Google parent Alphabet Inc. (Nasdaq: GOOGL) said attackers are using agentic pentesting frameworks in live intrusions, giving security teams less time to detect and contain activity after credentials or another initial access route has been compromised. Its researchers said the tools can automate parts of an attack that previously required more manual operator work.
Google Threat Intelligence Group and Mandiant said they have observed threat actors using ARTEX, PentAGI, CAIRN and other potentially custom multi-agent frameworks during incident-response engagements since late August. According to the company, the activity included reconnaissance, lateral movement, database exploitation and preparation for data exfiltration across multiple stages of the attack lifecycle.
The reported change is not a new vulnerability or a security product launch. It is evidence that LLM-driven offensive tooling has moved from a theoretical concern into observed intrusions. That matters to enterprise security operations because the frameworks can test options, adapt to errors and pursue several technical steps at a pace that can compress the window for analysts to investigate unusual behavior.
ARTEX is an autonomous, multi-agent platform that the company said can translate high-level goals into system commands through specialized sub-agents. Google said it observed the framework performing Active Directory reconnaissance, privilege-escalation attempts and cloud-infrastructure profiling, including efforts to assess access to cloud resources. The original ARTEX code repository was removed in October, according to the company, but forks and related versions remain available.
In one set of observations, Google said ARTEX executed individual activity bursts lasting roughly two to 25 seconds. The company documented one sequence involving 27 events in 23 seconds while probing AWS permissions across security groups. It also described a case in which the tool adjusted an exfiltration script after an error and deployed a 17-snapshot instance in about 10 seconds. Those examples illustrate the reported speed of automated execution, not a measure of the framework’s success rate across all intrusions.
The tools still depend on familiar weaknesses. Google said adversaries used compromised credentials, exposed application interfaces, unpatched systems and overly broad permissions as entry points or opportunities for escalation. In one case, the company said supplied credentials enabled ARTEX to attempt SQL commands through exposed application programming interfaces. In another, the platform tested cloud permissions and tried to create compute resources associated with more valuable identity roles.
For security teams, the practical implication is that controls designed around slower, sequential attacker activity may produce too much delay between an alert and a containment decision. Rapid cloud-permission checks, account creation, service changes or bursts of failed commands can be difficult to interpret in isolation. Correlating those signals across identity, endpoint, cloud and application logs can help teams determine whether several events belong to a single automated operation.
Google’s recommended defenses are established security practices rather than a new control category: isolate management planes, use short-lived credentials, enforce least privilege, segment networks and look for behavioral anomalies. Organizations will still need to decide which changes can be automated and which require human approval. The company did not provide comparative data showing that any specific safeguard will stop this class of activity.
The report also reinforces the importance of basic exposure management. Agentic tools can accelerate an attack path, but the company said they still rely on access and configuration conditions defenders can reduce. For enterprise IT and security leaders, the immediate issue is whether monitoring and response processes can connect identity, cloud and application evidence quickly enough when automated tools turn a valid credential or exposed interface into a multi-step intrusion.