Teamday
← Back

Wiz CTO Ami Luttwak: AI Attacks Now Finish in 20 Minutes

a16z
agentsenterpriseautomationsafetybusiness

Why Wiz's Ami Luttwak Calls October 2026 "Black October"

Ami Luttwak is co-founder and CTO of Wiz, the cloud security company that is now part of Google. He joined a16z general partners Zane Lackey and Sarah Wang to explain what Wiz calls Black October: a month with more security incidents than Wiz has ever seen, including PHP2Shell, which he calls probably the most severe vulnerability ever found by AI. His argument is that two things arrived together. Models are now good enough to find and exploit complex vulnerabilities, and open-source models caught up faster than expected. An attack that took the best human teams weeks or months now runs, in his words, in "around 20 minutes."

Startups holding AI keys are the target: Wiz's count of AI development platforms attacked in October started at nine companies and has reached 15. They are targeted because they hold customers' AI keys. Luttwak describes the founder's morning after: the attacker was in and out with every customer's keys within 20 minutes, before a small team could wake up. His first practical advice is to put spending limits on AI keys, because stolen keys run up large bills.

PHP2Shell and the patching gap: Almost all Wiz customers had PHP running somewhere. About 50% patched within the first two to three days, but PHP runs on roughly 70% of the internet, some versions get no patch, and Luttwak expects this one vulnerability to take years to clear. He does not see a path to automatic patching for legacy companies. New companies can design for it, if development, testing, CI/CD and operations are all automated end to end: "for new companies, you should design your system to be able to auto-patch."

The blue agent is a cost pipeline: Wiz's blue agent investigates attacks, and it can't use the best model for everything: "I cannot run the most advanced, expensive model on every event." So an event starts at a deterministic detection, then goes to a cheap model, then a more advanced one, and only if all agree does the most advanced model decide whether it is really malicious before the customer is told. Luttwak calls designing these multi-model pipelines the new engineering challenge, and says Wiz tests every model from every lab continuously because each behaves differently on speed, cost and capability.

Exposure first, code scanning later: Luttwak says a company that scanned all its code with a frontier model in April could have wasted $5 million, and some customers now spend tens of millions on code scanning. Then a new model version arrives and the question is whether to do it all again. "You cannot throw money on code scanning and think you're done." Wiz's order of work: map exposure deterministically, run an agent over everything unauthenticated and internet-facing (a few minutes per endpoint), then spend up to 10 hours attacking a critical application. A hardcoded key in a mobile app is a more likely way in than a deep code bug.

Attack yourself continuously: What was secure last week may not be secure against this week's model. "So, the only way to know you have a problem is to continuously attack yourself with the latest models." That is the job of Wiz's Red Agent, which attacks a customer's applications from outside using Wiz's inside context. Luttwak says a majority of Wiz customers already use it, and it is one of the fastest growing features Wiz has released. Findings too expensive to fix get handed to the blue agent as new detections.

What security teams should stop doing: Asked which tools CISOs no longer need, Luttwak goes after the work instead: "Most of what security teams do is not security." Compliance reports and lists of configuration checks don't stop an attacker. He wants teams on three things: finding critical risk, mitigating it or adding detections, and response readiness. Budget alone won't fix it. Secure design matters more: sandboxes, isolation, network and process lockdown, and assuming a container escape will happen.

6 Takeaways From Ami Luttwak on Defending Against AI Attackers

  • Plan for a 20-minute attack - Detection and response that depend on someone waking up are too slow
  • Cap your AI keys - Startups are hit for LLM credentials, and limits bound the damage
  • Scan what is exposed before what is written - Unauthenticated internet-facing surfaces come before whole-codebase scans
  • Tier your models - Deterministic checks, then cheap models, then expensive ones, or the service loses money
  • Re-test with every new model - Defenses are no longer static because attacker capability rises with each release
  • New companies should build for auto-patch - It needs automated dev, testing, CI/CD and operations from the start

What Black October Means for Companies Running AI Agents

Luttwak's forecast is blunt: the companies that survive will redesign what they expose to the internet and take everything else offline. For teams building on AI, the more useful part is the engineering detail. Wiz runs defense and offense as budgeted agent pipelines, where cheap checks filter what expensive models see and the red side feeds the blue side. He also describes Scan for Good, a Wiz initiative that scans public services that ask for help, to push them toward continuous red-team scanning. For a defender running this kind of pipeline on its own code, see how Mozilla's agents find and fix Firefox bugs.