The report
A third, separate Wiz intrusion involved a compromised Java gateway whose process tree reached a shell through jspawnhelper. The investigator observed a command-and-control loop and 602 post-exploitation steps over roughly four and a half hours. The commands inspected metadata routes, Kubernetes surfaces and middleware such as RabbitMQ, Hazelcast and Argo CD.
These names identify places the attacker tried to examine, not a list of breached services. The trace supports a claim that a compromised host ran a large adaptive reconnaissance sequence. It does not prove which credential requests succeeded or that a language model, rather than a conventional controller, selected each command. Wiz discusses likely agent assistance, but leaves model attribution inferential.
The Java gateway dossier records the process lineage and the difference between an attempted command and a realized effect. Investigators should start with process execution and network traces, then reconcile successful access tokens or persistent changes. Combining this gateway case with the separate Flowise and GraphQL MCP events as one victim would erase the different entry points and host authorities described in Wiz's reporting.