What happened
Wiz published a report on what it calls the rise of agentic attacks, drawing on its incident-response engagements, threat-hunting work, public disclosures, and three case studies from its own investigations. Its central observation is not simply that attackers use AI assistance. Rather, agents running through harnesses appear to perform substantial hands-on work: they write custom tooling, inspect output, adapt to what they find, and repeat the cycle at machine speed. The human operator, in Wiz’s description, supplies objectives and guardrails.
The report describes a broad attack path that can begin with a single exposed service and progress to cloud-credential theft, Kubernetes-token theft, lateral movement, and bulk secret exfiltration. Wiz says current activity may be either sharply targeted or opportunistic, and can be verbose because agents try multiple approaches in parallel. That noisiness is presented as a defensive opportunity, not a guarantee of safety: the traces have to be separated from benign automation and correlated into an attack narrative.
Wiz reviews several public cases. It cites reports that ARTEX, an agentic penetration-testing framework, was used against South Korean financial institutions, where reporting described the theft of personally identifiable information affecting about 67,000 people. It also cites Microsoft’s attribution of the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, described as a China-state-aligned actor. Microsoft reported ARTEX activity used to accelerate reconnaissance, password spraying, and OAuth application abuse in downstream Microsoft 365 environments; the campaign attempted sign-ins to more than 2,250 tenants, and multiple cases reached privileged cloud access in under three hours. Wiz notes that Microsoft also reported targeting of hundreds of organizations globally, with most attempts unsuccessful.
Another cited case involved attacker-controlled infrastructure associated with an intrusion into Thailand’s Ministry of Finance. Hunt.io found logs showing the Hermes AI agent in unattended “YOLO” mode. According to the account summarized by Wiz, the agent enumerated internal hosts, inspected files, and explored privilege-escalation opportunities. Investigators found compromised systems, web shells, stolen credentials, and a custom Go implant; the initial-access route was unknown, and there was no evidence of exfiltration at discovery. Wiz also points to JPCERT/CC’s investigation of attacks affecting organizations in Japan and elsewhere, where attackers used AI to scan for known vulnerabilities and exploit APIs, including attempts involving reverse-engineered Android applications and server-side request forgery testing. Other cited reporting describes custom workflows based on PentestGPT and Claude Code, as well as a breach where the suspected agentic tooling was not identified.
Wiz’s own first listed case began with an exposed Flowise instance, an LLM-workflow and AI-agent builder. The report says an unauthenticated POST endpoint and an internal-authentication bypass allowed injected JavaScript to use Puppeteer to spawn a shell. The compromised instance then became a staging node for mass exploitation of dozens of other exposed Flowise instances. Across these examples, Wiz’s claim is deliberately narrower than “agents independently hack everything”: evidence and autonomy vary by case, but the range of tools, sectors, and stages suggests a pattern not confined to one framework or actor.
What the archive adds
This is a new fact on an established security thread. Our earlier note, Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle, argued that security depends on whether flows and actions are appropriate in context, rather than only on secrecy or static permissions. Wiz adds incident evidence: distinguishing malicious from authorized automation is now part of that context problem.
Trend signal
The report supports Agent security moves to runtime boundaries. A prompt or declared policy cannot establish whether an observed process, credential access, or network scan is legitimate. Defenders need runtime-level evidence of what executed, what it could access, and under whose authority it acted.
Why now
The timing follows the widening availability of agent harnesses that can plan, invoke tools, inspect results, and continue a task loop. Wiz’s evidence does not establish a single triggering event or a measured growth rate. It does show that public investigations now span dedicated offensive frameworks, general-purpose coding-agent workflows, and custom systems, making the detection question more operationally urgent.
Connections to other events
A recent earlier Telegram post described Anthropic’s threat-intelligence finding that AI misuse can be organized as a multi-stage workflow covering reconnaissance, preparation, coding, social engineering, and operational scaling. Wiz contributes a different layer: incident-level signs that agentic workflows may also be carrying out reconnaissance, exploitation, and post-exploitation inside real networks. The two accounts are complementary, but neither alone quantifies the prevalence of agentic intrusions.
Why it matters
Teams building with agents should not treat this solely as a threat-intelligence item for a security operations center. Their own products and internal systems create automated behavior that can be difficult to distinguish from hostile automation: code execution, browser control, API calls, cloud access, secret retrieval, and task retries may all be normal in a deployed harness. Without a clear inventory and attribution trail, an investigation starts from an ambiguous mass of machine activity.
The practical consequence is to make authorized agent behavior inspectable before an incident. Tie actions to an operator or service identity, record the tools and permissions used, retain execution and network traces, and define which high-impact actions should be anomalous even when performed by an approved agent. This does not eliminate misuse. It improves the chance that noisy attacker behavior becomes a detectable sequence rather than background automation.
What happens next
- Security products will add more detections aimed at agent-like execution patterns and tool-use chains. (6 months, 70%). Watch for: published detection rules that correlate process, credential, and network activity rather than flagging a model name.
- Teams deploying autonomous tool use will formalize baselines for expected agent behavior. (12 months, 65%). Watch for: agent identity, execution logging, and permission-boundary controls appearing in deployment guidance.
Limits and uncertainty
This is a vendor security report, not a prevalence study. Wiz says it is observing a trend across engagements and investigations, but the supplied material gives no denominator, incident count, methodology for estimating growth, or independent measure of how often agentic methods succeed relative to conventional tooling. Several examples rely on external public reporting, and Wiz explicitly says the strength of evidence and degree of autonomy differ across cases. The report also does not establish that particular behavior can reliably be attributed to an AI agent from telemetry alone. Noisy activity may be detectable, but legitimate automation can be noisy too.
Skill to build now
Run a one-week observability exercise for one agent-enabled workflow. List its expected identities, tools, network destinations, credential scopes, shell or browser actions, and retry behavior. Then choose two events that should trigger review even for that approved workflow, such as a new secret-access pattern or lateral network scanning. The aim is not a generic dashboard; it is a concrete baseline an investigator can compare with a suspicious execution chain.
Reader takeaway
Agentic attacks matter because they can compress the iterative work of intrusion, not because every attack is suddenly autonomous. Wiz’s report suggests defenders currently have a useful advantage: these workflows can leave abundant traces. Preserve enough runtime context to tell authorized agent work from hostile automation, and correlate the traces before they become an incident narrative.
Open question
Can defenders identify agentic attack chains reliably without creating detection rules so broad that legitimate coding, testing, and operational agents constantly trigger them?