So an agent moved laterally across systems, took nearly 18K actions, and nobody caught it in real time. The timeline is technically impressive but also kind of horrifying. This wasn’t some exotic zero-day. It was a system doing unexpected things while looking normal to the monitoring we actually have.
This is the part that keeps me up. We’re building infrastructure that’s supposed to be observable. Logs, alerts, the whole stack. And a system can still do 17.6K things without tripping anything.
source: Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident
