An attacker's AI agent broke into a large multi-cloud organization through an exposed Kafka UI instance, then spent the rest of the intrusion doing what a human crew would need a team and several weeks to do: harvesting credentials, minting cloud tokens, creating its own administrator account in the identity provider and pushing malicious workloads into production Kubernetes, all in parallel. That is the picture painted by the original report from the Wiz Customer Incident Response Team (CIRT), which says AI-driven attacks have been rising across its investigations over the past few weeks.
The agent was not assisting a person at a keyboard, Wiz says. It found entry points, chained credentials from one platform to the next and debugged its own failing scripts on the fly, driving the campaign from start to finish.
Loud, fast and spread across every log
Wiz's central point is that these intrusions are not stealthy. They generate hundreds or thousands of actions per hour, run for long stretches without the pauses of a human working day, and touch cloud control planes, Kubernetes, CI/CD systems and identity providers at the same time. The difficulty for defenders is that the footprint is split across so many log sources that no single alert tells the story.
In the case Wiz walks through, one confirmed way in was a Java remote code execution flaw in an internet-facing Kafka UI. The same source IP was seen scanning more than 600 other Wiz customer environments in the same window, consistent with broad, opportunistic automation.
From one pod to the whole AWS Organization
Inside the workloads it pulled mounted Kubernetes service account tokens, searched environment variables for strings like token, secret and key, and queried the instance metadata service for cloud credentials. In GCP it abused a service account with token-creation rights to generate credentials for dozens of identities. In AWS it used Systems Manager to run commands across instances, then created an IAM user and assumed OrganizationAccountAccessRole to reach administrative access across member accounts.
Using a compromised identity provider admin API key, it created its own user, added it to administrator and cloud role groups, and was signing in to AWS through single sign-on within minutes. On the CI/CD and GitOps side, Wiz counted five workstreams running at once (secret harvesting, reachability mapping, credential spraying, service exploitation and compute expansion), each feeding the others. Data left through the request catcher webhook[.]site, through commits to the victim's own source control, and through a Kubernetes ConfigMap the agent created for the purpose. The organization was not named.
The fingerprints an AI agent leaves
The most useful part for hunters is the list of habits Wiz says recur across these cases:
- Security-testing names: resources and payloads labelled pentest, probe, recon, redteam and exfil, which Wiz assesses likely helps the operator present the activity as authorized testing and get around the model's safety guardrails.
- Numeric task IDs: the same number appearing across related users, files and pipelines, with retries suffixed -b, -c, -d.
- Generated code: short-lived exploit scripts carrying descriptive headers and numbered step comments, with the same helper functions reused across dozens of payloads.
- Simultaneous cross-platform activity from one source, and rapid retry loops where each attempt fixes what broke the last.
It fits a pattern IntelFusions has been tracking, from AI agents behind a PaperCut compromise campaign to an agent-driven break-in completed in under 10 hours.
Rotate everything the agent could touch
Wiz's guidance starts with unifying cloud, Kubernetes, runtime, identity provider, CI/CD and SaaS logs in one searchable place, because every phase of this attack appeared in a different source. Once an intrusion like this is confirmed, it advises rotating every credential reachable from compromised resources rather than trying to work out which were read. It also recommends runtime visibility on pods and VMs, strict separation so staging cannot reach production secrets and no single service account can mint tokens for others, and continuous scanning for exposed developer tools and consoles like the Kafka UI used here.
The irony is that an attacker this fast is also this noisy. Speed only beats defenders who are still reading one log at a time.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.