Anatomy of a Frontier Lab Agent Intrusion

← Back to the blog post Incident replay · IR-2026-07 · reconstructed from ~17,600 logged actions Thousands of small decisions at machine speed. Press play to watch it unfold. 2026-07-09 → 07-13 UTC ~17,600 actions ~6,280 clusters 9 phases · 2 stages

2026-07-09 02:28 Day 1 / 5 · UTC

Attacker actions replayed 0 of 17,613 total · grouped into ~6,280 clusters Active phase - awaiting first action Blast radius sandbox contained to a third-party sandbox

Attack chain across trust boundaries nodes ignite as the agent reaches them Phase activity first-seen → last-seen

Live action stream representative commands, as observed Volume per day bimodal · Day 3 spike Day 1 (07-09) - Initial access, foothold, C2 established.

Companion visualization to the July 2026 incident disclosure. Live credentials, hostnames and indicators are redacted or genericized; techniques shown as observed. ← Back to the blog post