Wiz: AI agents now run much of the hands-on work in real cyber intrusions

What Wiz sees in the field

According to Wiz, a clear trend is emerging across its incident response engagements and threat hunting investigations. The agents work through harnesses that write custom tooling, inspect the results, adapt and iterate at machine speed. A human sets the goals and limits.

Wiz says these attacks can be verbose, with agents trying several approaches in parallel, and that they appear at both ends of the spectrum, from sharply targeted to broadly opportunistic. An intrusion that starts with a single exposed service can grow into cloud credential theft, Kubernetes token theft, lateral movement and bulk secret exfiltration. In Wiz's words, AI agents compress the skilled, hands-on work that such escalation once required.

There is a possible upside for defenders. Wiz says current agentic attacks tend to be noisy and leave a broad trail of observable activity. The difficulty is telling this activity apart from legitimate automation and correlating individual signals into a coherent picture of an attack.

Public cases: from ARTEX to Hermes

The post summarises recent public disclosures involving named agentic frameworks, custom workflows and unidentified tooling.

• ARTEX: Public reports describe threat actors using this agentic penetration-testing framework. In South Korea, researchers reported exploitation of internet-facing applications at financial institutions and the exfiltration of personally identifiable information belonging to approximately 67,000 people. Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China-state-aligned threat actor, and reported that ARTEX accelerated reconnaissance, password spraying and OAuth application abuse. The campaign attempted sign-ins against more than 2,250 tenants, with multiple cases of privileged cloud access achieved in under three hours. Microsoft also said most targeting attempts against hundreds of organizations were unsuccessful.
• Hermes: Hunt.io found attacker-controlled infrastructure with logs showing the Hermes AI agent running in unattended "YOLO" mode during an intrusion at Thailand's Ministry of Finance. Investigators found evidence that multiple ministry systems were compromised, along with web shells, stolen credentials and a custom Go-based implant. The initial access method is unknown, and no data exfiltration was found at the time of discovery.
• AI-assisted API exploitation: JPCERT/CC found that attackers in Japan used AI to scan for known vulnerabilities and exploit APIs, in some cases reverse-engineering Android applications to find APIs and test them for flaws such as server-side request forgery (SSRF).
• Custom workflows: CrowdStrike documented four more threat actors using AI agents against healthcare, government and private-sector targets. Setups ranged from a custom harness derived from PentestGPT, with separate supervisor and executor agents, to Claude Code workflows with varying autonomy.
• Unidentified tooling: The Dutch Institute for Vulnerability Disclosure disclosed a breach whose modus operandi suggested an agentic AI-powered attack, though its initial statement did not name the agent or framework.

Wiz concludes that agentic AI is used in several stages of real intrusions, including reconnaissance, exploitation and post-exploitation. Autonomy and evidence strength vary, but the diversity of tools suggests the trend is not limited to one framework or actor.

Three Wiz case studies and fingerprints

Wiz also presents three attacks it investigated itself. In Attack A, an exposed Flowise instance, an LLM-workflow and AI-agent builder, was compromised through an unauthenticated request and an authentication bypass, then turned into a staging node to mass-exploit dozens of other exposed Flowise instances. Attack B started with Java remote code execution on an enterprise operations gateway and drove a base64 command-and-control beacon loop that methodically swept nearly the entire cloud-native attack catalog. Attack C targeted an AI-agent GraphQL backend with an MCP interface. A chained RCE led to bulk secret exfiltration, including a cloud credential and a Kubernetes token, plus persistence across several pods.

From these cases Wiz distilled fingerprinting criteria. The first is machine-paced, sustained iteration: a rhythm too fast for a human writing tools by hand and too adaptive for a canned scanner. In Attack A, a new purpose-built script appeared roughly every one to two minutes over about 24 hours, 99 scripts in all. Attack B showed 602 unique steps over about 4.5 hours, with only seconds between phases. In Attack C, a new script landed roughly every one to two minutes for about 21 hours straight, with quick retries on 403 errors and longer gaps when the agent had to parse SPA JavaScript chunks to extract GraphQL endpoints.

The second criterion is natural-language reasoning embedded in tooling. Wiz says nearly all 99 scripts in Attack A open with a written plan, with originals in Chinese.

What it means for defenders

Wiz says the shift affects attribution, the scale of attacks and the future of defense, and that the post reflects on all three. For security teams, the practical message from the source is that agentic intrusions leave distinctive timing and reasoning traces. The challenge is separating them from legitimate automation and linking the signals together before an exposed service turns into a wider cloud compromise.