Published: 2026-07-10
Categories: Offensive Security
Key Takeaways
Autonomous AI red-teaming agents have moved from research demonstrations to commercial products that independently discover and validate exploitable vulnerabilities in live production systems, without a human operator directing each step. Wiz’s Red Agent, launched in public preview on April 22, 2026, has surfaced more than 17,000 unique findings across roughly 1,000 customer environments in its first month of operation, including a broken object level authorization (BOLA) flaw in a major airline’s booking API that exposed years of passenger data to an anonymous session [1][2][3]. A second, independently developed agent, XBOW, has already climbed to the top of HackerOne’s United States researcher leaderboard, submitting nearly 1,060 reports — of which 130 have been resolved and 303 triaged as valid to date, with the remainder still pending review, duplicates, or informational [4] — and, in a separately published benchmark, matching a twenty-year veteran penetration tester’s 85 percent solve rate on a 104-challenge suite while completing it in 28 minutes against the tester’s roughly 40 hours [9]. Both systems reason over application logic and adapt their attack sequences dynamically rather than replaying static payloads, which allows them to surface context-dependent flaws — authorization gaps, server-side request forgery, JSON Web Token misconfigurations — that signature-based scanners and periodic manual assessments routinely miss. Because these same reasoning capabilities are available to adversaries as well as defenders, the emergence of autonomous red-teaming agents compresses the time between a system going live and its weaknesses being found, making continuous, machine-speed validation a near-term necessity rather than a future aspiration. CSA’s 2024 “Using AI for Offensive Security” report anticipated this trajectory, and its Agentic AI Red Teaming Guide already provides a structured methodology organizations can apply to test their own systems before an autonomous adversary does.
Background
For several years, AI-assisted offensive security tooling has occupied a middle ground: large language models could suggest exploit code, summarize scan output, or draft reconnaissance queries, but a human tester still had to direct the engagement, validate findings, and chain individual discoveries into a working attack path. That middle ground is closing. In March 2026, Wiz announced Red Agent at its RSA Conference keynote as an AI-powered attacker built to autonomously map an organization’s API attack surface, reason about application logic, and exploit vulnerabilities using adaptive rather than scripted techniques [1]. The tool entered public preview on April 22, 2026, and Wiz has since published a running series of case studies documenting what the agent finds when it is pointed at real customer environments with permission [3].
The pattern is not unique to a single vendor. XBOW, an autonomous penetration-testing agent that operates without human input during an engagement, submitted vulnerability reports against real-world targets through HackerOne’s bug bounty programs and became the first AI system to reach the number one position on the platform’s United States leaderboard, submitting nearly 1,060 reports, of which 130 have been resolved and 303 triaged as valid to date, with the remainder still pending review, duplicates, or informational [4]. In a separately published benchmark, XBOW matched a twenty-year veteran penetration tester’s 85 percent solve rate on a 104-challenge suite, completing it in 28 minutes compared with the tester’s roughly 40 hours, illustrating the scale of the speed differential these agents introduce [9]. Neither Wiz’s nor XBOW’s approach depends on novel exploitation techniques; both rely on well-documented vulnerability classes. What has changed is that an AI system can now perform the reconnaissance, hypothesis formation, and iterative exploitation that previously required a skilled human operator, and it can do so continuously and at a fraction of the cost.
CSA’s AI Safety Initiative flagged this trend early. The 2024 research report “Using AI for Offensive Security” documented an 87 percent success rate for autonomous vulnerability exploitation in controlled testing and noted an AI agent reaching the top one percent of HackTheBox’s community of more than 670,000 members, concluding that offensive AI capability would mature faster than most organizations’ defensive posture [5]. The developments described in this note represent that forecast materializing in production environments rather than benchmark labs, which raises the stakes for the recommendations that follow.
Security Analysis
Case study: broken object level authorization in an airline booking API
Wiz’s most detailed public disclosure to date involves a major airline’s public-facing GraphQL booking API. The Red Agent began by analyzing the client-side JavaScript served to ordinary website visitors, extracted the flow used to acquire a session token, and minted an anonymous authenticated session using no credentials at all, through two sequential API calls [2]. It then used GraphQL’s built-in introspection capability — a feature meant to help legitimate developers discover an API’s schema — to enumerate 514 available queries and 428 available mutations reachable from that anonymous session, and identified endpoints that accepted simple sequential integer identifiers as parameters [2].
