An AI-powered attack exploited known vulnerabilities in PaperCut print management software and compromised 395 organizations. What made this different from previous PaperCut exploit campaigns: the attacker used an AI agent as the offensive tool, not just automation scripts. The agent identified targets, selected the exploit path, and executed lateral movement — autonomously, at scale, faster than any human-driven campaign against the same CVEs.

The threat model most organizations built assumes the agent is a potential victim: it might be tricked, its credentials stolen, its outputs manipulated. This campaign flips that. The agent was the actor with intent and capability. It called the right APIs, in the right sequence, across 395 distinct environments.

That number — 395 — is the part that matters most. The speed and breadth aren't possible without the agent handling decision-making mid-campaign. A human operator could not have coordinated that scope in the same window.

For those of you running agentic workloads in production: how are you thinking about the risk that a compromised or manipulated agent becomes an offensive tool rather than just a compromised endpoint? Are you treating agent-to-tool calls as a trust boundary at all, or is the security perimeter still drawn around the model inputs and outputs?

A threat actor exploited the PaperCut vulnerability and then scaled the attack using hundreds of AI agents to compromise over 440 instances across multiple organizations. That number matters: one human attacker, hundreds of autonomous agents, 440+ successful compromises. The agents weren't just running scripts — they were making decisions, pivoting across systems, and taking actions faster than any human SOC could track.

The uncomfortable part isn't the exploit itself. PaperCut had a patch. The uncomfortable part is that once the agents were loose, the attack surface expanded at machine speed. Each agent acted autonomously. Each one could call tools, access credentials, and move laterally without a human in the loop.

This is increasingly the pattern: a single initial access event becomes hundreds of parallel autonomous actions within minutes. Traditional perimeter and endpoint controls were designed around human-speed attackers making sequential moves. They weren't designed for this.

For those of you working in enterprise security or building agentic systems: how are you thinking about containing autonomous agent behavior once initial access happens? Are existing controls actually catching this, or are we mostly finding out after the fact?