Here is the number that should stop a founder mid-scroll: 60 seconds. That's how long Google's now-generally-available Alert Triage and Investigation Agent takes to investigate a security alert, gather the evidence, and hand back a reasoned verdict — against a manual triage that typically eats 30 minutes of an analyst's day. Google says the agent has already worked through more than 5 million alerts. Agentic security operations just stopped being a demo.
But the more important story sits one layer up, and it's why this belongs in a wire for people who build companies, not just people who run SOCs: the floor moved on both sides of the fight at the same time. The same Google Threat Intelligence Group whose data powers these defensive agents is the team publishing evidence that attackers now run AI inside their malware. If you take one thing from this week, take that symmetry.
What actually shipped, and what's still a preview#
Precision matters here, because "agentic SOC" gets waved around loosely. As of July 2026, one piece is GA and the rest are in preview.
Generally available: the Triage and Investigation Agent. Inside Google Security Operations, it autonomously investigates an incoming alert — enriching indicators of compromise against Google Threat Intelligence and VirusTotal, building an entity context graph, pulling network context — and returns a verdict with an explanation rather than a black-box score. It automates the decision and the evidence-gathering, the two things that make triage slow. Eligibility runs through Google SecOps Enterprise, Enterprise Plus, and Google Unified Security.
Still in preview, three agents that extend the same idea from "respond faster" to "get ahead":
- A Threat Hunting agent that scours petabytes of telemetry, including historical logs, for the subtle anomalies that bypass signature-based defenses — shifting the posture from reactive to proactive.
- A Detection Engineering agent that takes fresh exploitation patterns for unpatched vulnerabilities and writes custom detections for your environment, then validates them with synthetic events. This is the agent aimed squarely at the "we never had a rule for that" gap.
- An Agentic Automation layer that pairs dynamic AI reasoning with deterministic enterprise playbooks, deliberately keeping a human in absolute control of high-impact actions like remediation.
That last design choice is the tell. The people shipping autonomous security don't trust autonomous action — they automate the analysis and gate the consequences behind a human. It's the correct pattern, and it's the one you should copy for any agent you give production access.
The offense didn't wait for GA#
Now the other wall of screens. Google's own threat tracker has named the first malware families that call a large language model during execution — not to write phishing emails, but as a live component of the attack.
PROMPTFLUX carries a module its authors literally call the "Thinking Robot," which periodically queries the Gemini API to rewrite the malware's own source code and evade antivirus. It reads as experimental — limited evidence of full campaigns — but the capability is real and observed. PROMPTSTEAL, which Google attributes to the Russian state actor APT28 (FROZENLAKE), queries a hosted Hugging Face model to generate reconnaissance commands on the fly, disguised as an image tool, and it was used in a live operation against Ukraine. GTIG also reports a zero-day it believes was developed with AI assistance, with interest in AI-driven vulnerability discovery traced to PRC- and DPRK-linked actors.
The point for a founder isn't to panic about nation-state malware you'll probably never meet. It's the trajectory: the cost of generating novel, self-modifying, environment-specific attack tooling is falling for the attacker at the same moment the cost of triaging and hunting is falling for the defender. Manual defense against automated offense is a losing trade on cost alone.
What a team of one should actually do#
You are not going to hire a SOC. You don't need to. The move is threefold:
- Rent the agent, don't build it. If your stack already runs on a security platform that ships agentic triage, turn it on and let it close the false positives. Enterprise-grade triage is now a feature you rent, and it's the single highest-leverage security spend for a small team drowning in alert noise.
- Update your threat model to assume an automated adversary. The baseline attacker can now generate recon, tooling, and evasion with a model call. Your agents' own attack surface — the prompt-injection and memory-poisoning paths we've covered in prompt injection against payment agents and agent memory poisoning — is part of that model now, not a footnote.
- Automate the decision, gate the action. Wherever you let an agent touch production, copy Google's hybrid pattern: let it reason and gather evidence freely, but put a human (or a deterministic playbook) on anything destructive.
Agentic security crossed from "someday" to "generally available" this month. So did the version pointed at you. The founders who come out ahead are the ones who treat both facts as true at the same time.