The underlying flaw was broken object level authorization, the vulnerability class that has held the top spot on the OWASP API Security Top 10 in both the 2019 and 2023 editions [6] and that industry research estimates is present in roughly 40 percent of observed API attacks [10]. The airline’s backend resolvers validated that a request carried a session token but never checked whether that session’s role entitled it to the specific booking record being requested. When the agent submitted twenty sequential booking identifiers to the vulnerable resolver, every single request returned a distinct customer’s profile: full name, date of birth, email address, phone number, masked payment card details, and up to two years of flight itineraries [2]. Because the anonymous session also carried write permissions, the same access path could have been used to hijack accounts, cancel flights, separate passengers from bookings, or issue unauthorized refunds. The exposure was discoverable in minutes by a system with no prior knowledge of the airline’s data model, using only publicly available frontend code and a documented API introspection feature — no credential theft, malware, or novel exploit technique was involved.
Case study: server-side request forgery in a cloud-hosted service
Wiz’s first published case in the series describes a different failure mode: a server-side request forgery (SSRF) vulnerability in a production Google Cloud Run service. Rather than testing a fixed list of SSRF payloads, the Red Agent built an internal model of the application’s input validation logic across 96 iterative interactions with the target, progressively refining its understanding of which inputs the service’s validation layer accepted, rejected, or partially sanitized [3]. This iterative, hypothesis-driven approach — closer to how a skilled human tester probes an unfamiliar system than to a traditional fuzzer — allowed the agent to construct a request that bypassed the validation logic and reached internal cloud metadata endpoints, a well-documented SSRF outcome that has enabled credential theft against cloud workloads in other publicly reported incidents.
Aggregate patterns across roughly 1,000 environments
Wiz has published aggregate statistics from the Red Agent’s first month of operation across approximately 1,000 customer environments, and the distribution of findings is instructive for prioritization. Access control failures — the category that includes the BOLA pattern described above — accounted for 54 percent of all discoveries, making them by far the most common exploitable weakness the agent identified [3]. Exposed secrets, such as API keys or credentials embedded in accessible code or configuration, made up 61 percent of the findings rated critical or high severity, indicating that when the agent does find a severe issue, credential exposure is disproportionately likely to be the cause [3]. SQL injection findings remained prevalent as well — over 52 percent of the injection findings the agent identified were rated critical or high severity, a reminder that well-understood, decades-old vulnerability classes persist in production systems even as attention shifts toward novel AI-specific risks [3]. Among JSON Web Token authentication bypasses specifically, 63.9 percent involved the alg:none misconfiguration, in which a service accepts a token whose signature algorithm has been set to “none” and therefore performs no cryptographic verification at all [3]. That such a well-documented and trivially fixable flaw still accounts for the majority of JWT bypasses the agent found suggests a persistent gap between known best practice and deployed configuration, not a new category of AI-discovered weakness.
What autonomy changes
The vulnerability classes involved here — BOLA, SSRF, SQL injection, JWT misconfiguration, exposed secrets — are not new, and traditional scanners and manual penetration tests have found examples of each for years. What autonomous agents change is the economics and cadence of discovery. Wiz reports that its design partners found vulnerabilities the agent surfaced had gone undetected despite extensive manual research, penetration testing, and active bug bounty programs [1], which indicates these agents are not merely replicating existing manual coverage faster; they are finding context-dependent logic flaws that require reasoning about how a specific application’s authorization model actually behaves under adversarial input, something signature- and rule-based tools structurally cannot do. Because equivalent agentic capability is emerging from multiple independent vendors rather than a single proprietary system, organizations should assume that adversaries have access to comparable tooling, whether commercial, open-source, or self-built, and that the interval between a vulnerable system going live and its weaknesses being found autonomously will continue to shrink.
Recommendations
Immediate Actions
Organizations operating public-facing APIs should assume that object-level authorization gaps are the single most likely severe weakness an autonomous agent will find, given that access control failures represented the majority of discoveries in Wiz’s aggregate data, and should prioritize an audit of every endpoint that accepts a user-supplied or sequential identifier to confirm that backend authorization checks — not just authentication checks — are enforced on a per-object basis. Security teams should also specifically verify that GraphQL introspection is disabled or restricted in production for any schema exposing sensitive queries or mutations, since introspection was the mechanism the Red Agent used to enumerate the airline’s entire attack surface from an anonymous session. JWT validation configurations warrant an immediate review to confirm that the alg:none algorithm and any other unsigned or weakly signed token paths are explicitly rejected, given how disproportionately that single misconfiguration accounted for JWT-related bypasses in the reported data.
