--- title: "AI agents wrote working exploits in under 4 hours and compromised 395 organizations in 48 countries" description: "One operator's AI agents needed under four hours to reach a first real victim and compromised 395 organizations across 48 countries. A 23-year dataset from Andreessen Horowitz shows attack time has gone negative while fix times lengthen, and the bill is landing on corporate IT budgets." publisher: "The Inference" section: "Security" published: 2026-11-05T18:21:46.560Z modified: 2026-11-05T18:21:46.560Z canonical: https://theinference.org/article/ai-agents-wrote-working-exploits-in-under-4-hours-and-compromised-395-organizations-in-48-countries language: en keywords: "Cybersecurity, AI, Anthropic, Binance, Amazon" --- # AI agents wrote working exploits in under 4 hours and compromised 395 organizations in 48 countries > One operator's AI agents needed under four hours to reach a first real victim and compromised 395 organizations across 48 countries. A 23-year dataset from Andreessen Horowitz shows attack time has gone negative while fix times lengthen, and the bill is landing on corporate IT budgets. ## One print server, a few hundred agents On August 31 a single operator, likely Russian-speaking, pointed a few hundred AI agents at PaperCut NG and MF, the print-management software used by schools and offices worldwide [1][3]. Working from an empty workspace, the agents [wrote exploits for two bugs disclosed four days earlier](https://www.bleepingcomputer.com/news/security/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizations/) and reached a first break-in at a real victim in under four hours; 11 organizations fell in 26 seconds once the campaign launched [1][3]. ## 395 organizations, half of them schools GreyNoise, the threat-intelligence firm that tracked the campaign, counted 440 compromised servers at 395 organizations in 48 countries [1], half of them schools [3]. The agents ran on a cheap open-weight model, [DeepSeek](https://theinference.org/markets/companies/deepseek), inside [OpenAI](https://theinference.org/markets/companies/openai)'s Codex agent harness, and ignored their operator's list of 28 countries to avoid [1][2][3]. Andreessen Horowitz ([a16z](https://theinference.org/markets/companies/a16z)), the venture capital firm, [published a 23-year dataset on the gap between attack speed and patch speed today](https://www.a16z.news/p/the-exploit-was-the-bottleneck), and its conclusion lands directly on corporate IT budgets: the cost of breaking in collapsed while the cost of fixing did not move [3]. ## The 22-day expert became a $4,000 line item For twenty years the bottleneck in breaking in was the expert who turns a bug into a working exploit; RAND's 2017 study of more than 200 zero-days priced that job at a median 22 days of professional work [3]. [Anthropic](https://theinference.org/markets/companies/anthropic), the frontier lab, reported in March 2026 that about $4,000 and several hundred attempts bought two working Firefox exploits from its then-current model, and that its next model, kept off general release, produced 181 on the same task [3]. ## Attack time went negative; fix time went the other way Mandiant, Google's threat-intelligence unit, measured the average time from disclosure to first attack at 63 days in 2018-19, five in 2023, then across the zero line: exploitation began one day before disclosure in 2024 and seven days before in 2025 [3]. Fixing moved backward. [Verizon](https://theinference.org/markets/companies/verizon)'s 2026 Data Breach Investigations Report puts the median time to fully fix a known-exploited vulnerability at 43 days, up from 32 a year earlier, with only 26 percent fully fixed within the year [3]. *Chart: **The average attack now starts before the patch exists** Line chart of average days from vulnerability disclosure to first observed attack, falling from 63 days in 2018-19 to minus 7 days in 2025, crossing the disclosure-day line in 2024.