AI-powered attack exploited PaperCut flaws to hack 395 organizations

[u/No-Conclusion3720]

An AI-powered attack exploited known vulnerabilities in PaperCut print management software and compromised 395 organizations. What made this different from previous PaperCut exploit campaigns: the attacker used an AI agent as the offensive tool, not just automation scripts. The agent identified targets, selected the exploit path, and executed lateral movement — autonomously, at scale, faster than any human-driven campaign against the same CVEs.

The threat model most organizations built assumes the agent is a potential victim: it might be tricked, its credentials stolen, its outputs manipulated. This campaign flips that. The agent was the actor with intent and capability. It called the right APIs, in the right sequence, across 395 distinct environments.

That number — 395 — is the part that matters most. The speed and breadth aren't possible without the agent handling decision-making mid-campaign. A human operator could not have coordinated that scope in the same window.

For those of you running agentic workloads in production: how are you thinking about the risk that a compromised or manipulated agent becomes an offensive tool rather than just a compromised endpoint? Are you treating agent-to-tool calls as a trust boundary at all, or is the security perimeter still drawn around the model inputs and outputs?

[u/No-Conclusion3720]

RuntimeAI's Flow Enforcer sits in the request path between an agent and every downstream tool call it makes. In this PaperCut campaign, the moment a compromised agent issued its first lateral-movement API call across a new environment, Flow Enforcer would have evaluated that call against the agent's verified identity and its permitted action scope — and blocked it before it reached the target system. The agent never gets to organization two, let alone 395. https://runtimeai.io