Four Days From Patch to Exploitation, Seven Minutes From Access to Domain Admin
Risk reduction does not work as an event. It works as a process that runs continuously inside a structured operating model, or it does not work at all.
This month that was proved from the other direction. A likely Russian-speaking operator used AI agents to compromise 395 organizations through PaperCut flaws that already had a patch. The attacker’s decisive advantage wasn’t a novel technique. It was a process that operated continuously.
What Happened: 395 Organizations, Three Days After the Patch
PaperCut published its urgent security advisory on August 27, 2026, and released its first emergency patch early on August 28 for vulnerabilities later identified as CVE-2026-81578 and CVE-2026-82078. The GreyNoise-observed campaign began on August 31.
According to GreyNoise findings reported last week, the operator ran hundreds of AI agents, OpenAI’s Codex as the agent harness, driven by a DeepSeek model rather than OpenAI’s, plus commodity offensive tooling, to build, test, and refine exploits, drawing target lists from the Netlas scanning platform. The result: at least 440 instances across 395 organizations in 48 countries. Credentials from 280 victims, operating system and domain secrets from 147, administrator privileges at 12. Education was roughly half the breaches.
The Attacker’s Advantage Was Structure, Not Skill
Sketch this campaign on a whiteboard and it looks like a mature security program; the same stages, in the same order, just pointed the other way. Discovery ran continuously against what was actually exposed. Development was iterative, tested against live targets rather than a lab. Execution was measured and repeatable.
No step required a novel technique. Every step required a loop that ran without waiting for a human, a maintenance window, or a change advisory board.
Every interval in that timeline was set by the attacker’s process, not by any defender’s ignorance of the flaw.
The Gap Was Never Knowledge of the Flaw
Four days separated the emergency updates from the start of exploitation. The vulnerabilities had identifiers, vendor guidance, and available fixes before this campaign began. Information alone was not enough.
The constraint is the distance between knowing a fix exists and having closed the exposure everywhere it lives. That distance is set by process. If discovery, prioritization, remediation, and verification depend on periodic cycles, a four-day exploitation window can open and close between them.
Why Periodic Security Loses by Definition
Point-in-time assessment made sense when attacker discovery was the bottleneck. Finding exposed instances took effort and building a reliable exploit took time, so a quarterly scan sampled a threat moving at roughly human speed.
Both bottlenecks are gone. Target discovery is a commodity API call, and exploit development is an automated loop that improves against live targets. A control tested once a quarter sits unverified for the rest of it.
Reported the same week, attackers chained two JFrog Artifactory flaws to create administrator accounts, in some cases in under five minutes, with 49 to 62 percent of reachable instances vulnerable to at least one of the three related flaws. Two products with the same story: a known exposure, and a window measured in days.
What a Continuous Operating Model Actually Requires
Continuous does not mean scanning more often. It means the loop closes without anyone remembering to start it, and the loop has a defined shape.
Run that way, it produces numbers leadership can read every week without commissioning anything: systems exposed, how many of those exposures are proven exploitable rather than merely flagged, the age of the oldest one still open, and how many have been closed since last week. Those four numbers separate a program that is running from a program that is reporting.
What This Changes for Security Leaders
The uncomfortable part is not the AI. It is that the winning side ran a continuous, measurable process, and the losing side ran a calendar.
No defender answers 26 seconds with a faster patch. Risk reduction has to be built into a continuous operating model; scoping, discovery, prioritization, validation, and mobilization as one measured loop, because the attack that beat these 395 organizations already was.
That model is Continuous Threat Exposure Management (CTEM). Running it, rather than scheduling around it, is the difference between the two sides of this campaign.
