What AI agents do offensively, and what we can actually prove.

1. Who is acting?

What offensive activity reaching these sensors can defensibly be associated with AI crawlers, interactive AI agents, or LLM-assisted automation, as separate claims?

2. How far do they go?

Around critical CVEs, do those actors only discover and probe, or do they send exploit-specific requests? An exploit attempt is observed request intent. It is never shown here as a compromise.

3. How fast do they move?

Conditional on a relevant decoy being reachable, how long after CVE publication does each cohort first probe and first attempt exploitation?

4. Do campaigns exist?

Which sessions form coherent, stable clusters that may share an operator or tooling, and which must remain singletons? A cluster is not, by itself, an AI attribution.

Why there is no curve yet

• Observed CVEs do not yet have stable exposure windows covering the period from publication, so time from publication would be left-truncated.
• Comparative curves need at least 20 first events per cohort; 18 qualifying first events are available, so any curve would be exploratory at best.

What will appear when gates pass

Kaplan-Meier style time-to-first-probe and time-to-first-exploit-attempt curves by cohort, with at-risk and censored counts, confidence bands, and "median not reached" where that is the truth. Gates:

• A CVE published after observatory launch with a decoy exposure window open from publication.
• At least two independent sensors or personas in each reported risk set.
• At least 20 first probe or first exploit-attempt events in the reported cohort.
• Stable matcher and bait versions across the exposure window, with censoring shown.