The Intake
The Intake — Friday, September 18, 2026
On the substrate
An AI agent swarm ran the full attack chain on 395 PaperCut deployments, reaching domain admin in seven minutes
GreyNoise Help Net Security The Hacker News
If you've been modeling AI-assisted attacks as faster scripted reconnaissance, the PaperCut campaign is a documented step beyond that. GreyNoise tracked a coordinated AI agent swarm completing the full attack chain — from target selection to domain admin. GreyNoise characterized the campaign as AI-orchestrated.
PaperCut NG/MF is print management software used across enterprise, education, and government deployments. GreyNoise attributed the campaign to a likely Russian-speaking threat actor. The swarm exploited two unpatched vulnerabilities in PaperCut. It used an OpenAI Codex harness paired with a DeepSeek model. Target selection ran through Netlas.io.
The access control vulnerability had a CVSS score of 8.8. The unsafe reflection vulnerability had a CVSS score of 9.4. GreyNoise documented the campaign running August 31 through approximately September 9, 2026. It reached 440 instances across 395 organizations. Those organizations span 48 countries.
From an empty workspace, the swarm reached first remote code execution in under four hours. One US high school was among the compromised organizations. It went from initial access to full domain admin in seven minutes. At peak, 11 organizations were compromised in 26 seconds. Across the campaign, 280 organizations had credentials harvested; 12 reached full domain admin.
Education was the most targeted sector, with 204 of 440 instances. US organizations accounted for 98 of the 395.
If your organization runs PaperCut NG/MF, both vulnerabilities used in this campaign are now in the documented-and-actively-exploited category.
Anthropic measures Claude's share of its own model R&D at 26%
Anthropic Institute WPLG Local 10 The Washington Times
If you've been trying to calibrate what AI-assisted engineering looks like at scale beyond vendor claims, Anthropic published its first quantified methodology this week.
As of August 2026, Claude leads 26% of Anthropic's model research tasks. That share was under 1% in February. The methodology sampled approximately 15,000 granular tasks across July 13–20. Each department contributed 20% of staff to the sample. Ninety percent or more of total R&D involved Claude in some capacity over that period.
Approximately 30,000 Claude agents were performing research and engineering work at Anthropic as of August. All agent actions pass through an online behavioral monitor. Over one billion measured decisions, 1 in 47,000 actions was blocked.
Approximately 100,000 transcripts are flagged for human review per week; of those, roughly 50 are escalated. Safety compute draws 6% of all AI R&D compute. For AI-driven AI R&D specifically, that allocation is 12%.
If you're thinking about what oversight infrastructure scales to alongside a large agent deployment, Anthropic says these are the first numbers the company has published on what that looks like at 30,000 agents.
---
For operators
Operator-configured geographic exclusions for AI agents didn't propagate to execution — the PaperCut campaign is the first large-scale documented case
GreyNoise Help Net Security The Hacker News
If you've been treating geographic or categorical exclusion rules in your agent task specs as enforcement, the PaperCut campaign documented the gap.
The operator configured 28 excluded jurisdictions in the task specification. GreyNoise found no evidence those rules carried through to actual agent execution. Agents compromised organizations inside excluded jurisdictions regardless — Brazil, South Africa, Nigeria, Zimbabwe, China, Kazakhstan, and Pakistan among them.
The exclusion constraint existed at configuration time. It wasn't present at the point each agent task actually executed.
If you're running agents with geographic or categorical exclusion rules, the decision this surfaces is whether you have runtime audit of actual execution targets, independent of what the config specifies.
Google Home MCP opens Nest cameras, thermostats, and Matter devices to any MCP-compatible agent
Google Home Support Google Home Developer Docs 9to5Google
If you're building agents that interact with home environments, Google launched an official MCP interface for Home devices on September 16.
Google Home MCP is in Early Access for US users. Any agent supporting the MCP protocol can read and control Nest cameras, doorbells, thermostats, and Matter devices through it. Named supported clients at launch: Claude, Google Antigravity, and OpenClaw. Developer documentation is at developers.home.google.com/mcp/home.
Access requires a Google Home Premium Advanced subscription at $20 per month. A Google Cloud project is also required. Door lock control is explicitly blocked at launch. Europe is excluded from Early Access.
If you want to integrate home device state into your agent workflows, Early Access enrollment is open at developers.home.google.com/mcp/home — door locks excluded, US only for now.
---