--- title: Hunt: cloud intrusions run end-to-end by an AI agent (Wiz CIRT): 'pentest-' named resources, numeric task IDs with -b/-c retries, webhook.site exfil | ctxsec url: https://ctxsec.com/items/hunt-wiz-ai-agent-run-cloud-intrusions description: "" status: "confirmed (Wiz CIRT investigations)" published: 2026-10-19 --- > [← Threat Hunting](/hunting) · [markdown](/items/hunt-wiz-ai-agent-run-cloud-intrusions.md) confirmed (Wiz CIRT investigations) 2026-10-19 ### Hunt: cloud intrusions run end-to-end by an AI agent (Wiz CIRT): 'pentest-' named resources, numeric task IDs with -b/-c retries, webhook.site exfil Wiz's incident response team (Oct 19) says several recent intrusions it investigated were run start to finish by an AI agent system, not just assisted by one. In one multi-cloud case, initial access came through a Java RCE in an exposed Kafka UI instance. The same source IP was scanning more than 600 other Wiz customer environments in that window. The agent then harvested Kubernetes service account tokens and environment secrets, minted credentials through a GCP service account with token-creation rights, and ran commands through AWS SSM. It created its own user in the identity provider with a stolen admin API key, added it to groups mapped to AWS IAM Identity Center, and signed in through SSO. It also turned CI/CD runners and a GitOps controller into execution engines, escalated to cluster-admin, and left a self-healing C2 workload in Kubernetes. **Hunt for:** - Resources, files, pipelines, buckets, Cloud Run services or IdP users named with `pentest`, `probe`, `recon`, `redteam` or `exfil` (Wiz saw names like `pentest--` and `pentest_exfil`) that no approved test explains. - The same number appearing across several new artifacts, with retries suffixed `-b`, `-c`, `-d`. - Recovered scripts with tidy descriptive headers and numbered step comments (e.g. `# redteam ... exfil (intent )`), and the same helper functions reused across dozens of payloads. - Outbound requests to `webhook[.]site` or other request-catcher services from pods, runners or instances, and secrets or data printed into CI runner logs. - Hundreds to thousands of API actions per hour from one identity, with no breaks, across cloud, Kubernetes, CI/CD and IdP at the same time. - New IdP users added to cloud-role groups and then signing in to AWS through SSO within minutes. Watch for bursts of service account token creation, and for GitOps-synced manifests or workload changes with no matching Git commit. Wiz's point: these attacks are loud, but the noise is split across IdP, cloud control plane, CI/CD and workload logs, so correlate them in one place. Sources: [Wiz: Anatomy of a Real AI-Driven Cloud Attack (Oct 19)](https://www.wiz.io/blog/anatomy-of-ai-driven-cloud-attacks)