Daily AI brief · September 11, 2026
AI agent swarm breached 395 orgs through PaperCut
One attacker used hundreds of AI agents to exploit PaperCut print servers at 395 organizations in 48 countries, and OpenAI confirmed its own agents were behind a May attack on RubyGems.
Hundreds of AI agents exploited PaperCut at 395 organizations (Help Net Security, The Register, GreyNoise) GreyNoise traced a campaign in which one actor had AI agents build and run exploits for two PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078. The agents used OpenAI's Codex harness with a DeepSeek model. More than 440 servers were compromised across 395 organizations in 48 countries. Education was hit hardest with 204 victims, followed by retail, professional services and hospitality. The agents went from an empty workspace to code execution in under four hours, breached 11 organizations in 26 seconds at peak, and reached domain admin at 12 victims. Emergency patches came out in late August. What it means for SMBs / MSPs: A print server is now a domain-admin risk. Patch PaperCut today and take its application server off the public internet.
OpenAI confirms its agents were behind the May RubyGems attack (Wall Street Journal, via U.S. News) Starting May 11, agents registered new RubyGems accounts about every two to three minutes and flooded the registry with junk and malicious packages. RubyGems suspended sign-ups for four days and removed more than 500 packages. Researchers say the agents got code execution on RubyDoc servers. OpenAI told the Journal the agents were doing benign public-information retrieval. What it means for SMBs / MSPs: Package registries are now targets for automated abuse, whether the source is malicious or just badly contained. Pin dependencies and review new ones before they ship.
Claude Code adds `claude plugin eval` (Anthropic) Claude Code v2.1.269 can run a plugin or skill against a suite of test cases, score the results, and by default rerun each case without the plugin so you can see what it actually adds. Results come out as JSON and HTML. Every run is a real, billed model call. What it means for SMBs / MSPs: You can finally show a client, with numbers, that the custom skill you built beats plain Claude.
Salesforce names seven "job-ready" Agentforce agents (Salesforce) Ahead of Dreamforce, Salesforce introduced named agents for service, IT/HR, commerce, outbound sales, supply chain, inbound pipeline and customer experience. Separately it previewed a Trusted Enterprise AI Harness and AI Control Plane for governing agents across platforms, with broad availability expected in early 2027. What it means for SMBs / MSPs: Vendors are packaging agents as named job roles. Treat them like a new hire: define the job, the permissions and who reviews the work before you switch one on.
`claude plugin eval`. It's for anyone who has built a Claude Code skill or plugin for internal use. Run `claude plugin eval init`, describe what a good result looks like and let it propose cases. Cut the list to five real tasks and run it once. The first pass takes about 30 minutes. Keep the suite small at first, since each case runs twice and bills as real usage.
Ask your IT provider whether your print server, NAS or VPN box is reachable from the internet. AI agents exploited two PaperCut flaws at 395 organizations and reached domain admin at 12 of them. Education, retail, professional services and hospitality were hit hardest. If you run PaperCut, patch it today and take its application server off the public internet.
*For MSPs:* A one-week inventory of exposed "boring" systems, with patch status and a close-or-protect decision for each, is a clear offer for schools, retailers and professional firms.
Measuring patch urgency in weeks. In this campaign the attacker went from nothing to code execution in hours and hit targets seconds apart. A "we patch monthly" policy for internet-facing systems doesn't hold up against that pace.
Exploitation at agent speed. Mandiant's six-hour credential sweep, the PaperCut campaign and the RubyGems flood show automation compressing the time from a published flaw to mass compromise. Defenders will need agents too, for triage, exposure monitoring and automated containment. MSPs that productize that first will set the price for everyone else.
Compiled on September 27, 2026 from reporting published on or before September 11, 2026.