Wiz Describes Runtime Detection of AI-Agent Attacks Across Model, Workload, and Cloud
Summary
Wiz describes correlating model, workload, and cloud activity to detect AI-agent threats, including a scenario where a manipulated agent runs a script, attempts a reverse shell, accesses credentials, and exports data.
Key points
- The article argues that AI runtime security must monitor agent actions and their impact, not just filter prompts.
- Wiz describes correlating signals across model inputs and outputs, workload execution, and cloud identities, APIs, and infrastructure.
- In the example, an attacker targets a publicly exposed AI agent with a prompt that leads it to download and execute a script.
- The agent’s activity includes an attempted reverse shell and access to environment credentials.
- Cloud signals in the scenario include identity activity, database export to external storage, and DNS queries to known malicious domains.
- Wiz says its context and Security Graph can link runtime activity to the AI workload, its exposure, and the code or configuration behind anomalous behavior.
Article Details
- Defense Focus
- Detect and investigate risky or malicious AI-agent behavior at runtime by correlating model activity, workload execution, and cloud impact with AI-specific context.
- Detection Methods
- Flag suspicious model inputs and prompt-injection attempts that lead to execution.
- Monitor agent processes, tool invocations, and actions, including script execution, credential access, and external communication.
- Correlate cloud identity activity, database exports to external storage, and DNS queries to known malicious domains with model and workload activity.
- Use AI context tags to identify AI workloads, agentic identities, processes interacting with AI services, and data tied to AI applications.
- Correlate anomalous runtime behavior to the code or configuration that introduced it.
- Data Sources
- AI model inputs, outputs, and prompt behavior
- Workload process execution and agent actions
- Cloud identity, API, and infrastructure activity
- Agent identities, roles, and AI-context tags
- Code and configuration associated with anomalous agent behavior
- Platforms
- Wiz Security Graph
- Defensive Actions
- Investigate the connected sequence from prompt through execution to cloud impact rather than treating signals in isolation.
- Determine how the AI workload was exposed and trace the activity that led to the threat.
- Use runtime-to-code/configuration correlation to identify the source of anomalous behavior and guide remediation.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe AI agent is instructed to download and execute a script, and the described attack includes execution of that script.T1059.001 · PowerShellThe article describes a script being executed but does not identify the scripting language.T1059.003 · Windows Command ShellThe article describes a script being executed but does not identify the scripting language.T1059.004 · Unix ShellThe article describes a script being executed but does not identify the scripting language.T1059.005 · Visual BasicThe article describes a script being executed but does not identify the scripting language.T1059.006 · PythonThe article describes a script being executed but does not identify the scripting language.T1059.007 · JavaScriptThe article describes a script being executed but does not identify the scripting language.T1059.008 · Network Device CLIThe article describes a script being executed but does not identify the scripting language.T1059.009 · Cloud APIThe article describes a script being executed but does not identify the scripting language.T1059.010 · AutoHotKey & AutoITThe article describes a script being executed but does not identify the scripting language.T1059.011 · LuaThe article describes a script being executed but does not identify the scripting language.T1059.012 · Hypervisor CLIThe article describes a script being executed but does not identify the scripting language.T1059.013 · Container CLI/APIThe article describes a script being executed but does not identify the scripting language.T1059.014The article describes a script being executed but does not identify the scripting language.T1105 · Ingress Tool TransferThe attacker-crafted prompt directs the agent to download a script before executing it.