Building an AI Detection Engine That Understands Agent Intent

What it is

Wiz's engineering post on their AI agent detection engine — but it carries two specifics the summary omits: an adversarial naming technique against LLM-based analyzers, and an unrelated active-exploitation advisory embedded in the footer.

How it works — the "SOC-2" evasion

One simulated scenario runs a malicious agent deliberately named "SOC-2" to make the analyzing LLM more permissive toward its actions — a prompt-injection-style trick aimed at the detector itself, not just the target agent. The agent has no elevated permissions but can enumerate other agents in a multi-agent environment, then tricks CI/CD and Data Analysis agents into exfiltrating secrets/PII to an agent-controlled resource. Detection relies on the correlation stage: model-layer telemetry shows intent, while cloud/runtime telemetry shows impact — a tool call innocuous at the model layer may show up as a reverse shell at runtime, and a malicious-looking prompt may have been stopped by sandboxing/permission boundaries before any real effect.

Preconditions / Affected

The detection capability applies to AWS Bedrock invocation logs, available today in private preview for Wiz Defend customers — existing customers must contact their account manager to join. This is the concrete availability boundary the summary doesn't state.

What to do — the JFrog advisory (separate item)

The page footer discloses that Wiz Research has identified active, in-the-wild exploitation of three JFrog Artifactory vulnerabilities:

• CVE-2026-42016 (critical/high)
• CVE-2026-42018 (critical/high)
• CVE-2026-82329 (critical/high)

Attackers are chaining these to bypass authentication and gain administrative control of Artifactory. If you run JFrog Artifactory, treat this as the actionable item: patch and check for admin-level compromise. The page gives no version boundaries or patch commands — consult JFrog's advisory for fixed versions.

Caveats

The post is a vendor engineering narrative; the pipeline effectiveness figures come only from Wiz's own 100+ simulated scenarios (57 injected attacks, 45 benign), not independent testing. The JFrog CVE details here are a one-line teaser with no mechanism depth, fixed versions, or IOCs — you must go to the linked Wiz Research write-up for anything operational.