ARTEX in real intrusions: test the time between access and containment

Sources checked: 2 November 2026. FailSafe Research.

An alert that arrives after a sensitive action has completed leaves a difficult recovery problem. Google's 30 October report describes agentic frameworks operating inside real intrusions, including ARTEX, PentAGI and CAIRN. The finding supports a practical question for defenders: how much useful authority remains available after an identity is compromised?

Read the observation within its limits

The report describes investigated activity, not a census of every attacker or a universal intrusion speed. Its examples should inform a bounded defensive exercise. Do not turn a short observed sequence into a promise that every attacker will achieve the same result, or that a product can always stop one.

Start with a business consequence: unauthorized access to a synthetic customer record, an unapproved administrative change or movement into a test environment representing a critical service. That consequence gives the exercise an observable finish line.

Agree a safe starting position

Use an explicitly authorized account and a small environment. Record the account's initial permissions, available integrations and expected restrictions. The defender should know the exercise's safety limits even when its exact timing is withheld under an agreed plan. Live customer data and unrestricted external destinations are unnecessary.

Define a maximum action budget and a person who can stop the exercise outside the agent's own workflow. These controls keep the assessment useful even if an automation component behaves unexpectedly.

Measure the response that changes access

Keep separate timestamps for the first security-relevant action, the alert, analyst acknowledgement, authority reduction and confirmed rejection of subsequent actions. Note any queued work that completes after revocation. A dashboard changing color is not sufficient evidence that an account lost access.

Repeat the permitted scenario after the chosen fix. Preserve both the original boundary failure and the corrected result, with identity details sanitized for the audience receiving the report.

Use SWARM to ask a specific question

FailSafe SWARM connects authorized attack-path testing with reproduced findings and remediation retesting. That makes it useful when the question is whether a particular workflow remains reachable after a control change. Scope the detection systems, test accounts and response owners together; an assessment cannot establish containment quality for controls it cannot observe.

For sensitive investigations, sovereign hosting and local inference can keep the assessment workflow inside the agreed enterprise boundary. Start with the agentic pentesting guide to distinguish a scoped demonstration from a broad coverage claim.

Source review, 2 November 2026: Google Threat Intelligence and Mandiant reporting. Our exercise design is a defensive recommendation, not a reproduction of an intrusion.