Wiz Details AI-Agent Detection Pipeline Using Model Logs and Runtime Telemetry

Article Details

Defense Focus

Detect malicious shifts in AI-agent intent by analyzing model input and output telemetry and correlating agent intentions with actions and effects in cloud and runtime environments.

Detection Methods

• Collect model-provider and cloud-service logs containing prompts, system instructions, tool specifications and results, model outputs, and reasoning.
• Use regex patterns, Wiz Secrets Engine, and SLMs to surface initial candidates for potentially malicious activity.
• Apply staged LLM analysis: first filter benign logs and identify suspicious activity, then analyze selected conversations in greater depth using environmental context.
• Correlate analysis verdicts with cloud and runtime events to establish whether intended actions occurred and assess their impact.
• Validate pipeline changes against a benchmark of simulated benign workflows and injected attacks.

Data Sources

• Model input and output logs, including user requests, system prompts, tool descriptions, tool results, outputs, and internal reasoning
• Cloud-service and model-provider logs
• Cloud events and cloud API calls
• Runtime telemetry, including process executions and network connections
• Identity information and environmental context

Rule Types

• Regex-pattern candidate matching
• Threat Detection Rules applied to enriched cloud events

Platforms

• Bedrock invocation logs

Defensive Actions

• Enable collection of model invocation logs and retain the prompt, tool-call, and tool-result context needed to investigate agent behavior.
• Analyze untrusted inputs together with model reasoning and subsequent tool calls to identify indirect prompt injection and suspicious intent shifts.
• Correlate model-layer findings with cloud API, process, and network telemetry before determining whether an action had real-world impact.
• Use staged analysis to prioritize suspicious conversations while filtering benign activity and reducing noise.
• Test detection updates against both injected attacks and benign workflows to assess coverage and false positives.