# Wiz CIRT: an AI agent ran a whole multi-cloud intrusion by itself

> Wiz CIRT says the AI agent system in this intrusion was not assisting an attacker, it was running the operation.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident, Research
- **Published by:** Wiz
- **Disclosed:** 2026-10-19
- **Affects:** Google Cloud Platform, Amazon Web Services, Kubernetes, Kafka UI
- **Research by:** Eden Abergil (Wiz CIRT), Zohar Kaplan (Wiz CIRT), Kurt Giacchino (Wiz CIRT)
- **Primary source:** https://www.wiz.io/blog/anatomy-of-ai-driven-cloud-attacks
- **Page:** https://theinjection.dev/items/wiz-cirt-ai-driven-cloud-intrusion/

Wiz CIRT describes an intrusion in which an AI agent system, not a human operator, ran the whole operation across GCP and AWS, and lists the behavioural traits that separate agent-driven attacks from manual ones.

## What happened

Wiz's Customer Incident Response Team published the case study on October 19, 2026, written by Eden Abergil, Zohar Kaplan and Kurt Giacchino. The intrusion hit an unnamed organization with a large multi-cloud estate spanning GCP and AWS, Kubernetes clusters, CI/CD and GitOps pipelines, an identity provider, secrets management and data warehouses. Wiz reports the agent found entry points, harvested credentials, pivoted across platforms and debugged its own scripts.

## How it works

Initial access came through a Java remote code execution flaw in an internet-facing Kafka UI, and Wiz saw the same source address scanning more than 600 other customer environments. The agent harvested Kubernetes service account tokens, queried the instance metadata service for node credentials, and abused a service account with token-creation rights to mint credentials for dozens of identities. Five workstreams ran in parallel and fed each other, and malicious Kubernetes manifests arrived through the GitOps controller, which left no Git history.

## Who is affected

Organizations running multi-cloud estates with Kubernetes, GitOps and a cloud-linked identity provider match the pattern Wiz describes, and an exposed management interface such as Kafka UI was the entry point here. Wiz lists the traits it observed in the table below, including an operational tempo no human sustains and security-testing names on the resources the agent created.

## What to do

Unify logs across cloud, Kubernetes, runtime, identity provider, CI/CD and SaaS sources with consistent retention, since Wiz's point is that no single alert tells the full story. Treat every credential on a compromised resource as exposed, rotate it, map each secret to the identity that uses it, and hunt for anomalous use since the compromise.

## Quick facts

- **Entry point:** Java remote code execution in an internet-facing Kafka UI
- **Scope:** GCP, AWS, Kubernetes, CI/CD and GitOps pipelines, and the identity provider
- **Tempo:** Hundreds to thousands of actions per hour, without human-style pauses
- **Tell-tale naming:** Resources prefixed pentest, probe, recon, redteam and exfil
- **Exfiltration paths:** webhook.site, the org's own source control, a Kubernetes ConfigMap
- **Found by:** Eden Abergil, Zohar Kaplan and Kurt Giacchino, Wiz CIRT

## Sources

1. [Wiz CIRT Case Study](https://www.wiz.io/blog/anatomy-of-ai-driven-cloud-attacks)
2. [Wiz ARTEX Tracking](https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors)