The Rise of Agentic Attacks: What They Look Like, and Where They're Headed

What it is

A Wiz Research post that turns three agentic intrusions from its own incident response work (labelled Attack A, B and C) into six fingerprints for spotting AI-agent activity. It also lists public cases: ARTEX, Hermes, JPCERT/CC, CrowdStrike and DIVD. The fingerprints come with concrete artifacts from the recovered tooling, which the catalog summary only names.

How it works: the fingerprints, with the evidence the page gives

• Cadence. Attack A produced 99 distinct scripts in about 24 hours, one every one to two minutes. Attack C ran about 21 hours with no human-style gaps. Attack B ran 602 unique steps over about 4.5 hours. Latency varies with step complexity (quick retries on 403s, longer gaps when parsing SPA JS chunks). A deterministic exploit chains commands in milliseconds, and a fixed-interval beacon clusters at one value.
• Written rationale in scripts. Nearly all of A's 99 scripts open with a plan. C had 803 distinct comment lines. C's commentary referred to "the other <agent>" and tried to work out what that parallel instance had achieved.
• Versioned self-correction. A's Flowise key-validation v2 explains why v1 failed: a customized WHITELIST_URLS list (42 entries versus the standard 20) returned 200 without auth. Script chains such as act3 → act3b … act3k, nodepivot.py → 2 → 3 → 4, and dynamo2 → 5 show the same pattern. C's token pivot was debugged against a 401 caused by signing with a us-east-1 scope when the cluster expected regional us-west-2 STS.
• Checklist enumeration. B moved through 12 technique families in order. C extended a cloud-native chain across Postgres, DynamoDB, Redis, Consul, gRPC reflection, S3, several MCP servers and a GraphQL federation.
• Noisy parallel lateral movement. B generated 100+ ArgoCD hostname variants and scanned 15 ports across 5 hosts in parallel (nc -vz -w1 $ip $port & in nested loops). C ran 150+ scripts against about 25 target organizations in about 21 hours. A sprayed one exploit across dozens of external hosts on port 3000.
• Probe before payload. A sent a harmless marker and fired the real exploit only if it echoed back. It also ran node -c on its backdoor, used grep -c <tag> to check its hook landed, and used self-deleting printf … | base64 -d > /tmp/.cXXXX.sh; sh …; rm wrappers. B's beacon wrapper truncated output with head -c 49152. C used curl --max-time 5 and -m 3.
• Self-labeled scratch files. Examples are host_a_b_c_d naming, about 40 descriptive /tmp files in B, /dev/shm/.x/c.py persistence in C, and an endpoint path /stdio-rce-a that describes the exploit. B named RabbitMQ global parameters after its own C2 host.

What to do

The page gives no formal detection rules or queries. Its stated direction is to distinguish agentic activity from legitimate automation and correlate individual signals. It also advises reducing exposed attack surface, prioritizing exploitable risks, keeping visibility, and defining containment and remediation workflows before an incident. It points to its AI Threat Readiness Framework.

A reader could hunt on these signals: bursts of new, uniquely named scripts every one to two minutes; comment-heavy scripts in /tmp or /dev/shm; numbered script generations; wide port sweeps from one workload; IMDS and service-account token access followed by selfsubjectrulesreviews calls. This list is derived from the page's examples, not stated by it as detections.

Public cases

• ARTEX: South Korean financial institutions (about 67,000 people's PII exfiltrated). Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, with sign-in attempts against more than 2,250 tenants and privileged cloud access in under three hours in several cases.
• Hermes: Thailand's Ministry of Finance, found by Hunt.io running in unattended "YOLO" mode. Initial access is unknown.
• CrowdStrike: four actors, including a PentestGPT-derived supervisor and executor harness and Claude Code workflows.

Caveats

• Wiz says agentic attacks tend to be noisy, but not that this guarantees detection.
• Autonomy and evidence strength vary by case. DIVD did not identify the agent involved.
• The page asserts the three Wiz cases are agentic from artifact analysis. Names, targets and the full case studies are redacted or only linked to earlier Wiz posts.
• On attribution, Wiz expects code and tool similarity to matter less and context (victimology, infrastructure, objectives) to matter more. This is Wiz's forecast, illustrated with the Shai-Hulud and Miasma campaigns.