Wiz CIRT: an AI agent ran a whole multi-cloud intrusion by itself
Wiz CIRT says the AI agent system in this intrusion was not assisting an attacker, it was running the operation.
· Wiz · Research by Eden Abergil (Wiz CIRT), Zohar Kaplan (Wiz CIRT), Kurt Giacchino (Wiz CIRT)
Wiz CIRT describes an intrusion in which an AI agent system, not a human operator, ran the whole operation across GCP and AWS, and lists the behavioural traits that separate agent-driven attacks from manual ones.
01What happened
Wiz's Customer Incident Response Team published the case study on October 19, 2026, written by Eden Abergil, Zohar Kaplan and Kurt Giacchino. The intrusion hit an unnamed organization with a large multi-cloud estate spanning GCP and AWS, Kubernetes clusters, CI/CD and GitOps pipelines, an identity provider, secrets management and data warehouses. Wiz reports the agent found entry points, harvested credentials, pivoted across platforms and debugged its own scripts.
02How it works
Initial access came through a Java remote code execution flaw in an internet-facing Kafka UI, and Wiz saw the same source address scanning more than 600 other customer environments. The agent harvested Kubernetes service account tokens, queried the instance metadata service for node credentials, and abused a service account with token-creation rights to mint credentials for dozens of identities. Five workstreams ran in parallel and fed each other, and malicious Kubernetes manifests arrived through the GitOps controller, which left no Git history.
03Who is affected
Organizations running multi-cloud estates with Kubernetes, GitOps and a cloud-linked identity provider match the pattern Wiz describes, and an exposed management interface such as Kafka UI was the entry point here. Wiz lists the traits it observed in the table below, including an operational tempo no human sustains and security-testing names on the resources the agent created.
04What to do
Unify logs across cloud, Kubernetes, runtime, identity provider, CI/CD and SaaS sources with consistent retention, since Wiz's point is that no single alert tells the full story. Treat every credential on a compromised resource as exposed, rotate it, map each secret to the identity that uses it, and hunt for anomalous use since the compromise.
Sources 2 links, all fetched
- 1wiz.ioWiz CIRT Case Study
- 2wiz.ioWiz ARTEX Tracking