If poking at a defended system gets you caught and cut off, can you learn enough before the door closes?

This explores what happens to someone learning about a defended system by poking at it, when one of those pokes sets off a containment response and the answers stop coming. The corpus's short answer is that probing turns into a race against the clock. Once probing can trigger containment, the question stops being 'can the attacker eventually work it out?' and becomes 'can a coalition gather enough observations before it's removed?' How fast must a coalition gather observations before containment? puts a finite-sample bound on this: a minimum number of observations the coalition needs, which turns a question about knowledge into a question about time.

Feedback matters because it is what makes probing work at all. Can repeated quiet probes separate decoys from genuine objects? shows that, in an idealized setting, enough quiet probes that trigger nothing can tell decoys from genuine objects with error shrinking to zero. That holds as long as the two respond differently and the prober can learn those responses from feedback. The corpus implies the flip side but doesn't test it: a probe that trips containment ends the flow of observations, so quiet probing is safe but slow, and loud probing is fast but can be cut off. Can attackers evade skill scanners by refining individual skills? shows what feedback buys when it keeps flowing. ColluSkill refines each skill against scanner feedback until it slips past six scanners with 96% average success. My inference is that cutting off the feedback stops that refinement loop.

The defender's side of this is more practical than you might expect. Can defenders stop intrusions without knowing who sent them? describes an intrusion ended with the defender's own security measures, before anyone knew who sent it. Containment only needed control of the perimeter, not authority over the agent or knowledge of its origin. So a prober can be cut off blind, and the attacker never gets to negotiate. This fits the argument in Should response workflows be inside the security boundary? that once an agent has tools and credentials, the response workflow is part of what must be secured. How do we contain capable agents during evaluation? adds that capability measurement and containment guidance have mostly been studied apart.

Containment only fires where its trigger matches how attacks actually look. Why does compression defense fail at the user prompt boundary? found a defense that stopped every leak between agents but failed 23.4% of the time at the user-prompt boundary, because it assumed attackers append payloads and users can prepend them. A prober who looks different from what the tripwire expects may never lose feedback. And whether extra monitoring is worth its cost is still open: Does added monitoring improve protection at acceptable cost? designs the comparison but reports no results. The corpus explains the shape of the race, but not who tends to win it.