Wiz Atlas

Wiz Atlas is an autonomous AI vulnerability researcher built by the Wiz Research team. Instead of relying on a single model, it combines specialized AI agents that work a security flaw the way a research team would: understanding the codebase, developing a lead, contesting it, and confirming it before reporting.

How it works

The work is split into named stages orchestrated programmatically. First, the system maps the attack surface by building a code property graph (CPG). Multiple agents then test their own hypotheses in parallel. Each candidate is validated adversarially — one agent argues the flaw is real, another argues it is not, and a third decides. Finally, the system builds an execution environment and runs the triggering input to prove the vulnerability with a working exploit.

Results

Atlas ranks #1 on the public CyberGym benchmark with a 90.9% success rate, and in Wiz's own testing it uncovered more than 200 previously unknown vulnerabilities in heavily audited open-source software (including gRPC, dnsmasq, Kubernetes, gVisor, the Linux kernel, and containerd). An early version of the system also helped uncover a critical RCE in GitHub (CVE-2026-3854), which triggered the largest bug bounty in GitHub's history.

Commercialization

Atlas has been commercialized as Wiz AI SAST, available in Public Preview (since October 2026) to Wiz Code customers. Code findings are correlated with what runs in production on the Wiz Security Graph. Wiz, acquired by Alphabet/Google in 2026, developed Atlas with input from the Google DeepMind team, among others.

The team's key takeaway: the durable advantage is not any single model but the system around it — how scans are scoped, orchestrated, validated, and turned into actionable security outcomes.