An AI agent, not a human operator, ran a recent multi-cloud intrusion from first probe to data theft, chaining stolen credentials across AWS, Google Cloud, Kubernetes, CI/CD pipelines and the victim’s identity provider, according to Wiz’s incident response team.
What Wiz documented in its Monday post is essentially a single break-in artist fluent in every lock in the building, working every floor at once and never stopping to rest. To the AI agent, the victim’s clouds, containers, pipelines and logins were not separate buildings but one connected house.
The agent got in through a Java remote code execution flaw in an internet-exposed Kafka UI instance, one of several doors it tried. Wiz did not name a CVE and said the agent fired exploits for well-known flaws rather than novel ones.
This was a real incident, not a lab demo. Wiz’s customer incident response team reconstructed it from the victim’s own logs, according to the post.
Speedrunner Hack: No Coffee Breaks, No Overtime Pay
What marks it as AI-run rather than ordinary automation is the behavior. The agent worked AWS, Google Cloud, Kubernetes and CI/CD in parallel, ran to hundreds or thousands of actions an hour with no working-hour pauses, read each error and rewrote its broken scripts within minutes, and kept hunting for new entry points after it was already inside.
The same source IP scanned more than 600 other Wiz customer environments in the same window.
This was not an isolated hit, and the broader numbers show why. CrowdStrike’s 2026 Global Threat Report clocked the average time from break-in to lateral movement at 29 minutes in 2025, down from 48 a year earlier, and logged an 89% year-over-year jump in attacks by AI-enabled adversaries. Most telling: 82% of intrusions used no malware at all; just stolen credentials and native tools, the same profile as the Wiz case.
Practitioners care because of where the evidence lands. An attack like this touches many parts of a company’s cloud at once, and each part keeps its own log: the identity provider, the cloud control plane, the CI/CD pipelines, the workloads. The traces the attacker leaves in each one, its footprint, end up scattered across all of them, so no single alert shows the whole picture, and it all moves faster than a human team can follow.
Not a Rogue AI Acting Alone
Human operators pointed an AI agent at the target and let it do the tactical heavy lifting, labeling their tools and files pentest, probe and exfil in what Wiz reads as an effort to talk the model past its safety guardrails.
Wiz did not quantify damages to the victim’s network.
With stolen Kubernetes tokens and cloud credentials, the agent chained its way to cluster-admin. It minted a backdoor administrator identity. It set up persistence across accounts. Then it moved data out through three channels, such as a webhook.site, the victim’s own source control and a Kubernetes ConfigMap. All of it ran before the account was cut off.
The three exfiltration techniques explained:
- webhook.site: A free “request-catcher” service that logs whatever is sent to it, so the agent used it as a quick drop box for stolen data.
- The victim’s own source control: The company’s internal code repository; the agent committed dumped data into it, hiding the theft inside normal developer activity.
- A Kubernetes ConfigMap: A built-in store meant to hold app settings; the agent created one and stashed output there, turning a routine config object into a staging spot.
Some exfiltration attempts were blocked, and Wiz named neither the victim nor the scale of what was taken.
AI Is Doing the Hacking’s Grunt Work Now
Attackers keep handing more of the keyboard work to AI, and defenders keep piecing it together after the fact. The loudest public marker came in Anthropic’s November 2025 report on GTG-1002, a group it tied to the Chinese state, which described Claude Code running an estimated 80% to 90% of tactical work against about 30 targets, at a request rate no human team could match. That account, though, came from the AI maker’s own logs, and researchers disputed it for exactly that reason.
Wiz documents the same behavior from the defender’s side, rebuilt from the victim’s own cloud, identity and pipeline logs rather than an AI vendor’s telemetry. Same machine-speed operator, seen through the glass the target actually controls.
The trend where people steer AI agents to do the grunt work at machine speed and not AI acting on its own is becoming well documented. SPB traced the ARTEX pen-testing agent through South Korea’s 66,000-victim bank hacks and watched an OpenAI research agent slip past Services Australia’s Medicare blocks. In each case a human set the target and the agent did the labor. None of it was an autonomous AI choosing its own victims.
Hype, Nothing-new, or a Real Turn?
The open question is how autonomous these AI attacks really are. The argument has been long on claims and short on proof from the victim’s side. Wiz’s case offers a proof point.
Anthropic’s disclosure of the GTG-1002 campaign split the security community. Some researchers dismiss Anthropic’s autonomy figures as overhyped marketing or regulatory theater. Others posit “there is nothing new to see here”, since attack automation has existed for years. Still others call it a tipping point in machine-speed offense.
‘Nobody Beats the Wiz’? The Field Is Catching Up
The Wiz write-up does land as an informercial. However, Wiz’s fixes are sound on their own terms, unify your logs, rotate every credential a compromised resource could touch, wall off environments from one another, but each one routes back to a Wiz product, and the post never pretends otherwise.
Wiz is pitching its CNAPP, the cloud security platform category it helped define, into a field that’s now packed.
Wiz is the CNAPP market leader by most counts and the subject of Google’s $32 billion acquisition, with Microsoft Defender for Cloud close behind and Palo Alto’s Cortex Cloud, CrowdStrike Falcon Cloud Security, Orca and runtime-first upstarts such as Sysdig and Sweet Security all shipping their own cloud detection and AI SOC agents. On machine-speed intrusions Wiz is defending a lead, not chasing one, but the whole field is racing at the same problem.
Strip the AI label and this is a textbook cloud breach. Wiz documented an exposed, unpatched service, stolen tokens, lateral movement, and data out the door. The agent changed one variable, time. Every control that would have stopped it still works; defenders just have minutes now, not days, to use them. The hype is about the operator. The job is still the fundamentals.
