AI agents are driving noisy, machine-paced attacks across cloud environments
The claim
The authors assert that AI-driven agentic attacks are becoming common in real-world intrusions and are generally noisier than traditional attacks.
Published as: “The Rise of Agentic Attacks: What They Look Like, and Where They're Headed”
So what
Defenders can leverage the noisy, verbose nature of agentic attacks to develop behavioral detections and improve attribution.
The five-minute version
Wiz analyzed multiple incident response cases and public disclosures showing AI agents like ARTEX, Hermes, and custom PentestGPT-derived workflows automating reconnaissance, exploitation, and post-exploitation at machine speed. They distilled six fingerprint criteria-machine-paced iteration, natural-language reasoning in scripts, self-correction, high verbosity, probe-before-payload discipline, and throwaway, self-labeled artifacts-and illustrated each with concrete examples from three internal attacks. The evidence comes from real-world telemetry across dozens of campaigns, indicating that while these attacks are faster and broader, they also leave a noisy trail that defenders can exploit.
What they found 2
- ARTEX was used to attempt sign-ins against more than 2,250 Microsoft 365 tenants, achieving privileged cloud access in under three hours in several cases.
“The campaign attempted sign-ins against more than 2,250 tenants, with multiple cases of privileged cloud access achieved in under three hours.”
- In Attack A, a new, distinct, purpose-built script appeared roughly every one to two minutes, sustained across ~24 hours, totaling 99 scripts.
“Attack A: a new, distinct, purpose-built script appeared roughly every one to two minutes, sustained across ~24 hours, 99 scripts in all.”
What undercuts it the paper’s own results
- More capable doesn't necessarily mean more stealthy. AI agents can make mistakes, generate broken tooling, pursue dead ends, or misinterpret results.
Stated limits 2
- The degree of autonomy and the strength of the available evidence vary by case, but the diversity of tools and workflows suggests that this is not limited to a single framework or threat actor.
- Current agentic attacks tend towards the noisy, leaving behind a broad trail of observable activity.
What’s new here 4
- Catalog of real-world agentic attack cases (ARTEX, Hermes, AI-assisted API exploitation, custom workflows).
- Definition of six observable fingerprint criteria for detecting agentic activity.
- Quantitative examples of script generation rates (e.g., 99 scripts over 24 h) and scale of cloud credential theft attempts.
- Analysis of implications for attribution, scaling of attacks, and defensive opportunities.
Artifacts & methods 4
- ARTEXsystem
- Hermessystem
- PentestGPT-derived harnessprimitive
- Claude Code workflowsprimitive