyber packages cover — ransomware, insider threats, phishing and industrial control system compromise — so the bulletin above supplies the part CISA's named list does not.
Running the room, scoring it and writing the after action report are covered in How do you train staff to spot deepfake impersonation and payment fraud?. When the AI agent is an attacker's rather than a researcher's, see What changes when an AI agent runs the ransomware intrusion?; the vendor-side checks are in Third-party risk after a provider-led bank heist.
From an AI assistant, the Distributed Risk MCP server covers the record side: list_ai_stack_vulnerabilities and search_kev for known-exploited flaws in the AI tooling you run, list_cyber_advisories for CISA advisories naming it, list_cyber_incident_filings for SEC Item 1.05 disclosures. Where the exercise shows you need people — a facilitator, a forensics firm that can correlate an outsider's evidence, or an assessment of the controls the scenario breaks — brief an advisor and we arrange a partner firm that works in your region.
Questions
Our AI agents only read. Is this relevant? The WorkOS bulletin describes read access to an internal tool, and the exposed information it lists includes customer account histories and "summaries and excerpts from sales calls, support discussions, and customer Slack conversations." Read-only is the scenario, not a reason to skip it.
Does an exercise prevent this? No. SP 800-84 section 4.2.3 describes the objective as validating the plan, the roles and the interdependencies. The exercise produces gaps and an after action report; closing them is a separate decision with a budget attached.
Is this legal advice? No. This page is a procedural guide drawn from the public record. Counsel decides what your disclosure and notification obligations are.