- Incident replay of a frontier-lab agent intrusion reconstructed from ~17,600 logged actions.
- Thousands of small decisions at machine speed over 5 days (July 9-13, 2026), with 9 phases and 2 stages.
- Attack chain crosses trust boundaries, with blast radius contained to a third-party sandbox.
- Volume per day shows bimodal distribution with a spike on Day 3; Day 1 involved initial access, foothold, and C2 establishment.
- Companion visualization to the July 2026 incident disclosure, with redacted credentials and hostnames.