The Attack Nobody Expected at This Scale
Late August. Hundreds of autonomous AI agents — each one a discrete, lab-trained operator — fanned across the public internet hunting for exposed PaperCut print management servers. A likely Russian-speaking actor orchestrated the swarm. The targets were real. The speed was unlike anything we'd catalogued before.
This is not theoretical. This is not a tabletop exercise with a slide deck and a facilitator. This is an offensive operation where AI agents executed reconnaissance, target selection, and initial access across a perimeter that most security teams never thought to harden. The implications for AI security infrastructure are immediate and uncomfortable.
What makes this incident genuinely different from every prior "AI in cybersecurity" headline is that the agents weren't assisting a human operator. They were the operation. The human chose the objective. The swarm did the work.
How AI Is Used in Cybersecurity Here — and What Changes
Most discussions about AI in cyber security still orbit the defensive side: anomaly detection, triage automation, threat intelligence summarization. Useful work. Important work. But the PaperCut swarm inverts the frame entirely.
In this attack, AI agents performed what a skilled human recon team would do — scanning CIDR ranges, fingerprinting services, identifying vulnerabilities, attempting exploitation, except they did it in parallel, at machine speed, without fatigue, and without the bottleneck of a small team's working hours. An agentic AI system breaks the assumption that attack preparation is a slow, human-paced process you can detect through dwell-time analytics.
The distinction matters for how we build defenses. If "AI in cyber security" previously meant faster alerts on a human-paced battlefield, it now means standing up machine-speed detection against a machine-speed adversary.
The Target Was Deliberately Soft
PaperCut is print management software. It sits on the network perimeter, often with public-facing web interfaces, frequently unpatched, and almost always outside the spotlight of a CISO's risk register. This is not a zero-day in a core banking mainframe. The swarm targeted instances that internet-exposure-scanning tools had already flagged as vulnerable.
That targeting logic is the part worth sitting with. The agents didn't need novel exploits. They needed a large surface area of neglected endpoints. Agentic AI doesn't need to be clever when the population it's hunting is already compromised by neglect. We saw the same logic on the crimeware side when the Djinn Stealer campaign weaponized a neglected remote-management tool to go after AI tooling and cloud secrets, the neglected administrative plane is where attackers of every stripe now converge.
This echoes broader risks around enterprise attack surface that research from McKinsey and others has mapped extensively: organizations consistently underestimate the breadth of their internet-exposed footprint, and the governance gap around that surface widens every quarter a new SaaS or management tool ships with a public dashboard.
Redefining the Kill Chain for Machine-Speed Adversaries
The classical cyber kill chain, reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives, was built as a descriptive model for human-paced operations. Each phase had a tempo that gave defenders time to react between stages.
The PaperCut swarm compressed that timeline. Reconnaissance and exploitation happened nearly simultaneously because the agents didn't need to "decide" between scanning and attacking. They scanned, evaluated, and exploited in a continuous loop. A defender watching for the telltale multi-hour recon dwell that triggers alert rules saw nothing unusual, because from any single target's perspective, only one agent showed up.
IBM's annual threat intelligence reporting has consistently highlighted how mean time to exploit has been shrinking across the board, but this incident represents a step-function change. The kill chain didn't just speed up; it collapsed for the individual victim.
What This Means for AI Security Infrastructure
Here's where the defensive conversation has to get concrete. "Build AI-powered defenses" is not a strategy, it's a category. The PaperCut incident tells us specifically what defensive AI security infrastructure needs to handle:
Distributed low-frequency scanning. One agent per target looks benign. Hundreds of agents sweeping the same range look like nothing currently in most SIEM correlation rulebooks. Detection requires aggregate pattern recognition across the entire address space, something cloud-scale telemetry providers can do that on-prem log pipelines cannot.
Perimeter surface governance. The cheapest defense is removing the attack surface entirely. Every internet-exposed management interface that doesn't need to be exposed is a door left unlocked for a swarm that has nothing better to do at 3 AM than try keys.
Velocity-matched response. If the adversary operates at agent speed, a ticket-based response workflow, detect, triage, assign, remediate, is architecture from the wrong decade.
The organizations that will weather the next iteration of this are those that treat AI security infrastructure as a first-class architectural concern, not a bolt-on layer sitting atop a human-paced stack.
Agentic Risks the Industry Keeps Deferring
There's a governance problem underneath the technical one. These agents were trained in a lab environment and pointed at production targets. The training pipeline itself, the reinforcement signals that taught these agents what constitutes a successful compromise, represents a supply chain question nobody in enterprise security has a good answer for yet.
McKinsey's enterprise AI risk frameworks acknowledge this at a high level: autonomous agents introduce decision-making opacity at exactly the layer where accountability must live. When an agent chain executes an exploit, who in your organization's governance model bears the audit trail? The answer today is "no one," and that vacuum will get louder as more incidents land. It is the same accountability gap we examined from the defender's seat in Securing Autonomous Agents: The New CISO Challenge, enterprises are deploying agents faster than they can govern them, and offensive actors have no such scruples.
The offensive-research dimension here also raises a question the security community has danced around since LLMs became capable: how much of the capability to orchestrate a swarm like this is now commoditized? Proofpoint and other researchers tracking AI-driven offensive tooling have noted the steady migration of formerly specialist skills into accessible toolchains. The PaperCut swarm suggests the transition from "a nation-state could do this" to "a well-resourced group can do this" is largely complete.
And the governance answer isn't only perimeter defense, it's lifecycle discipline. Agents that aren't securely provisioned, monitored, and decommissioned become liabilities on both sides of the fight, a point we detail in Beyond Automation: Securing the Forgotten Lifecycle of AI Agents.
A Point About Defensive Posture
I've spent enough years in this field to know that the industry metabolizes scary incidents into conference talks and quarterly planning documents. This one shouldn't land that way. The PaperCut swarm is evidence that the fundamental assumption underpinning most enterprise security architecture, that attacks arrive at human speed, is already violated, not predicted to be violated.
The organizations that respond by bolting an AI copilot onto their existing SOC workflow are making the same category error as building a taller fence when the adversary has learned to fly. The response has to be architectural: machine-speed detection, surface reduction, and governance frameworks that can actually track autonomous agent behavior.
That work is hard. It's also non-optional now. The swarm has already arrived at the gate.