Short-Term Mitigations
Beyond point fixes, organizations should evaluate deploying an agentic or AI-assisted red-teaming capability of their own — whether a commercial product or an internally governed adaptation of CSA’s Agentic AI Red Teaming Guide methodology — to test production and staging environments on a continuous rather than periodic basis, since the case studies above demonstrate that an autonomous adversary can complete reconnaissance and exploitation in a timeframe far shorter than typical audit or penetration testing cycles. API gateways and runtime protection layers should be evaluated for whether they can enforce object-level authorization centrally, rather than relying on every backend resolver to implement the check correctly, since a single missed resolver was sufficient to expose the airline’s full customer dataset. Secrets management practices deserve renewed attention given that exposed secrets accounted for the majority of critical and high-severity findings in the aggregate data; automated secrets-scanning integrated into the software development lifecycle, paired with short-lived credentials where feasible, directly addresses this category.
Strategic Considerations
At a governance level, security and risk leadership should treat the emergence of commercially available autonomous red-teaming agents as evidence that the assurance model built around periodic, human-scheduled penetration tests and annual audits may no longer be sufficient on its own, and should begin building continuous validation into their AI and cloud risk management programs rather than treating agentic offensive testing as a one-time pilot. Procurement and legal teams evaluating these tools should establish clear rules of engagement, scoping boundaries, and data-handling requirements before granting an autonomous agent access to production systems, given the write-level access such agents may exercise during exploitation. Finally, because the same reasoning capability that benefits defenders is available to attackers, organizations should factor the existence of autonomous offensive agents into their threat models for public-facing systems, particularly for API-first architectures where object-level authorization and authentication logic are most exposed to this style of automated discovery.
CSA Resource Alignment
CSA’s Agentic AI Red Teaming Guide provides the most directly applicable framework for organizations responding to this development, offering structured testing methodologies across twelve vulnerability categories specific to autonomous AI systems, including authorization and control hijacking, agent impact chain and blast radius analysis, and multi-agent exploitation [7]. While the guide is written primarily to help organizations red-team their own AI agents, the same authorization-hijacking and blast-radius concepts it defines apply directly to evaluating what an external autonomous red-teaming agent could reach and exploit if pointed at an organization’s API surface, and its step-by-step testing procedures offer a starting methodology for organizations that want to replicate agentic testing internally before adopting a commercial tool.
CSA’s 2024 research report, “Using AI for Offensive Security,” remains the most relevant prior CSA analysis of the underlying trend, having forecast — using its own controlled measurement of an 87 percent autonomous exploitation success rate and a top one percent HackTheBox ranking — that AI-driven offensive capability would scale faster than most organizations’ defenses, a conclusion the Wiz and XBOW case studies in this note now bear out in live production environments [5]. Organizations planning a strategic response to autonomous offensive AI should treat that report’s discussion of human-in-the-loop governance and GRC frameworks for AI-augmented security testing as the organizational counterpart to the technical guidance in the Red Teaming Guide.
CSA’s Cloud Penetration Testing Playbook offers relevant methodology for the cloud-hosted, API-centric environments where both case studies in this note occurred — an airline’s GraphQL API and a Google Cloud Run service — and organizations updating their cloud penetration testing programs to account for autonomous adversaries should cross-reference its cloud-specific testing scope against the API- and authorization-focused findings described here [8]. Organizations translating these technical findings into board-level risk framing should also consult CSA’s “AI Vulnerability Storm” briefing, published two months before this note, which addresses the same acceleration in AI-driven vulnerability discovery and exploitation from a CISO program-design perspective rather than a technical case-study perspective, and complements the Red Teaming Guide’s step-by-step methodology with organizational-readiness guidance [11].
References
[1] Wiz. “Introducing the Wiz Red Agent.” Wiz Blog, 2026.
[2] Wiz. “Red Agent POV: How an AI Attacker Found a Critical BOLA in an Airline’s API.” Wiz Blog, 2026.
[3] Wiz. “Red Agent POV: Inside the AI Attacker’s First Month of Findings.” Wiz Blog, 2026.
[4] XBOW. “How XBOW Ranked #1 in Autonomous Penetration Testing.” XBOW Blog, 2026.
[5] Cloud Security Alliance. “Using AI for Offensive Security.” CSA AI Technology and Risk Working Group, 2024.
[6] OWASP. “API1:2023 Broken Object Level Authorization.” OWASP API Security Top 10, 2023.
[7] Cloud Security Alliance. “Agentic AI Red Teaming Guide.” CSA AI Organizational Responsibilities Working Group, 2025.
[8] Cloud Security Alliance. “Cloud Penetration Testing Playbook.” Cloud Security Alliance, 2024.
[9] XBOW. “XBOW Now Matches the Capabilities of a Top Human Pentester.” XBOW Blog, 2024.
[10] Salt Security. “Broken Object Level Authorization (BOLA) – API1:2023.” Salt Security Blog, 2023.
[11] Cloud Security Alliance. “The ‘AI Vulnerability Storm’: Building a ‘Mythos-ready’ Security Program.” Cloud Security Alliance, 2026.