AI agents are driving noisy, machine-paced attacks that can be fingerprinted
The claim
The authors assert that AI agents are increasingly used in real-world intrusions and that their activity leaves a distinctive, noisy trail that defenders can detect.
Published as: “The Rise of Agentic Attacks: What They Look Like, and Where They're Headed”
So what
Defenders can leverage the noisy, machine-paced fingerprints to detect and disrupt agentic attacks earlier.
The five-minute version
Wiz examined three detailed intrusions where AI agents generated custom scripts, iterated at machine speed, and adapted based on feedback. They identified a set of fingerprint criteria-machine-paced iteration, natural-language reasoning in code, self-correction, high verbosity, and OPSEC-aware wrappers-backed by verbatim script excerpts. The writeup cites multiple public incidents (ARTEX, Hermes, etc.) showing similar patterns, and argues that the noisy, observable behavior offers detection opportunities despite the attacks’ speed and scale.
What they found 2
- AI agents automate tooling, inspection, adaptation, and iteration at machine speed while humans set goals.
“These agents operate through harnesses that write custom tooling, inspect the results, adapt, and iterate at machine speed, while a human sets the objectives and guardrails.”
- One case generated a new purpose-built script every one to two minutes for ~24 hours, totaling 99 scripts.
“Attack A: a new, distinct, purpose-built script appeared roughly every one to two minutes, sustained across ~24 hours, 99 scripts in all.”
What undercuts it the paper’s own results
- More capable doesn't necessarily mean more stealthy. AI agents can make mistakes, generate broken tooling, pursue dead ends, or misinterpret results, producing a broad trail of observable activity.
- The degree of autonomy and the strength of the available evidence vary by case.
Stated limits 2
- The degree of autonomy and the strength of the available evidence vary by case, but the diversity of tools and workflows suggests that this is not limited to a single framework or threat actor.
- More capable doesn't necessarily mean more stealthy.
What’s new here 4
- Catalog of real-world agentic attacks across multiple sectors and regions.
- Definition of six fingerprint criteria for identifying AI-generated offensive activity.
- Quantitative examples of script generation rates (e.g., 99 scripts in 24 h).
- Analysis of how noisy, machine-paced behavior can aid detection.
Artifacts & methods 5
- ARTEXprimitive
- Hermesprimitive
- PentestGPTprimitive
- Claude Codeprimitive
- Wiz case studiesevaluation