Wiz Says Atlas AI Agent Found 200+ Vulnerabilities in Audited Open-Source Projects
Summary
Wiz describes Atlas, an AI system that maps code attack surfaces, investigates and adversarially validates vulnerability candidates, and tests them dynamically. Wiz reports more than 200 previously unknown findings and says it is working with maintainers on disclosure.
Key points
- Wiz reports that Atlas found more than 200 previously unknown vulnerabilities across projects including Kubernetes, the Linux kernel, grpc, dnsmasq, gVisor, and containerd.
- Atlas maps entry points and data flows using code property graphs, then assigns multiple agents to investigate vulnerability hypotheses in parallel.
- Candidate findings face adversarial validation and are tested with triggering inputs in dedicated execution environments.
- Wiz says it is withholding technical details while it works to disclose findings to maintainers.
- The article describes a critical GitHub remote code execution vulnerability, CVE-2026-3854, as an example found using an early version of the system.
- Wiz says Atlas ranks first on CyberGym with a 90.9% success rate, while noting that the benchmark measures reproduction of known vulnerabilities, not discovery of unknown ones.
- Wiz is working to incorporate Atlas into Wiz Code for continuous code scanning and deeper investigation of selected areas.
Article Details
- Defensive Notes
- Atlas maps code entry points, untrusted-input paths, and potentially dangerous operations using a code property graph.
- The system investigates candidate vulnerabilities independently, challenges findings through adversarial validation, and dynamically verifies them by running triggering inputs in dedicated execution environments.
- The article says technical details of discovered vulnerabilities are being withheld until fixes are available.
CVE
Vendors
Products
AtlasOver the past several months, the Wiz Research team has built and tested Atlas, an autonomous AI system for vulnerability research, against some of the world's most heavily audited open-source projects. Today AtlasSecurity GraphEvery finding will flow into the same Wiz system. The Security Graph adds context across code, cloud, identity, runtime, and exposure; Red and Green Agents validate risk and build remediation plans. The result isWiz CodeWe are working to incorporate Atlas as part of Wiz Code, with a practical system for AI code scanning that combines continuous coverage with deep investigation.
Tools
Cyber Model Arenaand none stays state of the art for long. We evaluate every new model as it ships through Cyber Model Arena, and our internal benchmark suite that scores models across the specific tasks that make up anCyberGymresearch, against some of the world's most heavily audited open-source projects. Today Atlas ranks #1 on CyberGym - the public benchmark for AI-driven vulnerability work - with a 90.9% success rate, and in our ownGoogle CodeMenderdata flows, exposed paths, or high-impact changes. Atlas and other specialized engines, including Google CodeMender, can then apply greater context, compute, and reasoning where they are most likely to uncover