# Wiz: seven fingerprints that separate agentic attacks from automation

> Wiz distilled seven fingerprints of agent-driven intrusions, including machine-paced iteration and reasoning left inside the tooling.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident, Research
- **Published by:** Wiz
- **Disclosed:** 2026-10-29
- **Affects:** Flowise, Kubernetes, ArgoCD, MCP servers
- **Research by:** Avigayil Mechtinger
- **Primary source:** https://www.wiz.io/blog/the-rise-of-agentic-attacks-what-they-look-like-and-where-theyre-headed
- **Page:** https://theinjection.dev/items/wiz-agentic-attack-fingerprints/

Wiz published seven criteria for recognizing agent-driven intrusions, drawn from three attacks its team investigated: an exposed Flowise instance, a Java operations gateway and an AI agent GraphQL backend with an MCP interface.

## What happened

Avigayil Mechtinger published the criteria on the Wiz blog on October 29, 2026, drawn from three intrusions the company investigated and from public reports by Microsoft, CrowdStrike, Zscaler, Hunt.io and JPCERT/CC. Wiz presents the three as case studies of real attacks it handled, labeled Attack A, B and C. The closing section on where agentic attacks are headed is the authors' expectation rather than a measured finding, and they say so.

## How it works

The seven fingerprints are machine-paced sustained iteration, natural-language reasoning embedded in the tooling, self-correction and adaptive execution, a structured breadth-first methodology with near-complete technique coverage, verbosity in spraying many lateral-movement paths at once, probe-before-payload discipline with operations-security wrappers, and purpose-descriptive or disposable staging artifacts. Wiz argues the noise is itself the opening, because an operator that sprays hundreds of paths in an hour does not look like legitimate automation. In one case the attacker's own tooling comments referred to another agent instance, which the authors read as direct evidence of agent-driven work.

## Who is affected

Cloud and Kubernetes estates with internet-exposed AI tooling are the targets in all three cases Wiz describes. Attack A started at an exposed Flowise instance and became a staging node to mass-exploit dozens more; Attack C reached an AI agent GraphQL backend through its MCP interface and ended in bulk secret theft, including cloud credentials and a Kubernetes token.

## What to do

Build behavioral detections that can tell agent-driven activity apart from legitimate automation, then correlate single signals into one picture before acting. Wiz also advises cutting exposed attack surface first, and weighting attribution toward victimology, targeting and infrastructure rather than tool similarity, which agents now produce on demand.

## Quick facts

- **Published:** October 29, 2026
- **Found by:** Avigayil Mechtinger, Wiz
- **Criteria:** Seven fingerprints of agentic activity
- **Attack A:** Exposed Flowise: 99 scripts in about 24 hours, a new one every one to two minutes
- **Attack B:** Java operations gateway: 602 unique steps across 12 technique families in about 4.5 hours
- **Attack C:** AI agent GraphQL backend over MCP: 150-plus scripts over about 21 hours, about 25 target organizations

## Questions

### How can a defender tell an agentic attack from normal automation?

Wiz points to pace and breadth rather than tooling: agentic operators sustain machine-speed iteration for hours, cover nearly the whole technique catalog, self-correct after failures, and spray many lateral-movement paths at once. In one case Wiz counted 602 unique steps across 12 technique families in roughly 4.5 hours, a volume the authors say legitimate automation rarely produces.

### Does this Wiz report cover the same intrusion as its earlier AI-driven cloud attack write-up?

No. Wiz's October 19, 2026 post examined one multi-cloud intrusion that began at an exposed Kafka UI instance. The October 29 report presents three different cases and cites that earlier post, plus the Storm-0940 write-up, as separate in-depth examinations. Wiz does not state that any of the three new cases overlaps with them.

### Why does Wiz say attribution gets harder against agentic attackers?

Wiz argues that code and tool similarity lose value as evidence once agents generate tooling on demand for each operation, so two campaigns by one actor may share no artifacts. The authors advise weighting victimology, targeting patterns, infrastructure and objectives instead. Wiz presents this as an expectation about where agentic attacks are headed, not a measurement.

## Sources

1. [Wiz Research Post](https://www.wiz.io/blog/the-rise-of-agentic-attacks-what-they-look-like-and-where-theyre-headed)
2. [Wiz CIRT Case Study](https://www.wiz.io/blog/anatomy-of-ai-driven-cloud-attacks)