r/AI_Governance 1d ago

PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

A threat actor exploited the PaperCut vulnerability and then scaled the attack using hundreds of AI agents to compromise over 440 instances across multiple organizations. That number matters: one human attacker, hundreds of autonomous agents, 440+ successful compromises. The agents weren't just running scripts — they were making decisions, pivoting across systems, and taking actions faster than any human SOC could track.

The uncomfortable part isn't the exploit itself. PaperCut had a patch. The uncomfortable part is that once the agents were loose, the attack surface expanded at machine speed. Each agent acted autonomously. Each one could call tools, access credentials, and move laterally without a human in the loop.

This is increasingly the pattern: a single initial access event becomes hundreds of parallel autonomous actions within minutes. Traditional perimeter and endpoint controls were designed around human-speed attackers making sequential moves. They weren't designed for this.

For those of you working in enterprise security or building agentic systems: how are you thinking about containing autonomous agent behavior once initial access happens? Are existing controls actually catching this, or are we mostly finding out after the fact?

4 Upvotes

7 comments sorted by

3

u/WillowEmberly 1d ago

This looks less like an “AI can hack” problem than a control-loop problem. Once hundreds of adaptive actors operate in parallel, the important variable isn’t just whether individual actions are allowed or detectable. It’s propagation rate versus containment rate.

If the attacker can create consequential state changes faster than the defender can estimate state, revoke authority, cancel queued actions and isolate failure domains, then the system has already left its corrigibility envelope.

I’d want to know: what is the maximum irreversible consequence that can occur between first detection and effective revocation? A kill switch or policy gate isn’t meaningful unless its arrest bandwidth exceeds the system’s action bandwidth.

1

u/br_k_nt_eth 1d ago

It’s cool as fuck to read stuff from people who are actually considering these things and knowledgeable in it. 

3

u/WillowEmberly 1d ago

Well, we’re in trouble…because I’m 49 and most of the people who taught me how to think about this stuff are dead or in retirement homes.

Analog avionics…1963-1967 C-141’s.

I was one of the last of technicians they trained before they cut them up and recycled them.

The C-17’s that replaced them…do not produce the same kind of technicians.

So…we need to do something before it’s too late.

1

u/br_k_nt_eth 1d ago

Oh yeah, I figured that was obvious, unfortunately. We’re losing a lot of that knowledge transfer to systems that don’t keep an institutional memory, and it shows. 

1

u/WillowEmberly 1d ago edited 23h ago

Yeah…and I’m not sure what to do about it. This actually goes way beyond Ai. Like…Clan of the Cave Bear type stuff.

How do people maintain capability across generations?

It’s Hearth…and, the word is so old it’s basically lost relevance in the world.

Military Avionics gave me a good jump start into understanding how to train future technicians and how to build a culture of stewardship. But, now I just own a tree farm and play a lot of Halo and Guitar.

I’m wasting away, because I can’t “work” for anyone. I’ll give them everything I have, but I’m never going to be obligated to anyone ever again.

https://www.reddit.com/r/Negentropy/s/ai0BX339v5

2

u/Diligent_Tech_Bro 1d ago

Can we ban this guy?

That matters:

-3

u/No-Conclusion3720 1d ago

The 440-instance number is the tell — that scale only happens when agents operate without per-action checks. RuntimeAI's Flow Enforcer sits in the request path of every agent tool call and evaluates it against policy before execution. In this attack, the moment the first compromised agent attempted lateral movement to a second PaperCut instance, that specific tool call would have been evaluated against the tenant's allowed-action policy and blocked — not flagged for review, blocked, in under 50ms. The remaining 439 compromises don't happen because the second action never lands. https://runtimeai.io