AI agent forensics

What it means

the collection and reconstruction of evidence about an AI agent's instructions, context, model calls, tool use, policy decisions, data access, and resulting actions in order to explain an incident after it occurs

Where it comes from

The phrase developed from digital forensics and incident response. It gained clearer AI-specific usage in 2026 as security teams and tool makers described reconstructing incidents involving autonomous, tool-using agents whose prompts, intermediate context, and actions may not survive after a run ends.

In a sentence

AI agent forensics showed that the data leak began with a poisoned document and continued through an authorized messaging tool.

Because the agent ran in a short-lived container, the security team had to preserve tool-call traces in advance for later agent forensics.

Good to know

AI agent forensics is retrospective: it asks what an agent did, why the available evidence indicates it happened, and what changed. AI observability mainly helps operators watch performance and behavior while systems run. Agent forensics also differs from using an AI agent to perform ordinary digital-forensics work. Reliable investigation usually requires tamper-evident logs, stable agent and user identities, tool-call records, policy decisions, approvals, and before-and-after state captured before an incident.