Scan for Good: Using AI to discover and fix high-priority exposures across public services and critical infrastructure
New initiative partners with under-resourced organizations to uncover, remediate exploitable risk at scale.
Gal Nagli
Head of Threat Exposure
Gal Nagli의 게시물
Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR
Wiz Red Agent independently discovered and exploited a GitHub Actions injection missed by GitHub’s Advanced Security, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention, five days after the flaw became live.
The Wiz Red Agent is Now Generally Available
Continuously uncover complex, exploitable risks to stay ahead in the AI Threat Era with the Red Agent
The Red Agent POV: The One Boolean That Broke a B2B Platform’s Credit System
Part 3: How the Red Agent bypassed a credit and paywall system by changing a single client-side value from false to true.
Wiz ASM for any environment, any risk, everywhere
Protect the modern attack surface with new auto-reconnaissance capabilities, deep internal context, and the Red Agent to find any risk, anywhere.
The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API
Part 2: How the Red Agent bypassed backend resolvers to expose an entire airline booking database in fifteen minutes
The Red Agent POV: How it Reasoned its Way to SSRF
Part 1: How the Red Agent uncovered a multi-step attack chain allowing SSRF-to-Local-File-Read on a GCP Cloud Run API
Introducing the Red Agent POV Series
An inside look at how the Red Agent, our AI-Powered Attacker, uncovers complex, exploitable risks in the wild
Red Agent and Claude Opus: Securing Production Targets at Scale
Delivering enterprise-grade continuous AI-powered risk assessment to hundreds of customers through the combined power of Wiz and Anthropic
Introducing the Wiz Red Agent- AI-Powered Attacker
Red Agent is an AI-powered, context-aware attacker that uncovers complex exploitable risks across your entire attack surface, continuously and at scale.
Hacking Moltbook: The AI Social Network Any Human Can Control
1 exposed database. 35,000 emails. 1.5M API keys. And 17,000 humans behind the not-so-autonomous AI network.
AI Agents vs Humans: Who Wins at Web Hacking in 2026?
Wiz Research teamed up with Irregular, a frontier AI security lab, to settle this once and for all.
Protecting Against Zero-Day Vulnerabilities with SOC-Level ASM Alert
Outpacing React2Shell using pre-breach alerts from Wiz ASM to eliminate exploitable risk before attackers find them
Introducing Wiz ASM: Context-Driven Attack Surface Management
Wiz launches Attack Surface Scanner to bring context, ownership, and prioritization to every exposure, anywhere.
Wiz Research Discovers One in Five Organizations Exposed to Systemic Risks in Vibe-Coded Applications - Here's How to Secure Them
New research reveals four common security risks systematically affecting vibe-coded applications - with remediation strategies curated together with Lovable.
Wiz Research Uncovers Critical Vulnerability in AI Vibe Coding platform Base44 Allowing Unauthorized Access to Private Applications
New discovery underscores security implications of AI-powered development and the rise of Vibe Coding Platforms
Securing Cloud Databases: Best Practices with ClickHouse and Wiz
How to protect sensitive data in cloud-hosted databases with built-in security controls, best practices, and continuous risk monitoring.
GitHub Action tj-actions/changed-files supply chain attack: everything you need to know
A supply chain attack on popular GitHub Action tj-actions/changed-files caused many repositories to leak their secrets. Discover how it unfolded and the steps to mitigate the risk.
Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History
A publicly accessible database belonging to DeepSeek allowed full control over database operations, including the ability to access internal data. The exposure includes over a million lines of log streams with highly sensitive information.
Wiz Research Identifies Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603)
The Wiz Incident Response team is currently responding to multiple incidents involving CVE-2024-50603, an Aviatrix Controller unauthenticated RCE vulnerability, that can lead to privileges escalation in the AWS control plane. Organizations should patch urgently.
Supply chain attack on lottie-player: everything you need to know
Supply chain attack in popular lottie-player library compromises websites with malicious Web3 wallet prompts – update or revert the library to avoid the compromised versions.