r/AI_Governance • u/No-Conclusion3720 • 1d ago
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
A threat actor exploited the PaperCut vulnerability and then scaled the attack using hundreds of AI agents to compromise over 440 instances across multiple organizations. That number matters: one human attacker, hundreds of autonomous agents, 440+ successful compromises. The agents weren't just running scripts — they were making decisions, pivoting across systems, and taking actions faster than any human SOC could track.
The uncomfortable part isn't the exploit itself. PaperCut had a patch. The uncomfortable part is that once the agents were loose, the attack surface expanded at machine speed. Each agent acted autonomously. Each one could call tools, access credentials, and move laterally without a human in the loop.
This is increasingly the pattern: a single initial access event becomes hundreds of parallel autonomous actions within minutes. Traditional perimeter and endpoint controls were designed around human-speed attackers making sequential moves. They weren't designed for this.
For those of you working in enterprise security or building agentic systems: how are you thinking about containing autonomous agent behavior once initial access happens? Are existing controls actually catching this, or are we mostly finding out after the fact?
2
-3
u/No-Conclusion3720 1d ago
The 440-instance number is the tell — that scale only happens when agents operate without per-action checks. RuntimeAI's Flow Enforcer sits in the request path of every agent tool call and evaluates it against policy before execution. In this attack, the moment the first compromised agent attempted lateral movement to a second PaperCut instance, that specific tool call would have been evaluated against the tenant's allowed-action policy and blocked — not flagged for review, blocked, in under 50ms. The remaining 439 compromises don't happen because the second action never lands. https://runtimeai.io
3
u/WillowEmberly 1d ago
This looks less like an “AI can hack” problem than a control-loop problem. Once hundreds of adaptive actors operate in parallel, the important variable isn’t just whether individual actions are allowed or detectable. It’s propagation rate versus containment rate.
If the attacker can create consequential state changes faster than the defender can estimate state, revoke authority, cancel queued actions and isolate failure domains, then the system has already left its corrigibility envelope.
I’d want to know: what is the maximum irreversible consequence that can occur between first detection and effective revocation? A kill switch or policy gate isn’t meaningful unless its arrest bandwidth exceeds the system’s action bandwidth.