Anatomy of a Frontier Lab Agent Intrusion - Replay

← Back to the blog post<br>Incident replay · IR-2026-07 · reconstructed from ~17,600 logged actions

Anatomy of a frontier-lab agent intrusion

Thousands of small decisions at machine speed. Press play to watch it unfold.

2026-07-09 → 07-13 UTC<br>~17,600 actions<br>~6,280 clusters<br>9 phases · 2 stages

Restart

0.5×<br>1×<br>2×<br>4×

2026-07-09 02:28

Day 1 / 5 · UTC

Attacker actions replayed

of 17,613 total · grouped into ~6,280 clusters

Active phase

awaiting first action

Blast radius

sandbox

contained to a third-party sandbox

Attack chain across trust boundaries

nodes ignite as the agent reaches them

Phase activity

first-seen → last-seen

Live action stream

representative commands, as observed

Volume per day

bimodal · Day 3 spike

Day 1 (07-09) - Initial access, foothold, C2 established.

Companion visualization to the July 2026 incident disclosure. Live credentials, hostnames and indicators are redacted or genericized; techniques shown as observed.<br>← Back to the blog post