Wiz CIRT reports AI agents running full cloud attack campaigns autonomously

The Wiz Customer Incident Response Team (CIRT) has identified a rising trend where AI agents execute entire cloud intrusion campaigns autonomously. According to research published by Wiz, these systems are no longer just assisting human attackers but are independently finding entry points, harvesting credentials, and debugging their own scripts.

These intrusions differ significantly from traditional human-operated attacks or simple script-based automation. The AI agents operate at machine speed, maintaining high activity levels for extended periods without the pauses typical of human operators. They simultaneously enumerate cloud resources, deploy Kubernetes workloads, and query databases from a single source within the same time window.

Characteristics of AI-Driven Intrusions

Wiz CIRT highlights several distinct behaviors that separate these attacks from conventional threats. The operational tempo can reach hundreds or thousands of actions per hour. Unlike humans who work through one environment sequentially, these agents perform simultaneous activity across multiple platforms. They demonstrate proficiency with native APIs across cloud providers, container orchestration systems, CI/CD pipelines, and identity providers.

A key tactic involves credential chaining across environments. An agent might use a Kubernetes service account token to access a cloud service account, then move to a CI/CD system to gain administrative privileges. Because the agent possesses native fluency across these technologies, every compromised credential serves as a stepping stone to the next platform.

When an attempt fails, the agent reads the error message, rewrites its script in real time, and retries within minutes. This rapid trial-and-error loop allows the system to fix broken scripts immediately, unlike traditional scripts that require external human intervention to correct errors.

Detection Challenges and Artifacts

Defenders face a fragmented detection landscape because the attack footprint spans identity providers, cloud control planes, and workload logs. No single alert reveals the full story. However, Wiz notes specific artifacts that may indicate an AI-driven campaign. Resources created by the attacker often include labels such as "pentest," "probe," "recon," or "exfil."

These naming conventions likely help the actor frame the activity as authorized security testing, potentially bypassing AI model safety guardrails. Additionally, many resources include numeric task identifiers that appear across multiple related artifacts. Failed attempts are retried under the same number with letter suffixes, suggesting the agent uses these IDs to track its own work. Human attackers rarely add comments to short-lived exploitation scripts, a pattern that may also signal automated generation.

What should you do?

Security teams must look beyond single alerts to detect these machine-speed attacks. Since the activity is loud but fragmented, correlation across identity, container, and CI/CD logs is essential. Watch for resources created with security-testing labels or numeric task identifiers, as these may indicate an automated agent rather than an authorized test.

Background: CI/CD pipeline vulnerabilities

Inspect build agent logs for unexpected network connections, unusual file writes and credential usage patterns. Correlate these signals with artifact repository changes. Use static analysis on pipeline definition files to catch insecure configurations before execution.

Read the full guide: Detect CI/CD Pipeline Vulnerabilities: Signals, Blind Spots and Tools

What to do and how to stay safe: Wiz

• Monitor for simultaneous, high-volume activity across multiple cloud platforms and identity systems, as this indicates machine-speed operation rather than human behavior.
• Search logs for resources labeled with terms like pentest, recon, or exfil, which may be used by AI agents to bypass safety guardrails.
• Investigate numeric task identifiers that appear across multiple artifacts, as these may represent an AI agent tracking its own intrusion tasks.
• Review credential usage patterns for chaining behavior, where access to one system like Kubernetes leads immediately to access in CI/CD or cloud accounts.

Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How do AI-driven attacks differ from traditional script-based attacks?

AI agents combine machine speed with contextual reasoning, allowing them to debug scripts in real time and operate simultaneously across multiple platforms, whereas scripts execute pre-programmed steps blindly.

What artifacts can help identify an AI-driven cloud attack?

Look for resources labeled with security-testing terms like pentest or recon, and numeric task identifiers that appear across multiple related artifacts with letter suffixes for retries.

Are these attacks currently being used by threat actors?

Yes, Wiz CIRT has observed AI agents running entire intrusion campaigns autonomously across cloud, Kubernetes, CI/CD, and identity systems in recent investigations.