Mission 12 · Practice the response
The bot is compromised
Put the response in a safe order.
You have evidence that Reza’s bot instance was taken over. Real credentials stayed in the separate proxy, but the bot’s writable memory may be poisoned.
Incident coordinator
“Don’t keep chatting with the compromised copy. What comes first, and what comes next?”
The decision
Tap these steps in the safest order.
- Investigate, rotate replacement tokens, and rebuild from a clean point
Do not trust the compromised bot’s memory or settings. - Run the full verification checks before sharing access again
Refresh clean snapshots and integrity records afterward. - Contain the bot and its sandbox; close its proxy exit
Stop the ongoing activity before doing cleanup. - Preserve evidence
Save incident snapshots and relevant logs before rebuilding.
Reveal the explanation
Contain → preserve → investigate and rebuild → test. You did not try to ‘clean up’ a running compromised bot and hope for the best.
Rebuild from a clean point, and rotate what was exposed. If the infrastructure or host is compromised, the response is much broader.- For one Hermes-instance compromise, the guide rotates that friend’s replacement tokens because real credentials were not stored there.
- An infrastructure compromise can expose real bot tokens, API keys, and the CA: those must be replaced too.
- If the host itself is compromised, rebuild the whole server. Lower layers can no longer be trusted.
Incident containment
Stopping ongoing harmful activity and restricting access before investigating and rebuilding.