Wiz
Wiz is a cybersecurity company specializing in cloud security, providing services for security risk detection, vulnerability management, and threat protection across cloud infrastructure. Its products scan and analyze assets and configurations within cloud environments to help enterprises identify security risks. Wiz supports multi-cloud platform integration and delivers continuous Cloud Security Posture Management (CSPM) solutions for enterprise customers.
Core Facts
Google first handed Argon to trusted security experts for early validation through a project called Fairwind
Security firm Wiz has used Argon through the Scan for Good program, and in an early demonstration the model discovered a critical vulnerability in a medical software used by hospitals worldwide that was leaking sensitive personal information.
These PHP vulnerabilities were discovered by a model at the GPT 5.6 level, while the Wiz team independently discovered the same vulnerabilities.
Timeline (last 90 days)
Wiz's CTO coined the term "Vulnpocalypse" to describe a situation in which aging internet code erupts in concentrated security vulnerabilities and the pace of vulnerability discovery and remediation is out of balance.
Wiz's CTO believes the problem is not the destructive power of a single vulnerability, but that the fragility of the software supply chain is being exploited at scale.
Wiz's CTO believes the PHP2Shell vulnerabilities may be the prelude to a "vulnpocalypse."
Cloud security platform Wiz observed that Carbon leads on its web penetration testing benchmark.
Wiz disclosed that a malicious version, LiteLLM 1.107.0, was uploaded to PyPI, with the related GHCR and Docker Hub image tags also implanted, and it was subsequently quarantined and removed; the most recent secure version is 1.106.2.
According to security firm Wiz's earlier research on cloud service account leaks, as well as the disclosure in Anthropic's model card about the amplification effect of tool calls, similar problems have repeatedly appeared across multiple platforms.
These PHP vulnerabilities were discovered by a model at the GPT 5.6 level, while the Wiz team independently discovered the same vulnerabilities.
According to the timeline disclosed on Wiz's official blog: the first vulnerability was discovered on August 19, the exploitability of unauthenticated RCE on Drupal and WordPress was confirmed on August 20 and 21 respectively, and it was reported to the PHP security team on August 24.
The two vulnerabilities were discovered by the Wiz research team and were initially located through AI-assisted tools (Wiz Atlas, Gemini 4 Argon, GPT-5.6 Sol).
Wiz was founded in 2020.
16 more timeline events
All Facts (20)
Google first handed Argon to trusted security experts for early validation through a project called Fairwind
75%VerifiedSecurity firm Wiz has used Argon through the Scan for Good program, and in an early demonstration the model discovered a critical vulnerability in a medical software used by hospitals worldwide that was leaking sensitive personal information.
75%Unverified2024年AI安全初创公司的融资总额超过80亿美元
70%Partially VerifiedThese PHP vulnerabilities were discovered by a model at the GPT 5.6 level, while the Wiz team independently discovered the same vulnerabilities.
65%UnverifiedWiz's CTO believes the problem is not the destructive power of a single vulnerability, but that the fragility of the software supply chain is being exploited at scale.
50%UnverifiedWiz's CTO believes the PHP2Shell vulnerabilities may be the prelude to a "vulnpocalypse."
50%UnverifiedWiz's CTO coined the term "Vulnpocalypse" to describe a situation in which aging internet code erupts in concentrated security vulnerabilities and the pace of vulnerability discovery and remediation is out of balance.
50%UnverifiedCloud security platform Wiz observed that Carbon leads on its web penetration testing benchmark.
50%UnverifiedAccording to security firm Wiz's earlier research on cloud service account leaks, as well as the disclosure in Anthropic's model card about the amplification effect of tool calls, similar problems have repeatedly appeared across multiple platforms.
50%UnverifiedAccording to the timeline disclosed on Wiz's official blog: the first vulnerability was discovered on August 19, the exploitability of unauthenticated RCE on Drupal and WordPress was confirmed on August 20 and 21 respectively, and it was reported to the PHP security team on August 24.
50%UnverifiedThe two vulnerabilities were discovered by the Wiz research team and were initially located through AI-assisted tools (Wiz Atlas, Gemini 4 Argon, GPT-5.6 Sol).
50%UnverifiedAI participation in vulnerability discovery has moved from experimentation to real-world practice, and this collaboration between OpenAI and Wiz is a landmark moment.
50%UnverifiedWiz was founded in 2020.
50%UnverifiedWiz is a cloud security startup focused on agentless scanning of cloud workloads and code-to-cloud capabilities.
50%UnverifiedIn the Wiz research team's shadow A/B testing on real-world systems, Gemini 4 found more than twice as many vulnerabilities as other baseline models.
50%UnverifiedIn long-duration security tasks, Gemini 4 can work continuously for hours, chaining together complex vulnerability signals and locating critical risks that could not be found using other SOTA models.
50%UnverifiedThe Wiz researchers concluded that, based on the cybersecurity capabilities demonstrated by Gemini 4, defenders now have the means to find and fix vulnerabilities faster and are able to stay ahead of attackers.
50%UnverifiedArgon independently discovered a high-severity vulnerability lurking in software widely used by hospitals worldwide, which multiple frontier models had previously failed to find
50%UnverifiedSecurity firm Wiz used Argon for black-box penetration testing, and Argon was able to autonomously discover vulnerabilities and provide proof-of-concept without viewing the source code
50%UnverifiedSecurity firm Wiz initially reported that browser credentials were stolen, but the video author pointed out that in reality only saved login metadata was read and no encrypted credential material was retrieved.
50%