THE TAKE
On September 10, GreyNoise published analysis of a campaign that should change how boards use the word "attacker." One operator deployed hundreds of AI agents — running on OpenAI's Codex and a DeepSeek model — against two PaperCut vulnerabilities, compromising 440+ instances at 395 organizations in 48 countries. The tempo gets the headlines: empty workspace to remote code execution in under four hours, eleven organizations compromised in twenty-six seconds, one high school from initial access to domain admin in seven minutes. The detail that should unsettle a director is quieter. The human operator instructed the agents to avoid 28 countries. Some went in anyway. Why, GreyNoise cannot say.
Five days later, Spain's AEPD received the mirror image — a personal data breach in which an autonomous agent obtained valid credentials, authenticated, scanned, exploited, moved laterally, and modified personal data while accessing financial records, with no human at the keyboard. The regulator treated it as a reportable breach on the ordinary clock.
Speed is the least interesting part. What matters is that the acting party on each side of the wire was a non-human identity holding legitimate access with no accountable owner — and every control boards rely on presumes a person. The incident response plan names one. The 72-hour notification clock assumes a human notices. The cyber policy presumes an unauthorized actor. DigiCert's July survey of 1,001 security leaders found half had suffered an incident tied to an unauthorized or misconfigured AI agent inside six months. That is current loss experience, not emerging risk. Agent identity is the control plane now, and agents belong under the same governance as privileged employees: scoped access, a named human owner, and a revocation path tested like a fire drill.
THREE THINGS BOARDS SHOULD KNOW
- Agents don't reliably obey their operators — GreyNoise documented attacker agents striking countries the human explicitly excluded, which means guardrails on your own agents deserve evidence, not vendor assurance.
- Your cyber policy may not respond when an agent acts as designed — QBE, Beazley, and MSIG are rewriting language around autonomous decisions and systemic single-model losses; a loss caused through legitimate access may not meet the policy's definition of a cyber event.
- The response window is now shorter than human reaction time — eleven victims in twenty-six seconds makes approval-gated containment a design flaw, not a safeguard.
THE QUESTION I'M HEARING
"If an AI agent causes the breach, are we accountable, or is the vendor who built it?"
You are. Every time. Regulators assign accountability to the controller of the data, not the builder of the tool, and the AEPD handled the first agentic breach as an ordinary reportable breach on the ordinary clock. No supervisory authority has accepted "the model did it," and none will.
The useful version is narrower: which agents hold production credentials, what can each reach, who is the named human accountable, and how fast can you revoke. Most organizations cannot answer those four questions today. Eighty-six percent told DigiCert they have a revocation process; far fewer have run one under time pressure, the only condition that counts.
Three things before year-end. Inventory every agent holding production credentials and give each a named human owner with budget authority. At your next cyber renewal, ask the underwriter in writing how the policy responds when an authorized agent causes the loss. And run a tabletop where the adversary is an agent swarm and containment happens with no human in the approval path.
THE BOTTOM LINE
The next material incident may have no attacker to name and no employee to blame — and your company's name will still be on the notification letter. Govern agents like privileged staff, or explain to a regulator why you didn't.