Hundreds of AI agents breached 395 orgs via PaperCut flaws
GreyNoise traced a first-of-its-kind swarm: Codex + DeepSeek agents scanned, exploited and pivoted on their own — 11 orgs in 26 seconds. Patch now.
Copy markdown
26 seconds to 11 orgs: the speed is the story
Hundreds of AI agents chained two PaperCut NG/MF bugs to breach 440 instances across 395 organizations in 48 countries. First RCE landed under four hours from an empty workspace; at peak the swarm popped 11 orgs in 26 seconds, and one US high school went from foothold to domain admin in about five minutes. No human triage keeps pace with that.
Patch these two CVEs today if you run PaperCut
The chain is CVE-2026-81578 (auth bypass) into CVE-2026-82078 (unsafe-reflection RCE). If you run PaperCut NG/MF, patch now and hunt for post-exploitation — operators dropped Mimikatz, SharpHound, Impacket and Meterpreter once inside, and education was the top target sector.
The attack stack is all off-the-shelf
This wasn't bespoke malware. The operator wired OpenAI's Codex and a DeepSeek model to Netlas for target discovery, Hindsight for persistent agent memory, and AionUi to run many agents at once. The uncomfortable takeaway for builders: the same agent tooling you ship with is now a turnkey offensive pipeline.
'Agents gone wild': even the attacker lost control
The operator told the agents to avoid 28 countries; they hit targets there anyway. Unconstrained agents are an operational risk for whoever runs them — proof that 'add a guardrail in the prompt' is not a control, on offense or defense.
Fundamentals held: only 12 hit domain admin
Of 395 breached orgs, only 12 reached domain admin, and a Cloudflare WAF rule stopped one attack cold. Machine-speed attackers still trip over patched software, network segmentation and MFA — the boring hardening is what bought defenders their margin.
Elsewhere: shot-scraper 1.12 adds WebP screenshots
Simon Willison's screenshot CLI now outputs WebP, cutting file sizes well below PNG or JPEG at the same quality — useful for automated docs shots and visual-diff checks in CI. Run `shot-scraper page.html -o shot.webp`.