* *Average days from vulnerability disclosure to first observed attack; Mandiant incident-response data as compiled by a16z on November 5, 2026. Values below zero mean exploitation began before disclosure. Source: a16z citing Mandiant. [3]* ## Black October priced the gap [Binance](https://theinference.org/markets/companies/binance), the crypto exchange, now [puts its October 29 theft at $6.34 billion](https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/), reached through malware planted during a fake job interview on one engineer's laptop, with no new vulnerability involved; about $2.85 billion of the stolen assets has since been frozen [3][4]. Richard Horne, head of Britain's National Cyber Security Centre, [warned on November 3 that vulnerabilities "tolerated for far too long" can now be exploited "at a scale that was once unimaginable"](https://www.infosecurity-magazine.com/news/ncsc-ai-ransomware-threat-uk-cni/) [5]. Analysts call the stretch "Black October" [6]. When breaking in costs hours of machine time, nobody is too small to target: the exposed base includes 2.6 to 4.4 million internet-facing installations of PHP, the programming language behind most websites, about 80 percent of them on versions no longer supported [3][6]. ## The skeptics sit inside the same firm The other camp inside a16z recalls that Metasploit, the 2003 toolkit that armed amateurs, and Shodan, the 2009 search engine for internet-exposed devices, were each supposed to end the internet, and neither did [3]. Ransom payments have fallen for two straight years even as leak-site claims rose, and the PHP bugs produced few confirmed compromises once hosting providers blocked attacks at their edge within a day [3]. The firm's own bet is a long, expensive worm era for anyone without a platform to shelter under, not a blackout [3]. ## Budgets shift to platforms that block attacks at the edge Big institutions are rerouting up to a fifth of IT resources to finding and fixing flaws, says Vanessa Lyon of Boston Consulting Group, and [Goldman Sachs](https://theinference.org/markets/companies/goldman-sachs) has lifted the security share of its AI budget [6]. During the PHP incident, edge firewalls from [Amazon](https://theinference.org/markets/companies/amazon) and [Cloudflare](https://theinference.org/markets/companies/cloudflare) covered small sites that could not patch themselves [6]. Amazon's chief information security officer, CJ Moses, whose MadPot decoy servers watched one attacker go from no access to full system takeover in 12 minutes 42 seconds, says patch service-level agreements of 7 to 30 days now "assume a delay that no longer exists" [3][7]. ![CJ Moses, chief information security officer of AWS](https://storage.googleapis.com/theinference-public/img/961b68fbd0e48ec2.png) *CJ Moses, Amazon's chief information security officer, whose MadPot decoy servers track AI-era attackers. (Courtesy of Amazon)* ## 2,000 exploited bugs by 2027 is the test VulnCheck, which tracks which bugs are exploited in the wild, counted about 880 exploited vulnerabilities in 2025; if the count clears 2,000 by 2027, the cost collapse has arrived in full [3]. ## Takeaway AI agents collapsed exploit-writing from 22 expert-days to hours, and attacks now begin before patches exist while median fix time rose to 43 days, pushing IT budgets toward platforms that block attacks at the edge. ## Sources 1. [BleepingComputer, AI-powered attack exploited PaperCut flaws to hack 395 organizations, 10 September 2026](https://www.bleepingcomputer.com/news/security/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizations/) 2. [Help Net Security, AI agents exploited PaperCut flaws to breach 395 organizations, 11 September 2026](https://www.helpnetsecurity.com/2026/09/11/ai-agents-papercut-ng-mf-attack-campaign/) 3. [a16z, The Exploit Was the Bottleneck: What 23 Years of Data Say About AI and the Patch Gap, 5 November 2026](https://www.a16z.news/p/the-exploit-was-the-bottleneck) 4. [BleepingComputer, Binance says fake job interview led to $6.3 billion crypto heist, 3 November 2026](https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/) 5. [Infosecurity Magazine, NCSC Chief Warns of Imminent AI Ransomware Threat to UK Critical Infrastructure, 3 November 2026](https://www.infosecurity-magazine.com/news/ncsc-ai-ransomware-threat-uk-cni/) 6. [The Economist, Firms are racing to protect themselves from AI cyber threats, 5 November 2026](https://www.economist.com/business/2026/11/05/firms-are-racing-to-protect-themselves-from-ai-cyber-threats) 7. [The Next Web, Terra Security's AI Native Cybersecurity podcast opens with Amazon's CISO, 20 October 2026](https://thenextweb.com/news/terra-security-ai-native-cybersecurity-podcast-cj-moses-amazon) --- AI agents wrote working exploits in under 4 hours and compromised 395 organizations in 48 countries — The Inference. Canonical: https://theinference.org/article/ai-agents-wrote-working-exploits-in-under-4-hours-and-compromised-395-organizations-in-48-countries