The attack had no one at the keyboard
An AI agent ran a full cloud intrusion alone, and a security vendor now screens every new package version at publication. Separately, one team cut its AI inference bill 68 per cent by instrumenting exactly where the tokens went.
How we Build
Cloudflare found its AI code reviewer’s cost had doubled, and traced the doubling to the call
The average cost of a review that Cloudflare’s internal AI code reviewer ran increased from $1.22 in March to $2.46 by August. No architecture change sat behind that rise. Cloudflare’s engineers instrumented the token usage of every call that it made. They found three causes. Reviewers had moved onto costlier models. A cache-prefix bug meant two of three reviewers almost never reused a cached prompt, and a sub-reviewer kept calling a tool that it had no permission to use. Fixing the cache bug alone cuts the cost from $2.47 to $2.02 per review. The full set of fixes brought it to $0.77. Median review time fell from 4m 09s to 1m 32s.
Every customer release carries the aggregate token cost of producing it, meaning everything spent building, evaluating and reworking it since the last one, and delivery telemetry is drawn from the systems the team already works in.
Our practice says that a release should carry its own token cost, drawn from the systems that the team already runs rather than reconstructed later. This case shows what that requires: a total alone told Cloudflare that cost had doubled, but said nothing about why. Only a per-call breakdown that the team could see let it find the cause and fix it. The saving came from engineering effort spent on purpose. The target was one team’s own internal tool rather than a customer release, so no team gets this result for free.
How we Assure
Wiz’s incident response team describes several recent cases like this one. In each, an AI agent that was driving the whole campaign itself did so rather than assisting a person: it found entry points, harvested credentials, and pivoted between platforms, rewriting its own exploit code whenever an attempt failed. In the case that Wiz documents in full, the agent broke in through a flaw that sat in an exposed developer tool. From there it harvested Kubernetes and cloud credentials, and minted itself a new identity inside the victim’s identity provider. It had used a cloud service account’s token-creation privilege to generate credentials across dozens of further identities, and it ran five workstreams at once across CI/CD systems, each of which fed the others fresh access. The same source address that it used was seen scanning over 600 other Wiz customer environments in the same window.
For every agent, the combination is assessed as one thing: untrusted content, private data and a path out.
We assess that combination as one thing, never the components alone. This incident is exactly why. The agent’s path crossed identity, cloud, Kubernetes and CI/CD systems. Each may have looked individually controlled on its own. The combination is what the attacker used. Wiz names no victim here, and it gives no rate for how common a campaign as complete as this one now is. It is one vendor’s incident caseload, read by the vendor that sells the defence against it. The agent belongs to the attacker, not to any firm a practice here governs.