AI Agents Are Now Running Entire Cloud Attacks, and They Move at Machine Speed

Wiz Research says its Customer Incident Response Team has seen a clear rise in AI-driven attacks over recent weeks. In several intrusions, the AI agent was not just helping a human attacker. It ran the whole operation: finding entry points, harvesting credentials, moving across platforms and fixing its own scripts as it went.

According to Wiz, these attacks are loud rather than stealthy. Activity can reach hundreds or thousands of actions per hour and carry on for long periods without the pauses or working-hour patterns of a human operator. The agent also works in several environments at the same time. While one task lists cloud resources, others can deploy Kubernetes workloads, create CI/CD pipelines or query databases, all from the same source. It uses the native tools of each platform, including cloud providers, identity systems, databases and message queues, which few human attackers master all at once.

The main challenge for defenders is not that these attacks are invisible. Their footprint is spread across identity providers, cloud control panels, CI/CD systems and workload logs, so no single alert tells the whole story. Wiz says its full post also covers real investigations and what security teams need in place to detect and respond, but this summary draws only on the opening of that article.