Ninety-nine scripts in twenty-four hours
Wiz took apart three intrusions in which an agent wrote its own tooling, captioned it, and iterated for a day at a stretch. Google Cloud made per-request inference logging generally available, recording the meter and never the prompt.
How we Build
The log records what the request cost and not what it asked
Google Cloud made inference request metadata logging generally available on 30 October. Turn it on and the Gemini Enterprise Agent Platform writes one entry for every inference request a project serves. Each entry carries the model, the region, token counts, Provisioned Throughput usage, latency and an error code. Google states the limit in the same paragraph. Entries hold metadata only and never contain prompts or responses. It covers Gemini models called through generateContent and Claude models through rawPredict. Headers can attribute usage to a team. The entries are then queried with SQL.
We ask that any output a firm relies on can be put back together afterwards.
Every output is reconstructable: a trace links it to the specification, the versions in play, the context, the tool calls made and the cost incurred, and a dated replay reproduced it.
Count what arrives against what that asks for. The model gives the version. The token counts give the cost. Two of the five are now a feature a firm can switch on in an afternoon. The context is excluded by design. The tool calls are not recorded, the specification never enters, and nothing here replays anything. What a firm has after switching it on is a meter. The risk is that the console says observability and nobody asks the work record again. Google is not claiming otherwise, so this is a gap in what a buyer will infer rather than in what a vendor promised. Nor is this the first source to bear on it. An NBER team reran 4,452 published economics replication packages in September and disconfirmed the same statement.
How we Assure
The intruder left eight hundred comment lines explaining itself
Avigayil Mechtinger set out three intrusions Wiz investigated, published 29 October. In the first, a new purpose-built script appeared every minute or two for about 24 hours, 99 of them in all, each opening with a written plan. The second ran 602 distinct steps across 12 technique families in roughly four and a half hours. The third sustained about 21 hours and chased some 25 organisations in parallel. It left 803 human-readable comment lines across its own scratch scripts. One of them notes that traffic to a DynamoDB endpoint cannot be told from the workload’s normal usage. Wiz also records public cases. ARTEX was used against South Korean financial institutions and took the data of roughly 67,000 people. In the ConnectWise compromise, which Microsoft attributes to the China-state-aligned actor Storm-0940, sign-ins were attempted against more than 2,250 tenants and privileged cloud access was reached in under three hours.
We tell clients that something behaving oddly has not thereby been shown to be hostile.
Not every rogue action is an attack.
Wiz reaches the same place from the other side. It names four fingerprints: a machine-paced cadence, self-correction, breadth-first coverage and disposable staging files. The task, it says plainly, is telling these apart from legitimate automation, and it adds that agents make mistakes, build broken tooling and pursue dead ends. That produces rogue-looking activity with no attacker behind it. These are Wiz’s own engagements rather than a published dataset. The sample is three attacks, and a vendor describing intrusions its sensor caught is describing the ones it can see.