There’s a clear trend emerging across our incident response engagements and threat hunting investigations. Wiz increasingly sees intrusions where AI agents appear to handle much of the hands-on work and potentially orchestrate the attack itself. These agents operate through harnesses that write custom tooling, inspect the results, adapt, and iterate at machine speed, while a human sets the objectives and guardrails.
These attacks can be verbose, with agents trying multiple approaches in parallel. They appear at both ends of the spectrum, from sharply targeted to broadly opportunistic. What begins with a single exposed service can expand to cloud credential theft, Kubernetes token theft, lateral movement, and bulk secret exfiltration. AI agents compress the skilled, hands-on work that such escalation once required. There is, however, a potential advantage for defenders. Current agentic attacks tend towards the noisy, leaving behind a broad trail of observable activity. The challenge is to distinguish this activity from legitimate automation and correlate individual signals into a coherent picture of an attack.
In our recent blogs, Anatomy of AI-Driven Cloud Attacks and Storm-0940 Expands Targeting of IT and Software Vendors we examined specific agentic intrusions in depth. This post takes a broader view, reviewing both private and public cases to identify recurring fingerprints of agentic activity. We also reflect on what this shift means for attribution, the scale of attacks, and the future of defense. — Read More
Recent Updates
What Google and Reddit’s bad days have in common
On Thursday afternoon, Demis Hassabis celebrated a milestone for Google’s AI efforts: Gemini 4 Carbon, a new large language model that is currently available only to cyber defenders, topped Artificial Analysis’ Intelligence Index. After a series of delays in new model releases and a growing perception that the company is falling off the frontier, early signs suggest that Carbon marks a return to form. For Alphabet’s chief scientist, the news surely felt like a vindication.
Investors, however, are much less certain. On the same day, Google’s parent company had its worst day in history as a public company. Alphabet’s stock fell 12.6 percent, erasing around $500 billion in market value. The loss marked the second-biggest stock market plunge ever, following Nvidia’s $593 billion slide in January 2025. And it was Google’s biggest one-day decline since the great financial crisis.
Most of the selloff came from investor worries about the huge scale of Google’s AI infrastructure buildout. The company plans to spend up to $205 billion on capital expenses this year, and has promised to spend even more in 2027. And it reported free cash flow of negative $9 billion — an acceleration of a decline that began the previous quarter. — Read More
EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants
Five of the AI coding tools your employees already run shipped a browser inside the assistant. We looked at all five and found Arbitrary Code Execution, Browser Sandbox Escape, Arbitrary Local File Read & Exfiltration, Prompt Injection, Address Bar Spoofing, and more.
Yes, if you’re using Cursor, GitHub Copilot, Codex, VS Code, or Claude Desktop… that means you. And since Codex and VS Code are still unpatched at the time of publishing, it may still mean you today. — Read More
The Economics of Intelligence: How and when does AGI lead to economic transformation?
This essay draws on the paper Organizing Intelligence which presents the full economic model and derives the results formally.
How do capability improvements transform the economy, and when? In this essay, we define thresholds of economic capabilities, e.g., minimal AGI, as a function of how they transform the economy. We then track how the economy–market structure, employment, and wages–changes during the transition across capability regimes. — Read More
As search traffic dries up, Reddit announces it’s shifting to a logged-in experience
Reddit has long attracted millions of users to its site through Google, with many even appending the word “Reddit” to their search queries for better answers. But as search traffic dries up amid the shift to AI-powered search, Reddit is rethinking its relationship with the open internet. In its third-quarter earnings call on Thursday, the company announced it’s transitioning to a primarily “logged-in experience.”
The move is designed to protect its data from AI scraping, allowing the company to instead forge lucrative licensing deals with model providers. But just as important, such a shift could help Reddit to increase its revenue even as it faces daily active user declines in its largest market, the U.S. — Read More
FrontierCode 2.0
Recent progress in AI has made software engineers dramatically more productive. However, our experience building and deploying Devin suggests that agentic software engineering remains far from solved. Models struggle to infer user intent, respect unstated constraints, and anticipate long-term consequences of their changes, forcing human intervention.
Most existing coding benchmarks fail to capture these gaps and tend to be saturated quickly. We are excited to introduce FrontierCode 2.0, a new generation of our coding benchmark series and our best attempt yet to evaluate user experience. — Read More
The sleep framework: A new way for LLMs to retain knowledge in continual learning
Modern LLMs achieve impressive performance via pre-training and in-context learning (ICL). However, once deployed, they remain largely static, operating with a fixed knowledge cutoff date that leaves them unable to acquire long-term capabilities or adapt to new information.
While updating models with new data seems like the obvious solution, continual parameter updates often trigger catastrophic forgetting, a fundamental issue where learning new tasks severely degrades performance on previously learned ones. Alternatively, relying strictly on ICL limits knowledge retention to the immediate context window: once the context session ends, the acquired short-term information is forgotten.
nspired by how the human brain processes and stabilizes memory during rest, we introduce a sleep framework in continual learning: a learning paradigm that equips large language models (LLMs) with a continuous periodic lifecycle, enabling them to continually learn, consolidate fragile short-term context into stable long-term parameters. With this framework, we demonstrate that alternating between active interaction and offline memory consolidation allows LLMs to continuously acquire new facts, retain long-context knowledge up to 10M tokens, and improve complex reasoning. — Read More
How Microsoft quietly reinvented itself to build better AI
Kevin Scott is a maker. Given that he’s been Microsoft’s CTO for almost a decade, that doesn’t come as a shock. But his passion for making stuff extends to two hobbies—pottery and woodworking—that he pursues in a studio he built in Los Gatos, California. Large and lavishly outfitted, it’s packed with the tools of all his trades: a gas-powered kiln and a full woodshop, but also an office bedecked in computing equipment. On any given day, he may spend 9 or 10 hours there on video calls related to his day job.
By contrast, today’s software engineers are being pragmatic about their own extraordinary new power tool: generative AI.
“People more clearly understand that it’s just a tool,” Scott says. “And it’s not a particularly useful tool unless you have someone asking it to do a useful thing in a useful way.” Already, one study says that 42% of developers are using the technology to generate at least half their code.
Microsoft’s understanding of what people want out of AI has outsize impact on the entire world of software. — Read More
Genie 4: A new generation of world simulation
Today, we are announcing Genie 4, our new world model, which unlocks unprecedented realism and improves real-time interactive simulation. Genie 4 is natively multimodal, enabling audio-like music, ambient noises, and interactive dialogue to be simultaneously generated with the world
The Genie 4 model incorporates and builds on capabilities from the Gemini family: Gemini Omni anchors the simulations in real-world appearance and behavior, while other Gemini models provide the complex reasoning needed to help maintain a simulation’s coherence and continuity. — Read More
AI Models Can Provably Hide Arbitrary Capabilities
Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses. — Read More
