For two years the pitch on agents has been productivity. Today's stories are the other half of that sentence: the same autonomy that lets an agent close your tickets lets one open your network — and the tooling your own developers point at your codebase turns out to leak. Autonomy is a capability, and capabilities cut both ways.
An agent swarm breached 395 organizations while you slept
This is the one to read twice. GreyNoise researchers say a Russian-speaking threat actor used hundreds of AI agents built on OpenAI's Codex and a DeepSeek model to exploit CVE-2026-81578 and CVE-2026-82078, compromising at least 440 PaperCut NG/MF instances at 395 organizations across 48 countries. The tempo is the story: the campaign began August 31, reached its first remote code execution in under four hours and first domain admin two hours after that — and at peak the automated agents compromised 11 organizations in 26 seconds, with education the hardest-hit sector at 204 victims.
The operator's take: your incident-response plan is almost certainly written for human attacker speed — reconnaissance over days, lateral movement over hours. An adversary that pops eleven orgs in under half a minute has already changed the unit of time you're defending in. You cannot out-click this; the only answers that survive are the ones that were automated before the attack started: patch SLAs measured in hours for internet-facing gear, blast-radius limits that don't depend on a human noticing, and detections that fire on behavior rather than on someone reading a log. The uncomfortable part is that this wasn't a nation-state's custom cyber-weapon — it was off-the-shelf agents pointed at two known CVEs. The barrier to running a campaign like this just dropped to a credit card.
The coding agents on your team's laptops are leaking
The defensive side of the same coin. Stealth startup Accomplish — founded by Or Hiltch, Amit Avner and Guy Zipori — disclosed leaky sandbox vulnerabilities across Claude Code, OpenAI Codex and Cursor after quietly flagging them to the vendors this summer. Notably, Anthropic's fix reportedly took 50 days, which tells you the patch cadence on this new class of tooling isn't keeping pace with how fast it's being adopted.
The operator's take: a coding agent runs with your developer's credentials, your repo access, and often a shell — so a leaky sandbox isn't a productivity bug, it's a privilege-escalation path sitting inside your build pipeline. Most shops rolled these tools out bottom-up, by individual engineers, with zero review of what they can reach. Treat the agent like any other identity with production access: inventory who's running what, scope its permissions, and put its network egress behind the same controls you'd demand of a new SaaS vendor. If you can't answer "what can this thing touch," you've already lost the argument.
Microsoft's Patch Tuesday is a wall of work
Meanwhile the fundamentals pile up. Microsoft's September Patch Tuesday fixed more than 970 vulnerabilities — including two zero-days already under active exploitation, one of the largest single months on record. Independent coverage put the count at 973 CVEs with two zero-days, and either way it's a triage problem, not a checklist.
The operator's take: nobody patches 970 things at once, so this is a prioritization exercise — the two exploited zero-days and anything internet-facing go first, the rest gets scheduled. But pair this month's backlog with the story at the top of this post and the math gets grim: attackers are now automating exploitation of known bugs faster than most teams can even inventory them. The gap between "patch is available" and "patch is applied" has always been where breaches live. In 2026 that gap is being scanned by machines.
Also on my radar
- Nvidia eyes Perplexity. Reports suggest Nvidia may buy into Perplexity at a valuation above $30B ahead of Wednesday's earnings — when your chief chip supplier starts taking equity in your app-layer competitors, the "neutral arms dealer" framing gets harder to sustain.
- Patch Chrome now. Google shipped a Chrome update for an actively exploited V8 zero-day — browser zero-days are the quiet front door to endpoints, so this one belongs on the same short list as the exploited bugs above.
The throughline for a Saturday: agents crossed from demo to deployment on both sides of the wire this week. One crew used them to breach 395 companies at a speed no SOC can match by hand; the vendors building the agents your own engineers rely on are still shipping — and slowly patching — leaky sandboxes; and underneath it all sits a 970-CVE backlog that assumes human-paced attackers who no longer exist. Automate your defense or get automated against. That's the Signal for today.
Paul Sapio is the CIO of Mikhail Education and a full-stack AI engineer. Open to contract work in security, networking, AI, and SaaS development — reach out.