Wiz Puts AI-Powered Red Agent for Finding API Flaws in Public Preview

Summary

Wiz says its Red Agent autonomously maps APIs and tests application logic for exploitable flaws. In examples, it found authentication bypasses that exposed member records and chatbot data; the agent is now in Public Preview through Wiz ASM.

Key points

The Red Agent is now in Public Preview as part of Wiz Attack Surface Management.
It combines API discovery—including an AI-powered web crawler—with adaptive testing that reasons about application behavior and chains attack steps.
Wiz says the agent found an authentication bypass on a community platform, exposing member records, internal discussions, identities, and attachments.
In a separate example, it reportedly bypassed authentication on an AI chatbot and extracted personal and company data from its database.
Wiz says findings are validated for external exploitability and correlated with cloud, identity, and data context to help assess impact.
The company says the tool is intended to find logic flaws and other risks that static signatures and traditional scanners may miss.

Article Details

Event Type: Wiz announced the Public Preview of its AI-powered Red Agent as part of Wiz Attack Surface Management and reported security findings from testing production environments.
Impact: Wiz says the Red Agent identified hundreds of critical, exploitable risks. Reported examples include an authentication bypass exposing thousands of member records and a chatbot attack chain that extracted live personal information and proprietary company data.

People

Emil VaaglandIdentified as Head of Product Security at Vend and quoted about the Red Agent's findings.

Vendors

WizAt RSA 2026, we announced the launch of the Wiz Red Agent- reimagining how organizations secure the modern attack surface.

Products

Green AgentRemediate: You can leverage the Green Agent to accelerate remediation and easily identify the right owner and get remediation guidance to assign and fix fast.Wiz Attack Surface Management (ASM)Now in Public Preview as part of Wiz Attack Surface Management (ASM), the Red Agent acts as an autonomous, world-class security researcher designed to uncover complex vulnerabilities. It does so by combining three Wiz Red AgentAt RSA 2026, we announced the launch of the Wiz Red Agent- reimagining how organizations secure the modern attack surface.Wiz Runtime SensorDiscover: The Red Agent maps your full API attack surface by aggregating endpoints from Cloud APIs, Swagger and OpenAPI documentation, the Wiz Runtime Sensor, and its own AI-powered web crawler.Wiz Security GraphFindings are correlated with context from the Wiz Security Graph- connecting application-layer risks to cloud infrastructure, identity, data and lateral movement paths - to help you prioritize with context.