{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/wiz-agentic-intrusion-fingerprints-2026/",
 "asOf": "2026-10-30",
 "id": "wiz-agentic-intrusion-fingerprints-2026",
 "date": "2026-10-29",
 "datePrecision": "day",
 "title": "Wiz presents three agentic intrusion case studies and seven proposed behavioral fingerprints",
 "lane": "attack",
 "kind": "misuse-report",
 "summary": "Wiz presents three investigated intrusions involving an exposed Flowise service, a Java operations gateway and an MCP-facing GraphQL backend. It proposes seven behavioral fingerprints for agentic activity, combining tool adaptation, natural-language artifacts and execution patterns, while describing humans as setting objectives and guardrails.",
 "whyItMatters": "It gives defenders case-based detection hypotheses while exposing the uncertainty in identifying agentic activity from operational traces.",
 "actors": [
  "wiz"
 ],
 "topics": [
  "ai-enabled-intrusion",
  "threat-intelligence",
  "tool-and-mcp-security",
  "data-exfiltration"
 ],
 "atlas": [
  "tools",
  "credentials",
  "monitor"
 ],
 "artifacts": [
  "model-context-protocol"
 ],
 "sources": [
  {
   "url": "https://www.wiz.io/blog/the-rise-of-agentic-attacks",
   "publisher": "Wiz",
   "title": "The Rise of Agentic Attacks: What They Look Like, and Where They're Headed",
   "date": "2026-10-29",
   "type": "primary",
   "accessed": "2026-10-30"
  }
 ],
 "keyFacts": [
  {
   "fact": "The cases describe reuse of an exposed service to target other installations, cloud-environment probing, and secret theft with persistence across workloads. These are Wiz investigative accounts, not independent victim statements.",
   "locator": "Agentic Attacks Investigated by Wiz; Case Studies"
  },
  {
   "fact": "Wiz combines sustained variable cadence, reasoning artifacts and adaptive behavior as indicators. It does not provide a validated detector error rate or establish a model identity from cadence alone.",
   "locator": "AI-agent fingerprinting criteria"
  },
  {
   "fact": "The article separately recaps previously published incidents. Its Hermes detection illustrations are labeled attack simulations and should not be counted as additional observed intrusions.",
   "locator": "From ARTEX to Hermes; simulation captions"
  }
 ],
 "significance": 4,
 "fideQuestions": [],
 "methods": [
  "agent-orchestrated-intrusion",
  "agent-data-exfiltration"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-30",
 "revisions": []
}