The Rise of Agentic Attacks: What They Look Like, and Where They're Headed

What it is

Wiz research (blog post, no date given on the page) on intrusions where AI agents do the hands-on attacker work. It gives six fingerprints, drawn from three Wiz-investigated attacks (A, B, C), that help tell agentic activity from scanners, human operators and legitimate automation. The page does not name the agent framework in the Wiz cases. The attacker's own commentary in Attack C refers to "the other <agent>", a second instance of the same agent.

How it works

The fingerprints, with the concrete numbers the page gives:

• Machine-paced iteration. Cadence is variable and tracks step complexity, sustained for hours. Attack A produced 99 distinct scripts, roughly one every one to two minutes, over about 24 hours. Attack B ran 602 unique steps in about 4.5 hours on a workload that had never shown such activity. Attack C ran about 21 hours with no fatigue gaps. A deterministic auto-exploit chains commands in milliseconds, and a fixed-interval beacon clusters at one value, so neither matches.
• Embedded natural-language reasoning. Scripts open with written plans or captions (Attack A in Chinese, nearly all 99 scripts). Attack C had 803 distinct comment lines in its /tmp scripts.
• Self-correction. Versioned scripts that explain why the previous version failed (Attack A's "Flowise API-key validity test, v2"). Chains such as act3 → act3b … act3k and nodepivot.py → 2 → 3 → 4. Attack C debugged EKS request signing across four generations, noting that the authenticator rejected a us-east-1 presigned URL and rebuilding against the regional us-west-2 STS endpoint. Attack B fell back through IMDSv2, IMDSv1, ECS credential endpoints (169.254.170.2), IPv6 ([fd00:ec2::254]) and finally an InfluxDB-Flux SSRF.
• Checklist enumeration. Attack B walked 12 technique families in order: recon, tool enumeration, IMDS, container-breakout check, Kubernetes RBAC, RabbitMQ, Kubernetes API, Hazelcast, port scan, ArgoCD/dashboard, InfluxDB, deserialization research.
• Verbosity in lateral movement. Attack B generated 100+ ArgoCD hostname variants and scanned 15 ports across 5 hosts in parallel (2375, 2376, 10250, 10255, 2379, 61678, 8200 and others). Attack C swept /24 database subnets for 5432 and ran 150+ scripts against about 25 organizations (crypto exchanges and fintechs) over about 21 hours.
• Probe before payload. Attack A sent a harmless marker and fired the real exploit only if it echoed back. It also ran node -c on its backdoor and used self-deleting /tmp/.cXXXX.sh one-liners. Attack B's beacon wrapper truncated output (head -c 49152), silenced errors and cleaned up. Attack C used an out-of-band callback endpoint (/stdio-rce-a) and tight timeouts (curl --max-time 5).
• Self-named scratch files and signatures. Attack A named per-host identifiers host_a_b_c_d and left a fixed activation tag, a backdoor token and a hidden route. Attack B left about 40 descriptive /tmp files (for example influx-imds.flux, k8s_ssar_all.sh) and RabbitMQ global parameters named after the attacker's own C2 host. Attack C left /dev/shm/.x/c.py as reverse-shell persistence and files such as nodepivot*.py, dynamo*.py and coh1-48.py.

Initial access in Attack A and C was unauthenticated RCE on Flowise (/api/v1/node-custom-function) and an MCP stdio-transport RCE. The cloud-native chain was IMDSv2 credentials, service-account token, SelfSubjectRulesReview, then secrets dump.

What to do

The page gives no commands for defenders or detection queries. Its stated guidance is to:

• Build behavioral detections and correlate individual signals into one picture, since current agentic attacks are noisy.
• Separate agentic activity from legitimate automation.
• Reduce exposed attack surface and prioritize exploitable risks.
• Keep visibility and set containment and remediation workflows before an incident.

Hunting leads implied by the fingerprints: bursts of new, uniquely named scripts in /tmp or /dev/shm, IMDS fallback sequences, SelfSubjectRulesReview calls from workloads, and wide parallel port sweeps from a pod.

Caveats

• The case studies are summarized in prose only. Victims and the agent framework are redacted or unnamed.
• The page says noisy behavior is not guaranteed to be easier to detect.
• Public cases vary in autonomy and evidence. Hermes at Thailand's Ministry of Finance had unknown initial access and no confirmed exfiltration. DIVD did not name the tooling.
• Attribution weakens as tooling gets cheaper to share. Wiz suggests weighting victimology, targeting, infrastructure and objectives over code similarity.
• Public figures cited: ARTEX exfiltrated PII of about 67,000 people in South Korea. The Storm-0940 ConnectWise campaign attempted sign-ins against more than 2,250 tenants, with privileged cloud access in under three hours in several cases.