On October 29, 2026, Wiz published research describing an uncomfortable shift in attack practice: AI agents are now doing much of the hands-on work in an intrusion and may orchestrate the attack itself. Humans still set the goals and guardrails, but the agent writes its own tooling at machine speed, checks results, corrects itself and iterates. Wiz stresses that such attacks are currently often loud rather than stealthy, leaving a large trail of observable activity — the defensive difficulty lies in telling them apart from legitimate automation and in joining scattered signals into a complete picture.
The exposed Flowise case: one node attacking dozens more. The first case began with an exposed Flowise instance, a builder for LLM workflows. Through an unauthenticated call and a header trick that bypassed authentication, the attacker injected JavaScript that produced a shell via Puppeteer. The captured instance was then used as a staging node to mass-attack further exposed Flowise instances. About 24 hours produced 99 scripts, on average a new purpose-built script every one to two minutes.
The Java gateway case: 602 steps in four and a half hours. The second case started with a remote code execution flaw in a Java enterprise operations gateway and worked systematically through nearly the entire cloud-native attack catalogue. Wiz counted 602 distinct steps across 12 technique families in about 4.5 hours, with only seconds between phases. It also generated more than 100 ArgoCD hostname variants, scanned 15 ports on five hosts in parallel, and left about 40 temporary files.
The MCP backend case: secrets at scale. In the third case, an attacker-controlled MCP command reached a shell in an AI-agent GraphQL backend through subprocess execution. Chained remote code execution led to bulk secret theft, including cloud credentials and a Kubernetes token, plus persistence and spread across multiple pods. More than 150 different scripts were used in about 21 hours, in parallel against roughly 25 target organizations, mainly large crypto exchanges and fintech firms. Recovered tooling contained 803 lines of human-readable comments — evidence that the agent was documenting its own working steps.
Seven fingerprints, not a tick-box list
Wiz proposes seven recognition criteria: machine-paced, sustained iteration whose delays vary with step complexity; natural-language reasoning embedded in scripts and artifacts; self-correction and adaptive execution, for example in versioned script chains; a structured, breadth-first methodology covering nearly the whole technique catalogue; conspicuous simultaneity in lateral movement across many paths, ports and hosts; disciplined probe-before-payload sequencing with deliberate control of outputs, timeouts and traces; and descriptive, disposable staging artifacts that inadvertently sign the attacker. No single criterion proves an agent; only their combination, sustained over hours and systems, makes the attribution plausible.
For defenders, the priority shifts from hunting a single malicious tool to visibility across environments. Exposed AI tooling and agent interfaces should be closed first, cloud and Kubernetes logs must be joined so distributed steps read as one campaign, and containment playbooks must be in place in advance — because once an agent is iterating at machine speed, manual investigation alone is too slow.
