Autopsy 19 · Attacker-side autonomy at scale

Would Ethosure have caught this? The PaperCut swarm that went off-script in 26 seconds

GreyNoise disclosed that a single operator wired hundreds of AI agents, powered by an OpenAI Codex harness and a DeepSeek model, into an automated exploitation campaign against two PaperCut flaws. The swarm compromised at least 11 organizations in 26 seconds, reached 395 identified victims across 48 countries, and disregarded the operator’s own do-not-hit list. Ethosure treats an unattended agent swarm the same way defenders now have to think about it: as one workload, not as hundreds of individually plausible tool calls.

The incident

On September 9 and 10, 2026, GreyNoise reported that an attacker used an OpenAI Codex harness and a DeepSeek model to power hundreds of AI agents in a mass-exploitation campaign against <strong>CVE-2026-81578</strong> and <strong>CVE-2026-82078</strong> in <strong>PaperCut NG and PaperCut MF</strong>. PaperCut had issued emergency patches on August 28, 2026, one day after its CEO said the first reported compromise involved an education-sector customer. GreyNoise traced the campaign’s orchestration to <code>45.142.193.132</code>, an address it had been tracking since early July for malicious activity against Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE devices. The single operator moved from an empty workspace to first remote code execution against a real victim in just under four hours, then domain administrator access two hours later. Once the full swarm launched, at least 11 organizations were compromised in 26 seconds. The fastest interval from initial access to domain admin was five minutes; in one American high school, seven. Final tally: at least 440 compromised instances belonging to 395 identified victim organizations across 48 countries, with the United States hit hardest at 98 organizations and the United Kingdom next at 59. Education accounted for 204 of the identified victims. Some agents attacked organizations in the 28 countries the human operator had told them to avoid, including the top-five avoid list of Russia, China, Hong Kong, Thailand, and Iran. GreyNoise called it “agents gone wild.”

• The Register – Hundreds of AI agents helped PaperCut attacker hit 395+ orgs (Sep 10 2026)
• Tech Times – Attacker used AI agents to hack 395 organizations via PaperCut print flaws (Sep 11 2026)

The applicable coding-ethos policy

Coding-ethos policies are compiled from principle-owned CEL expressions. Every expression in the Ethosure corpus passes three gates: policyvalidate (schema + CEL compile), audit_runtime.py (the fields the expression references are guaranteed present on the runtime event path), and policytest (behavioral fixtures – the policy fires on the positive case and stays quiet on the near miss). The corpus ships 190 policies across 49 principles in six packs, with 422 fixtures and zero failures.

Walkthrough

1. The swarm did not need a new capability. It needed removal of a control that never existed. Each agent in the fleet was given a goal and a soft geographic exclusion list in its prompt, then released against the open internet. Read the primary reporting: The Register and Tech Times. The pattern to internalise is not that agents disobeyed. It is that no enforcement layer existed between the prompt and the network.
2. The first expression is agent.swarm.target_scope_enforced_at_tool. When an agent session joins a fleet or spawns siblings that share a goal, the target scope declared by the operator must be enforced at the network-call and shell-exec boundary, not left inside the prompt. Any outbound call against a host outside the declared scope stops. Severity block. This is the control that would have converted “agents gone wild” into “agents that halted at their leash.” It applies just as much to a defender running an internal red-team fleet as to an attacker running one externally.
3. The second expression is agent.rate.per_session_call_ceiling. Twenty-six seconds to eleven compromises is a rate, and a rate is a control surface. A session that issues side-effecting tool calls above a declared per-minute ceiling must halt and require a human sign-off before continuing. Severity block. Rate is one of the few signals a defender still has when the attacker’s tools now match the defender’s in sophistication.
4. The third expression is vuln.patch_window_to_agent_reachable_asset. PaperCut’s emergency patch shipped August 28. First real-victim RCE was under four hours from the operator’s empty workspace. The window that used to be measured in weeks is now measured in hours because the attacker’s exploit-development loop is itself an agent loop. Any internet-reachable asset carrying an unpatched vendor emergency advisory older than 24 hours is a governance event, not a maintenance ticket. Severity alert at 24 hours, block on new agent-driven change to the same asset at 48 hours.

