The Rise of Agentic Attacks: What They Look Like, and Where They're Headed | Wiz Blog

Researchers have disclosed a vulnerability affecting Claude Code-style agents, reported by Rise.

There’s a clear trend emerging across our incident response engagements and threat hunting investigations.

Wiz increasingly sees intrusions where AI agents appear to handle much of the hands-on work and potentially orchestrate the attack itself.

Recent public disclosures describe real-world intrusions involving named agentic frameworks such as ARTEX and Hermes, as well as custom-built agentic workflows and cases where the underlying tooling remains unidentified.

ARTEX - South Korean financial institutions and the ConnectWise supply-chain compromise: Multiple public reports describe threat actors using ARTEX, an agentic penetration-testing framework, to automate offensive operations.

In South Korea, researchers reported exploitation of internet-facing applications at financial institutions and the exfiltration of personally identifiable information belonging to about 67,000 people (Zscaler, CrowdStrike).

Any organization running Claude Code-style agents on the affected workflow is potentially exposed, not just the specific product named in the research.

The campaign attempted sign-ins against more than 2,250 tenants, with multiple cases of privileged cloud access achieved in under three hours.

Microsoft also reported ARTEX-driven activity targeting hundreds of organizations globally, although most targeting attempts were unsuccessful.

Prompt injection works precisely because the agent can't reliably tell its owner's instructions apart from text it's merely processing -- that's a structural gap, not a one-off bug.

These attacks can be verbose, with agents trying multiple approaches in parallel.

What begins with a single exposed service can expand to cloud credential theft, Kubernetes token theft, lateral movement, and bulk secret exfiltration.

Rise's research describes a specific attack chain rather than a generic weakness, meaning the fix has to address that chain directly.

The agent enumerated internal hosts, inspected files, and investigated privilege-escalation opportunities.

Investigators found evidence that multiple ministry systems had been compromised, along with web shells, stolen credentials, and a custom Go-based implant.

This post takes a broader view, reviewing both private and public cases to identify recurring fingerprints of agentic activity.

JPCERT/CC investigated a series of attacks affecting multiple organizations in Japan and found evidence that attackers used AI to scan for known vulnerabilities and exploit APIs.

The investigation also uncovered infrastructure containing tools and artifacts associated with vulnerability testing and attempts to access internal networks.

Review whether any agent in your environment processes untrusted or externally-submitted content as part of its normal workflow, since that is the pattern this kind of attack chain relies on.

Confirm outbound data-handling controls actually inspect what an agent sends, not just where it sends it, since DNS- and URL-based exfiltration techniques are built to slip past destination-based controls specifically.

DIVD reported suspicious activity and initiated incident response and forensic investigation, but its initial public statement did not identify the agent or framework involved.