← Back to the blog post
Incident replay · IR-2026-07 · reconstructed from ~17,600 logged actions
Anatomy of a
frontier-lab agent
intrusion
Thousands of small decisions at machine speed. Press play to watch it unfold.
2026-07-09 → 07-13
UTC
~17,600
actions
~6,280
clusters
9
phases ·
2
stages
Restart
0.5×
1×
2×
4×
2026-07-09 02:28
Day 1 / 5 · UTC
Attacker actions replayed
0
of 17,613 total · grouped into ~6,280 clusters
Active phase
-
awaiting first action
Blast radius
sandbox
contained to a third-party sandbox
Attack chain across trust boundaries
nodes ignite as the agent reaches them
Phase activity
first-seen → last-seen
Live action stream
representative commands, as observed
Volume per day
bimodal · Day 3 spike
Day 1 (07-09)
- Initial access, foothold, C2 established.
Companion visualization to the July 2026 incident disclosure. Live credentials, hostnames and indicators are redacted or genericized; techniques shown as observed.
← Back to the blog post