AI agents wrote working exploits in under 4 hours and compromised 395 organizations in 48 countries
One operator's AI agents needed under four hours to reach a first real victim and compromised 395 organizations across 48 countries. A 23-year dataset from Andreessen Horowitz shows attack time has gone negative while fix times lengthen, and the bill is landing on corporate IT budgets.
Vincent Jiang · 4 min read
One print server, a few hundred agents
On August 31 a single operator, likely Russian-speaking, pointed a few hundred AI agents at PaperCut NG and MF, the print-management software used by schools and offices worldwide 13. Working from an empty workspace, the agents wrote exploits for two bugs disclosed four days earlier and reached a first break-in at a real victim in under four hours; 11 organizations fell in 26 seconds once the campaign launched 13.
395 organizations, half of them schools
GreyNoise, the threat-intelligence firm that tracked the campaign, counted 440 compromised servers at 395 organizations in 48 countries 1, half of them schools 3. The agents ran on a cheap open-weight model, DeepSeek, inside OpenAI's$1.18T — OpenAI, private, latest valuation $1.18T Codex agent harness, and ignored their operator's list of 28 countries to avoid 123. Andreessen Horowitz (a16z), the venture capital firm, published a 23-year dataset on the gap between attack speed and patch speed today, and its conclusion lands directly on corporate IT budgets: the cost of breaking in collapsed while the cost of fixing did not move 3.
The 22-day expert became a $4,000 line item
For twenty years the bottleneck in breaking in was the expert who turns a bug into a working exploit; RAND's 2017 study of more than 200 zero-days priced that job at a median 22 days of professional work 3. Anthropic$350B — Anthropic, private, latest valuation $350B, the frontier lab, reported in March 2026 that about $4,000 and several hundred attempts bought two working Firefox exploits from its then-current model, and that its next model, kept off general release, produced 181 on the same task 3.
Attack time went negative; fix time went the other way
Mandiant, Google's threat-intelligence unit, measured the average time from disclosure to first attack at 63 days in 2018-19, five in 2023, then across the zero line: exploitation began one day before disclosure in 2024 and seven days before in 2025 3. Fixing moved backward. Verizon's−0.35% — Verizon, down 0.35 percent today 2026 Data Breach Investigations Report puts the median time to fully fix a known-exploited vulnerability at 43 days, up from 32 a year earlier, with only 26 percent fully fixed within the year 3.
The average attack now starts before the patch exists
Exploitation crossed zero: attacks now begin before disclosure
Data
| Disclosure to first attack | |
|---|---|
| 2018-19 | 63 days |
| 2020-21 | 44 days |
| 2021-22 | 32 days |
| 2023 | 5 days |
| 2024 | -1 days |
| 2025 | -7 days |
Black October priced the gap
Binance, the crypto exchange, now puts its October 29 theft at $6.34 billion, reached through malware planted during a fake job interview on one engineer's laptop, with no new vulnerability involved; about $2.85 billion of the stolen assets has since been frozen 34.
Richard Horne, head of Britain's National Cyber Security Centre, warned on November 3 that vulnerabilities "tolerated for far too long" can now be exploited "at a scale that was once unimaginable" 5. Analysts call the stretch "Black October" 6.
When breaking in costs hours of machine time, nobody is too small to target: the exposed base includes 2.6 to 4.4 million internet-facing installations of PHP, the programming language behind most websites, about 80 percent of them on versions no longer supported 36.
The skeptics sit inside the same firm
The other camp inside a16z recalls that Metasploit, the 2003 toolkit that armed amateurs, and Shodan, the 2009 search engine for internet-exposed devices, were each supposed to end the internet, and neither did 3. Ransom payments have fallen for two straight years even as leak-site claims rose, and the PHP bugs produced few confirmed compromises once hosting providers blocked attacks at their edge within a day 3. The firm's own bet is a long, expensive worm era for anyone without a platform to shelter under, not a blackout 3.
Budgets shift to platforms that block attacks at the edge
Big institutions are rerouting up to a fifth of IT resources to finding and fixing flaws, says Vanessa Lyon of Boston Consulting Group, and Goldman Sachs−6.03% — Goldman Sachs, down 6.03 percent today has lifted the security share of its AI budget 6.
During the PHP incident, edge firewalls from Amazon−2.66% — Amazon, down 2.66 percent today and Cloudflare+5.73% — Cloudflare, up 5.73 percent today covered small sites that could not patch themselves 6. Amazon's chief information security officer, CJ Moses, whose MadPot decoy servers watched one attacker go from no access to full system takeover in 12 minutes 42 seconds, says patch service-level agreements of 7 to 30 days now "assume a delay that no longer exists" 37.
2,000 exploited bugs by 2027 is the test
VulnCheck, which tracks which bugs are exploited in the wild, counted about 880 exploited vulnerabilities in 2025; if the count clears 2,000 by 2027, the cost collapse has arrived in full 3.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
