Observed incident

Wiz reports AI-driven intrusion across cloud, identity and delivery systems

Reported

Published here

What happened

Wiz investigated an intrusion with a confirmed entry vector through exposed Kafka UI, spanning AWS, GCP, Kubernetes, identity and delivery systems, with credential harvesting and data exfiltration. Wiz assessed that an AI agent orchestrated the operation.

Parties and reporting

AI tools and systems: Unidentified AI agent, Kafka UI, AWS and GCP, Kubernetes, CI/CD and GitOps systems

Outcome

The attacker gained administrative access and extracted data. One attacker-created identity was suspended; full containment and total losses were not disclosed.

Operating lesson

Correlate identity, workload and delivery-system logs; rotate credentials reachable from compromised resources and restrict trust between environments.

Evidence and limits

AI orchestration is Wiz's assessment. The actor, model, victim geography and exact incident dates are undisclosed. Scanning of 600-plus other environments does not establish additional compromises.

Sources