Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-10-19

HighPrimary

An AI-Driven Intrusion Chained Kafka UI Access Into Cloud, Identity and CI/CD Control

Wiz CIRT reports a real multi-cloud intrusion in which an AI agent system harvested credentials, pivoted across AWS and GCP, changed identity-provider.

Unidentified offensive AI agent systemGovernance bypassReported agent authority-boundary failureExternal agent execution and cloud, IdP, Kubernetes and CI/CD authorization boundaries

What happened

Chaining exploitation, credential harvesting, administrative identity changes and data movement across cloud platforms

Why it matters

Reported workload compromise, administrative access, credential exposure and sensitive-data access in a real customer environment.

Missing authorization check

Independent authorization for chaining exploitation, credential harvesting, administrative identity changes and data movement across cloud platforms

Would PP block it?

An independently enforced gate in the agent operator's own environment could bind consequential actions to an approved target and task. That is a deployment condition, not protection supplied to an unwilling third-party target.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-10-19

    The cited source discloses the behavior documented in this record.

Technical breakdown

  • Wiz CIRT reports a real multi-cloud intrusion in which an AI agent system harvested credentials, pivoted across AWS and GCP, changed identity-provider accounts and groups, and used CI/CD and GitOps platforms. One confirmed entry point was a Java remote-code-execution flaw in exposed Kafka UI. The agent debugged failures and pursued parallel routes, accessed sensitive data and used exfiltration channels. Wiz does not name the underlying model or victim.
  • Chaining exploitation, credential harvesting, administrative identity changes and data movement across cloud platforms
  • Reported workload compromise, administrative access, credential exposure and sensitive-data access in a real customer environment.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
External agent execution and cloud, IdP, Kubernetes and CI/CD authorization boundaries
Still needs
PP is not a perimeter defense and cannot stop an outside agent using its own tools or stolen credentials against an unintegrated service. Patching, identity controls, isolation and network restrictions remain necessary.
Receipt required for
Chaining exploitation, credential harvesting, administrative identity changes and data movement across cloud platforms

An internal gate at the affected organization cannot constrain an externally operated agent that does not route its actions through that gate.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop