A password spray is a familiar attack: try a few common passwords against many accounts and hope one works. In October 2026, Wiz Research watched one where the median gap between attempts was exactly one second. Sessions ran for 24 to 30 hours, and blocked addresses were replaced within minutes. No person types like that. The pattern comes from an AI agent, and it points to a tool called ARTEX.
What ARTEX is and who is using it
ARTEX is an open-source framework that runs a penetration test on its own. An operator names a target and a goal, and the agents plan and carry out the steps. Since late August, Google's Threat Intelligence Group and Mandiant have seen it used in incident response cases, by extortion groups and suspected espionage operators alike. Microsoft tracks one of those campaigns as Storm-0940. The developer stopped offering the code openly in October, but it had already been copied more than 12,000 times.
The techniques are old, and the time between them is gone
None of what the agent did is new: password spraying, abusing password-reset pages, stolen cloud keys, moving from one system to the next. Google puts it this way: "LLM-enabled offensive tooling does not fundamentally change the techniques attackers use. It reduces the time required to combine them."
The time is the difference. Google reports that one actor typically went from a first compromised account to deep access in about four hours, and once in 15 minutes. Individual steps ran in bursts of seconds: 27 events in 23 seconds while the agent tested what a stolen cloud key could do.
Three gaps, crossed in seconds
This is where the three detection gaps in my whitepaper show up in real incidents. In several cases, the operators handed ARTEX credentials they had already stolen. The agent then logged in with them, so authentication succeeds, and the record of who did what shows ordinary sign-ins (Gap 2). It also reused features that were already there, such as a business application's own notification system to email more than 1,300 employees, so nothing looks wrong (Gap 1). And it crossed from directories to cloud storage to identity services, which separate teams and tools usually watch, so movement isn't visible (Gap 3).
A human operator crossing those boundaries leaves slow, spread-out evidence. An agent leaves the same evidence compressed into minutes, in a window that three separate tickets may never connect.
The pace is the clue, but spotting it does not stop the objective
The speed is also the most readable signal. A one-second rhythm, a permission test every second or so, and a burst of 27 events in 23 seconds stand out once someone looks at timing and sequence together instead of one event at a time.
But Google makes a harder point: detection and response are different jobs, and "simply detecting the attack in time does little to hinder objective completion." If an agent can reach deep access in 15 minutes, an alert that becomes a ticket for the next morning arrives after the objective is complete. The speed of the response has to match the speed of the attacker.
The noisy version is the early version
Google describes current use as early-stage: open-source tools used carelessly, producing campaigns that are broad and noisy but still successful. Its own estimate is that quieter, fully autonomous attacks follow within three to six months. That is a forecast, not an observation. If it holds, the clues above are the easy version, and the window to build timing-based detection and a faster response is open now.
Where Vectra AI fits
At Vectra AI, this is the problem our detection work is built around: a sign-in that the audit log records as a success, followed by behavior that doesn't match the identity that signed in. Google's defensive guidance ends on the same point, that detecting behavioral change depends on seeing identity, cloud, and network activity as one sequence. An agent moving at this pace will cross all three before separate tools finish alerting.
The Mind Your Gaps in the Age of AI-Powered Attacks whitepaper walks through the three detection gaps end to end. Its sections on Gap 1 (nothing looks wrong), Gap 2 (authentication succeeds) and Gap 3 (movement isn't visible) cover the pattern described here.