- Wiz says its incident responders increasingly see intrusions where AI agents appear to handle much of the hands-on work while a human sets goals and limits.
- In three attacks Wiz investigated, the agents' scripts explained their reasoning, fixed their own failures and tried many paths at once. Wiz calls the resulting noise a potential advantage for defenders.
- Leaders should ask whether their teams can tell legitimate automation from agent activity and join scattered signals into one picture.
The attacker's notebook, in three cases
Most people picture an intruder as quiet and secretive. In three attacks it investigated, Wiz found tooling that did the reverse. The scripts carried comments explaining what they tested and why. That turned the attacker's own tools into evidence.
Wiz published its findings on October 29. Across its incident response and threat hunting work, the company sees a growing pattern: software agents seem to do much of the hands-on work. A human sets the objectives and guardrails. The agents run through harnesses that write custom tools, read what comes back, adjust and try again.
The idea worth holding onto is this. A human intruder pays for being loud in fatigue and risk. Wiz says an agent pays neither cost. So the same freedom that makes these attacks fast also makes them noisy. Wiz calls that a potential advantage for defenders. It does not call it a guarantee.
Where agents have already been seen
Wiz cautions that cases differ in how independent the agent was and how solid the proof is. Its review mixes public reports with its own.
Zscaler and CrowdStrike reported that attackers used ARTEX, an agentic penetration-testing framework, against South Korean financial institutions. Personal data on approximately 67,000 people was exfiltrated. Microsoft tied the ConnectWise Cloud Backup supply-chain breach to the actor Storm-0940. It said ARTEX sped up reconnaissance, password spraying and OAuth application abuse.
Microsoft reported sign-in attempts against more than 2,250 tenants in that campaign. Several cases reached privileged cloud access in under three hours. Microsoft also reported ARTEX-driven activity against hundreds of organizations globally, most of it unsuccessful.
Hunt.io found logs of the Hermes agent running unattended in "YOLO" mode during an intrusion at Thailand's Ministry of Finance. At the time of discovery, investigators saw no sign that data had been taken. JPCERT/CC found attackers in Japan using AI to scan for known flaws and exploit APIs. CrowdStrike documented four more actors, including some using Claude Code workflows.
How Wiz recognises an agent at work
Wiz distilled its fingerprints from three attacks it investigated. The first is rhythm. A person writing tools by hand is too slow. A canned scanner is too uniform. In one attack, a new purpose-built script appeared every one to two minutes for about 24 hours, 99 scripts in all.
The second is self-explanation. In another case, Wiz recovered tooling with 803 distinct human-readable comment lines. Some comments mentioned "the other" instance of the same agent and tried to work out what it had achieved. Wiz calls this the most decisive example of self-explanation, because the tool's own notes point to an agent doing the hands-on work.
The third is adaptation. One tool's second version opened by explaining why the first had failed and what changed. In the attack with the 803 comment lines, a request-signing script went through four generations. Each diagnosed the previous 401 or 403 error and re-derived the requirement. Wiz says a fixed playbook cannot do that.
The fourth is checklist coverage. One attack worked through 12 technique families in about 4.5 hours, using 602 unique steps. The fifth is breadth. That same attack generated more than 100 ArgoCD hostname variants and scanned 15 ports across five hosts in parallel.
Why noise is an opening, not a solution
Wiz says current agentic attacks tend towards the noisy and leave a broad trail of observable activity. A human intruder usually commits to one path. In Wiz's cases, the agents tried many at once. Each attempt can leave a trace, if the right logging is in place.
Wiz is clear that the trail is not enough by itself. The hard part, it says, is telling this activity apart from approved automation. Defenders must also link separate signals into one picture of an attack. Your own build systems and scripts also run fast and in bulk. A rule that fires on speed alone could flag your own tools as well.
Wiz adds that one exposed service can be the start of a chain. It can reach cloud credentials, Kubernetes tokens, movement between systems and bulk secret exfiltration. Agents compress the skilled work that this escalation once required.
What to ask your team
Start with visibility. Can your team see requests to cloud credential endpoints and Kubernetes tokens, and tie them to one identity over time? Wiz's cases show attackers going after exactly these.
Ask how your team tells approved automation from unknown automation. If the answer is "by speed", that is not enough. Ask who owns the correlation step, because a hundred small alerts only help if someone reads them as one story.
Last, ask how quickly a stolen cloud credential can be revoked. In Microsoft's reporting, several cases reached privileged access in under three hours. In Wiz's cases, investigators recovered the agents' tooling and its notes. Defenders may not always get that. The noise is a potential advantage, but only for teams that can separate it from their own automation.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Wiz.
