The 440-to-12 Ratio Carries More Information Than the 26 Seconds
The speed figures will take all the attention, but the number to leave with is that gap: 440 instances breached, 12 reaching domain admin. That gap says AI made **breadth** cheap, not **depth**. Scanning targets, trying exploits, hitting several hundred hosts at once — those parallelize mindlessly, and agents do them fast and cheaply. Going from one print server to control of an entire domain does not run on parallelism; it runs on how that particular machine happens to be configured: whether PaperCut sits on a domain controller, whether its service account holds domain admin rights, whether the two 2021-era noPac flaws (CVE-2021-42278 and CVE-2021-42287) were ever patched. The simplest of the three escalation paths GreyNoise documents is exactly that — the PaperCut host running on a domain controller or under a domain-admin service account, so the attacker just adds an account to Domain Admins. Which means the ceiling on your losses is still set by your own configuration. That is good news, and it is also a very concrete to-do list.
What Got Compressed Is Human Response Time
Eleven organizations in 26 seconds, seven minutes from initial access to domain admin — what those numbers break is the assumption underneath incident response. The old rhythm of "patch ships → customer schedules a window within a few days → upgrade" quietly assumed the attacker also needed people working host by host. Not anymore. The timeline makes it plain: PaperCut shipped emergency patches on August 28 (its CEO said the first reported compromise came in on August 27, at an education-sector organization), and this mass deployment began August 31. Patch first, breaches after — those few days are the gap. GreyNoise reads education's 204 organizations as mostly reflecting PaperCut's customer base rather than deliberate selection, characterizing the campaign as opportunistic; and schools are precisely the places least able to complete an emergency upgrade cycle inside three days.
Guardrails on Frontier Models Don't Close This Path
The stack composition deserves its own look: the harness is commercial Codex, the model actually driving decisions is a DeepSeek model — reporting indicates it was chosen because it lacks the content-safety restrictions of US frontier models — with Netlas.io for target discovery, public offensive tooling for execution, plus tooling for persistent memory and for driving many agents at once. That shape makes one point: resting security policy on a handful of frontier models is not enough, because the "brain" in this chain is swappable while the orchestration layer is a commodity. This site covered GitSpawn on September 7 — malicious repositories getting coding agents to execute code on a developer's machine — where the agent was the victim. This time the same class of tooling is the weapon. Both directions point at the same fact: the agent toolchain is now mature enough to be used from either side. GreyNoise could not determine the attacker's ultimate objective, and notes this access could serve data theft or ransomware. One conclusion worth keeping is the consensus among security researchers: against this speedup, standard defenses — multi-factor authentication, least privilege, short-lived session tokens, anomaly detection — still work. AI changed how much time you have, not what you should be doing.
via: GreyNoise, "Agents Gone Wild", BleepingComputer, The Register, Help Net Security