17,600 Actions and Nothing to Go On: What Agentic Intrusions Do to Your Investigation
A burglar picks one lock. He takes the jewellery from the bedroom, leaves the television because it is too heavy to carry, wipes the handle on his way out and is gone in eleven minutes. When you call the police, they can tell you a surprising amount from very little. The method of entry narrows down who he was. The things he chose not to take say something about what he wanted. The absence of fingerprints tells you he has done this before.
Now picture a different visitor. He tries every window in the building, including the ones on the third floor. He breaks three of them. He has four goes at the back door with the wrong sort of crowbar, gives up, and comes in through the coal chute. He opens every drawer in every room, takes nothing from most of them, and leaves his ladder propped against the wall.
You have far more to look at and far less to go on.
That is the shape of the recent reported agentic intrusions, and it has consequences for anyone who has to investigate one.
What our investigation model quietly assumes
Digital Forensics and Incident Response was built around a particular kind of adversary, and most of our tooling, training and retention policy still assumes that adversary exists.
We assume progression. An intruder moves from initial access to impact along a path that makes sense in hindsight, because a human being chose each step based on what the last one told them. If a route fails, they back out and try something else. That sequence is what allows an investigator to reconstruct a timeline rather than a pile of events.
We assume cleanup. Competent operators remove what they can. Log deletion, timestomping and the removal of staging artefacts are all documented tradecraft, and the effort an adversary puts into hiding is itself evidence of who they are.
We assume repetition. The same crews reuse the same tools, the same infrastructure and the same habits, often for years. That repetition is what makes threat intelligence economically worthwhile. It is also the foundation of the Pyramid of Pain: the higher up you force an adversary to change, the more it costs them, because changing behaviour is expensive.
Three assumptions. Each of them reasonable for two decades. All three now under pressure at the same time.
What the forensics actually show
Hugging Face published a technical reconstruction of the intrusion into their infrastructure in July 2026, and it is worth reading in full. Their team recovered around 17,600 attacker actions, grouped into roughly 6,280 clusters, across four and a half days. On 11 July alone there were 7,677 actions.
More telling than the volume is the shape. Inside a thirteen-hour window on that single day, the agent went from code execution in one worker pod to cluster-admin across multiple internal clusters. Kubernetes enumeration began at 10:10. Supply chain exploitation started at 15:51. A network pivot opened at 21:23. Internal service connectors were reached at 22:43. An operator working one hypothesis at a time does not produce a day like that. Those are several campaigns running in parallel.
Most of it failed. Hugging Face's own summary of the agent's behaviour is blunt: it tested many paths that failed, switched channels when it was blocked, and repeatedly returned to earlier leads. Most actions went nowhere. Eighty-four operations against the credential store and cluster keys were denied outright. Two attempts to reach the production database never completed. Early server-side request forgery attempts against cloud metadata died with a type error before a packet ever left the host.
None of that was cleaned up afterwards.
SentinelOne's analysis across four separate agentic intrusions reaches the same conclusion from a wider base. What characterised the agents was volume and persistence rather than sophistication, described as the relentless effort to explore possibilities a human team would have written off hours earlier. They observed no operational security discipline at all. No attempt to hide, no attempt to cover tracks. Simply continued effort through failure after failure.
And then the finding that ought to worry you most. Because these agents write unique, disposable tooling for each intrusion, there is very little left over that is worth cataloguing. No shared malware family. No reused builder. No infrastructure that shows up in someone else's incident three months later.
The paradox
Put those together, and you get a crime scene that is simultaneously enormous and uninformative.
Seventeen thousand six hundred actions, and fewer durable indicators than a careful human intrusion would have left behind. The volume of evidence has gone up by an order of magnitude. The value of that evidence, in terms of anything you can carry forward to the next incident or share with a peer, has gone down.
I argued in When the Pyramid Starts to Move that agentic systems break the economics that the Pyramid of Pain depends on, because behavioural change stops being expensive. The forensic reports now give that argument a second edge. Indicators age faster, which was the original point. On top of that, the adversary generates so much activity, so indiscriminately, that separating signal from noise becomes the dominant cost of the investigation.
Your investigation was standing on progression, cleanup and repetition. Ask yourself honestly what it is standing on now.
Four things that have to change
Scope by trajectory rather than by technique. If the adversary is pursuing an objective and selecting among many paths rather than executing a playbook, then hunting for the technique you saw last time will find one branch of the tree and miss the other eleven. Scope the investigation around what the adversary was trying to reach, and enumerate every route toward it, including the ones that did not work. I called this hunting for attack trajectories, and it matters more in the forensic phase than in detection.
Size forensic readiness for volume, not precision. An investigation that assumes a few hundred relevant events does not survive contact with seventeen thousand. That is a retention question, a telemetry coverage question, and a triage question, and all three need answering before the incident, not during it. It is worth noting that Hugging Face used machine assistance to triage their own logs, and that they recommend having a capable model vetted and running on your own infrastructure before you need it, precisely because commercial guardrails may refuse to analyse attack data at the moment you most need the help.
Treat failed paths as live exposure. This is the change most likely to be resisted, because it increases the remediation workload considerably. A human intruder's abandoned attempts are usually of historical interest. An agent's abandoned attempts are a map of every weakness it found and did not get around to using. The eighty-four denied credential store operations tell you exactly which controls held. They also tell you which ones were reachable in the first place. Remediate what the adversary touched, not merely what worked.
Make the recovery decision under acknowledged uncertainty. Root cause takes longer when the evidence is this noisy and this thin at the same time. Boards will still ask when services can come back. The answer cannot be to wait for a certainty that is no longer available, and it cannot be to guess. It has to be an evidenced risk decision, taken by accountable leaders, that states what has been established, what has not, and what compensating controls cover the difference. Organisations that have rehearsed that conversation will make it in hours. Organisations that have not will discover that nobody is willing to own it.
The ladder against the wall
One further thought, offered as reasoning rather than as a finding, because no published forensic report has yet documented it.
The Hugging Face agent staged persistence as it went. A second-stage loader that re-fetched and executed code from a pastebin on every submission. Staged RSA keys. An adversary with no cleanup discipline leaves that sort of thing lying about, and an agent optimising for objectives has no incentive to tidy up after itself.
We already know what happens to abandoned attacker infrastructure. In 2025, researchers at watchTowr took control of more than four thousand live backdoors simply by registering the expired domains that those backdoors were still calling home to. The original operators had moved on. The access had not.
Now consider that pattern at the volume and carelessness that agentic intrusions operate with, in an environment where the tooling is disposable and nobody is coming back to clean it up. The ladder is still against the wall, and the next person along the street does not need to be sophisticated to use it.
I would expect this to become an observed phenomenon rather than a predicted one within the next eighteen months. I would rather we planned for it than were surprised by it.
What to do about it
Re-scope your forensic readiness assessment around evidence volume. Establish whether your CURRENT retention, telemetry coverage and triage capacity survive an incident generating tens of thousands of relevant events.
Change the remediation standard from what the adversary achieved to what the adversary reached. Make failed attempts a remediation input, not an appendix.
Rehearse the recovery decision under incomplete root cause, with the executives who will have to take it. Define in advance what evidence is sufficient and what compensating controls are acceptable.
Hunt for staged persistence specifically, including second-stage loaders, staged keys and any outbound dependency on infrastructure you do not control.
Decide now how you will triage at machine scale, and confirm that whatever assistance you plan to use will still be available to you when the data in question is a live intrusion.
The adversary got faster, louder, and considerably less tidy. Our investigations were designed for someone careful. That mismatch is the gap worth closing this year.
