Attackers now run agent frameworks in real intrusions. Google logged 27 actions in 23 seconds

Twenty-seven events in twenty-three seconds. That is how long one attacker’s tooling took to probe AWS permissions across security groups in an intrusion that Google Threat Intelligence Group and Mandiant investigated. No person types that fast. Nobody reading alerts responds that fast either.

The report, published on October 30, documents threat actors using open-source agentic offensive frameworks in real incident response engagements since late August 2026. Agentic attacks have been a lab topic for a year. This is evidence from customer environments.

What Google actually observed

The frameworks named are ARTEX, Hexstrike, CAIRN and PentAGI, all built as penetration testing tools and repurposed. ARTEX, the centerpiece, is a Go-based multi-agent platform that splits the attack lifecycle across six specialized sub-agents and doubles as command and control. PentAGI supports more than a dozen cloud and local model backends, which means blocking one model provider does not stop it.

The behavior in the logs has a recognizable shape. Execution comes in bursts lasting from 2 to 25 seconds. In one case, after an error said a script was too large, the tooling adapted and deployed a 17-snapshot instance in about ten seconds. In Azure, it ran a dry-run validation sweep across eleven resource types in eight seconds. Elsewhere, it enumerated more than 110,000 Active Directory objects from a domain controller. Google also cites Wiz Research on one campaign in which attackers went from a first compromised account to deep system access in around four hours, and in one case in 15 minutes.

Two cautions keep this in proportion. These are selected investigations, not a measure of how many attackers use agents. And several of these frameworks and campaigns had been reported before; what is new is Google’s consolidated evidence of how they behave inside real environments.

The window, on one scale

Attacker tempo against a typical response chain

SecondsDays

1. 23 seconds27 permission probes in one burst, per GTIG
2. About 10 secondsTooling adapts to an error and redeploys
3. 15 minutesFastest first account to deep access cited (Wiz Research)
4. About 4 hoursTypical first account to deep access in that campaign
5. Next business dayWhere alert triage and ticket-based containment often land

We argued in October that the first systems to fail under agent adoption are the ones sized for human tempo. That was about a company’s own agents overwhelming review queues and merge pipelines. The same arithmetic now runs against the defense. A response process that needs a person to read an alert, open a ticket and ask for approval before revoking a credential is designed for an adversary who also needs coffee.

What still works at machine speed

Mandiant’s recommendations are organized in five layers, and they share one property: almost none of them depend on a human deciding in the moment.

Protect the control plane. Admin APIs, consoles, CI/CD systems, identity providers, backup infrastructure and certificate authorities should be reachable only from trusted networks. An agent cannot abuse a management interface it cannot reach.

Restrict identities and keys. Short-lived workload credentials and no long-lived secrets. A stolen key that expires in an hour limits the run; one that never expires is the run.

Harden configurations and reduce attack paths. Continuous scanning of applications and infrastructure, because the agent will find the misconfiguration faster than the quarterly review.

Protect applications from abuse of legitimate features. In one case the attackers forced test notification emails to more than 1,300 internal users through an ordinary application feature.

Detect behavioral and volumetric change. This is where the speed becomes the defender’s advantage. Twenty-seven permission checks in twenty-three seconds, sweeps of dry-run deployments, bursts of API calls from one identity: these patterns are rare in legitimate human work. Identity velocity and API burst rates are signals worth alerting on.

What to decide before the next incident

The practical consequence is about authority, not tooling. Containment actions that can be automated safely (suspending a session, revoking a token, isolating a workload) should be pre-authorized for defined patterns, so the response does not wait for an approval chain. The same discipline applies to the organization’s own AI infrastructure: AI gateways and MCP servers hold keys to everything agents touch, and they belong inside the control plane that Mandiant tells you to wall off.

Earlier this month, Anthropic showed models building full exploit chains in research settings. Google’s report shows the operational side already in the field. Neither means every attacker is autonomous. Both mean the response plan should assume the next one might be.