Placing the Suspect Behind the Prompt

We’re headed toward getting really good at proving what the AI did while remaining unsurprisingly bad at proving who put it in a position to do it. We’re building tools to stop the machine, but we also need evidence to identify the person behind it.

Ovie Carroll recently put a name to an argument that digital investigators are going to hear: SAIDI,  “Some Artificial Intelligence Did It.” In his article, AI Did It: Why Digital Investigative Analysts Must Not Outsource Judgment to Artificial Intelligence, Ovie demonstrated how an autonomous AI agent could modify a file without creating some of the traditional user-activity artifacts an examiner might expect to find. His point goes directly to attribution: the fact that something happened on a computer does not necessarily tell you who or what caused it.

That problem sounds very familiar to me.

I have always looked at digital forensics through the lens of attribution. Not necessarily attribution to a named person in every case, but attribution of an act, event, or result to its source so that responsibility can be evaluated.

Incident response? Sure. Attribution can be part of incident response too. But once the question becomes not only what happened and how to stop it, but who caused it, what evidence supports that conclusion, and someone or some org will be held responsible, you are doing forensic attribution.

That is the problem I have described for years as placing the suspect behind the keyboard. The keyboard was never literally the point. The point was connecting a person to the activity, with one of the ways being the forensic analysis of computing devices and data.

At the most basic level, I think of the attribution relationship like this:

That sounds simple until you test the assumption. A commonly shared computer with shared password complicates attribution by analysis alone. Remote access and stolen credentials expand on these complications. Even an IP address identifies network activity associated with an address at a point in time. It does not identify the human being behind it.

But PERSON → DEVICE still does not fully describe the attribution problem. The issue is whether the suspect can be connected to the act or event under investigation. A more complete chain is:

Person → Device → Activity/Event

From the Person to the Event

Digital forensic tools are exceptionally good at describing machines. Depending on the available artifacts, we can establish that a program executed, an account authenticated, a file was created, a message was transmitted, a browser recorded access to a site, or a process contacted a remote system. Sometimes we can reconstruct the sequence with timestamps at second-level or finer granularity.

That may establish:

DEVICE → EVENT

But the chain can still break at:

PERSON → DEVICE

In 2025, Hannes Spichiger gave useful names to parts of this problem: the Person-Device Gap and Person-Account Gap. His taxonomy separates the person, user, account, and device instead of silently treating them as the same thing.

The Chain Was Already Getting Longer

The old picture of one person sitting at one computer using one account was becoming inadequate long before generative AI appeared.

One person may own several devices. One device may contain several user profiles. One profile may access dozens of accounts. A single account may be accessed by multiple devices. Authenticated sessions, tokens, and delegated authorization can persist. Cloud applications can continue operating after the original device disconnects. Remote access can separate the physical location of the computer from the person controlling it.

So, a more realistic attribution chain may already look like this:

Person → Access Device → Local Profile → Account/Identity → Authentication → Session → Activity/Event

Each node exposes an assumption that otherwise disappears inside phrases such as “the suspect’s computer” or “the suspect’s account.”

The account may belong to the suspect, but was the relevant session theirs? The session may have originated from the suspect’s laptop, but was the suspect operating it? The laptop may have been in the suspect’s home, but could it have been controlled remotely?

These are attribution questions, not technicalities.

Agentic AI Inserts More Distance Between the Person and the Act

If the practitioner never checks whether agentic AI was involved, the entire event can be misread. An examiner may attribute an action to the human because it occurred in that person’s account, profile, or device, or may conclude an action never occurred because the familiar artifacts of human interaction are missing.

Agentic AI can produce both conditions. Before deciding who did what, the investigator has to determine whether a person, ordinary software, automation, or an AI agent actually performed the consequential act. Otherwise, the attribution may be wrong before the analysis even begins.

Traditional computer activity often involved relatively direct interaction. A person typed a command, clicked a button, sent a message, opened a file, or launched a program. The machine recorded evidence close in time to the person’s action.

With an AI agent, the human may not directly perform the consequential activity at all. The person may supply an objective or instruction. The agent may interpret that instruction, select a tool, call another service, retry after failure, and eventually perform an action without requiring approval for each intermediate step.

The chain can therefore become:

Person → Access Device → Account/Identity → Authentication → Session → Instruction/Control → Agent Runtime → Tool Invocation → Action → Result/Event

Not every investigation will require every node. The investigator needs to know which links matter and which can actually be supported with evidence.

The mistake would be jumping directly from the right side of the chain to the left.

“The AI agent sent the message, therefore the suspect sent the message.”

Maybe. But the arrows between those statements still need evidence.

The Prompt Is Only One Link

This is why I do not think the prompt should become the center of AI attribution, although it seems to make headlines. Clickbait is good to get clicks, but not for getting charges.

Prompts will attract attention because they are easy to understand. A jury can read one. A reporter can quote one. A screenshot of a suspicious prompt makes a better presentation slide than twenty pages of authentication logs.

But a prompt is still only one node in the chain. If you only read the news headlines, you’ll think it’s all you need.

Suppose a person asks an AI system how phishing campaigns work. That may be relevant, but it does not prove that the person conducted a phishing campaign. Researchers, students, security professionals, journalists, investigators, and curious people ask suspicious looking questions every day but that doesn’t make them guilty of anything.

Now add the rest of the activity. The same AI session requests example messages and receives a target list. Correlated tool and account activity registers a domain, connects an email service, receives credentials, tests the messages, changes course after failures, and is authorized to continue. Later, the resulting credentials are used to access the targeted accounts.