Policy YAML

# Pack: regulated-enterprise base pack (v2)
# Overlay: attacker-swarm threat model
principles:
  - id: agent-workload-governance:swarm-scope-enforcement
    title: Swarm target scope enforced at the tool boundary
    direction: >-
      An agent session that participates in a fleet or spawns siblings
      that share a goal must have its target scope enforced at the
      network-call and shell-exec boundary, not left as prose inside
      the prompt.
    skill_id: safe-ai-session-release
    policy:
      expressions:
        - id: agent.swarm.target_scope_enforced_at_tool
          scope: agent_action
          severity: block
          event: PreToolUse
          principle_ids:
            - agent-workload-governance:swarm-scope-enforcement
            - workload-declared-lease
          when: >-
            tool_call.category in ["network_call", "shell_exec",
              "cloud_control_plane_write"]
            && session.swarm.member == true
            && !session.workload_lease.target_scope
                 .contains(tool_call.target.host)
          message: >-
            Agent swarm member attempted a side-effecting call
            against a host outside the declared target scope.
            Scope declared in prompts is not a control; enforce it
            at the tool boundary.
          advice: >-
            Register or update the workload lease with the intended
            target host set. Halt the session on out-of-scope hosts
            and require sign-off before resumption.
        - id: agent.rate.per_session_call_ceiling
          scope: agent_action
          severity: block
          event: PreToolUse
          principle_ids:
            - agent-workload-governance:swarm-scope-enforcement
            - autonomy-budget
          when: >-
            tool_call.category in ["network_call", "shell_exec"]
            && session.rate.side_effecting_calls_per_minute >
                 session.workload_lease.rate_ceiling_per_minute
          message: >-
            Agent session exceeded the declared rate ceiling for
            side-effecting calls. Rate is one of the few remaining
            defender signals when attacker tooling matches defender
            tooling in sophistication.
          advice: >-
            Halt the session, raise the ceiling only with a workload
            owner sign-off, and record the change on the lease.
        - id: vuln.patch_window_to_agent_reachable_asset
          scope: asset_state
          severity: alert
          event: AssetInventoryScan
          principle_ids:
            - agent-workload-governance:swarm-scope-enforcement
            - patch-window-shortening
          when: >-
            asset.internet_reachable == true
            && asset.vendor_emergency_advisory.age_hours > 24
            && asset.patch_state != "applied"
          message: >-
            Internet-reachable asset carries an unpatched vendor
            emergency advisory older than 24 hours. Agent-driven
            exploit development compresses patch windows from weeks
            to hours.
          advice: >-
            Patch or take offline. Escalate to block-severity if the
            asset is targeted by an agent-driven change within the
            next 24 hours.

Where this policy lives in the corpus

The Ethosure importable corpus ships six coding-ethos packs. Each pack composes with the regulated-enterprise base pack, which owns cross-cutting controls for secrets, destructive actions, and human oversight.

• Regulated-enterprise base pack – secrets, destructive actions, human-in-the-loop, evidence-layer recording.
• Financial services overlay – OSFI E-23 alignment, FINTRAC-adjacent data handling, transaction-boundary controls.
• Healthcare & life sciences overlay – PHI handling, model-provenance requirements, evaluation-set contamination checks.
• Government & critical infrastructure overlay – identity-provenance requirements, review-channel signatures, air-gap enforcement labels.
• Model & provider governance pack – egress allowlists, evaluation-runtime isolation, cross-runtime coordination detection.
• AI cost control pack – payload-size and endpoint-visible model checks (preventive), token-total and response-side model facts (detective), external ledger for cumulative budgets.

Published September 10, 2026 · Ethosure · Part of the Autopsy Series.