Wiz launches Red Agent POV series

Wiz has launched the Red Agent POV series, a blog series from its research team that details how its AI-powered pentester, Red Agent, discovers complex exploitable risks in production environments.

The series launches with a post on how Red Agent found a critical server-side request forgery (SSRF) vulnerability in a GCP Cloud Run service. Over three scan runs and 96 iterations, the agent bypassed validation that only accepted GitHub links, escalating from SSRF to full credential and source code extraction without authentication.

Wiz also shared aggregate data from a one-month period: Red Agent completed hundreds of thousands of scans across about 1,000 environments, surfacing over 17,000 unique findings, including more than 5,500 high and critical vulnerabilities. Access control flaws accounted for 54% of findings, and over 61% of exposed secrets were rated critical or high severity.