The original prompt has not changed but its evidentiary meaning has. Context, just like attribution, is everything.

The examination cannot stop at what the user typed. The prompt has to be tied to a session; the session to an authenticated account; the account and session back to the person; the instruction to the agent run; the run to its tools; and the tools to the resulting action.

A prompt can be evidence as part of, and not the entirety of, the attribution chain.

The Suspect Does Not Have to Be at the Keyboard

Agentic AI further weakens the intuitive connection between the time of the human action and the time of the resulting machine event.

Suppose an AI agent performs a consequential action at 3:12 in the morning and the investigation establishes that the suspect was asleep at 3:12. That fact should be documented. Don’t ignore it simply because it complicates your theory.

Maybe someone else controlled the account. Maybe the credentials were stolen. Maybe the agent behaved outside its instruction. Maybe the timestamps are wrong. Maybe the suspect is not responsible. Those possibilities should be tested.

But consider another possibility. The person configured the agent at 10:00 the night before, supplied the objective, connected the accounts, loaded a target list, tested the workflow, corrected a failure, expanded permissions, and scheduled it to begin at 3:00. The agent performed the action at 3:12. At 7:15 the person opened the dashboard and reviewed the results.

The fact that the person was asleep at 3:12 remains true. It simply does not answer the complete attribution question.

The suspect not being there at 3:12 does not, by itself, answer who caused the event.

People have always caused events indirectly through timers, scheduled tasks, scripts, malware, remote administration tools, and automation. AI increases the distance because the system may make more decisions inside the boundaries supplied by the user.

The attribution question shifts from “Who clicked the button?” to “Who created and controlled the conditions under which the action occurred?”

This is the principle I would apply to AI attribution: Every arrow represents an evidentiary link that must be supported by evidence and articulated reasoning.

Start at the bottom of the ladder. The result exists. Fine. What action produced it? What tool performed the action? What agent invoked the tool? What instruction governed the agent? Which session supplied or controlled that instruction? Which account controlled the session? Which device accessed the account? Which person was behind that device, account, or session at the relevant time?

The examiner does not need to prove every theoretical link imaginable. But the examiner should not jump across a link merely because the surrounding evidence feels persuasive. And it certainly should not be skipped because an AI tool ‘confidently’ says the pieces connect.

You may reconstruct the AI’s behavior perfectly and still have weak evidence about the person. That is no different in principle from proving that a computer downloaded a file without proving who was using the computer.

The machinery became more complicated while at the same time, the attribution requirement did not.

Attributing Autonomy

“The AI acted” is not the end of attribution. It creates another question: how much of the consequential act was directed by the person, and how much was selected by the agent?

Look at the human side: the objective, instructions, configuration, permissions, approvals, corrections, scheduling, and decisions to stop or continue.

Then look at the agent side: planning, tool selection, retries, generated subtasks, target selection, and actions that were never explicitly specified by the user.

The output alone may not tell you where that line sits.

Autonomy has to be reconstructed from the relationship between human instruction, delegated authority, agent discretion, and the resulting act.

The Legal Layer

Attribution is not the same thing as culpability.

The examiner or investigator establishes what the evidence can support: who controlled the device, account, or session; what instructions were supplied; what authority was granted; what the agent did; and what happened as a result.

Those facts may be relevant to the legal elements of an offense. But I don’t get to declare actus reus or mens rea from a forensic image.

In a criminal case, actus reus refers to the physical element required by the offense. Mens rea is the required mental state. The prosecution has to prove the applicable elements of the crime. Digital evidence may be an important part of that proof, but it is not the verdict.

Suppose a user tells an agent to “gather intel on a competitor,” gives it broad permissions, and the evidence indicates that the agent selected SQL injection as one of its methods without a specific human instruction to do so.

The forensic evidence might establish the user’s instruction, the permissions granted to the agent, its planning and execution, the tool call, the exploit, and the resulting access.

Those are attribution facts.

They do not, by themselves, answer what the person intended, knew, expected, or consciously disregarded.

So, I want the evidence before I want the theory. Did the person test the workflow? Expand permissions? Correct failures? Approve continued execution? Review the results? Did the agent act beyond the instruction? Was another person using the account? Was a token stolen? Was the agent manipulated?

Those facts may support or cut against conclusions about intent, knowledge, recklessness, authorization, or responsibility.

The examiner documents what the evidence establishes and what it does not. The decision-maker decides what those facts mean legally.

Want to Work This Problem Live?

On October 20, I’m teaching a live 3-hour Placing the Suspect Behind the Prompt workshop focused on investigating attribution when AI and autonomous agents sit between the person and the act.

We’ll work through the attribution chain, prompts, accounts, sessions, permissions, agent activity, competing explanations, and the evidence needed to connect the resulting action back to a person.

Live Online • November 17, 2026 • 3 Hours

Workshop Details & Registration https://www.suspectbehindthekeyboard.com/psbp

Placing the Suspect Behind the Prompt

AI exposes what ‘placing the suspect behind the keyboard’ meant all along.

The goal was never to prove that a suspect’s fingers were physically touching the keyboard at the precise moment an event occurred. The goal was to establish a defensible relationship between the person and the act.

With AI, that relationship may include supplying instructions, configuring the system, granting permissions, correcting failures, approving actions, scheduling activity, monitoring results, or deliberately allowing the system to continue without further human involvement.

Technology does not change the investigative principles. You still need evidence outside the box to prove who did what inside it.

The machine is evidence to be interrogated. The person is the investigation.

Don’t get that twisted.