Your First Trade Playbook is expiring

On August 31, a single operator armed with commercial AI tools did something security researchers had modeled in theory but never observed at scale. The campaign began on August 31, combining OpenAI’s Codex and DeepSeek models with commodity offensive tools. The goal was to exploit two freshly patched vulnerabilities in PaperCut print management software. The result was carnage delivered at machine speed.

“The adversary went from an empty workspace to first achieving remote code execution against a real victim in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds,” GreyNoise analysts reported. In one case, a U.S. high school went from initial access to domain admin in five minutes.

The final count: at least 440 PaperCut instances linked to 395 distinct organizations across 48 countries. GreyNoise counted 280 victims where credentials were harvested and 147 where operating system or domain secrets were pulled.

What makes this event structurally different from prior exploitation waves is the tooling. What sets this apart from a routine post-disclosure exploitation wave is the tooling. Rather than manually scanning the internet for exposed servers and running exploits one at a time, the attacker handed that work to a coordinated group of AI agents. The attacker, believed to be Russian-speaking, first built a private lab environment with a vulnerable copy of PaperCut NG/MF and an Active Directory server to develop and test exploits for the two vulnerabilities. The agents then scaled that work globally without meaningful human involvement at each step.

For investors, the investment question is not whether AI-assisted attacks will happen again. They will, and faster. The question is which security businesses are structurally positioned to win in an environment where a capable threat actor no longer needs a specialist team to build and deploy a working exploit.

Three businesses deserve close attention. CrowdStrike’s response to this precise problem arrived two days after the campaign began. On September 1, CrowdStrike introduced Falcon Guardian, a new AI Detection and Response solution delivering complete visibility and runtime enforcement from the endpoint, where AI agents execute across the enterprise. The product operates at the runtime level where agents are actually executing tasks, rather than only at the interface where instructions are issued. Prompt-layer protection catches problematic inputs before they reach an agent; runtime security watches what the agent actually does with its instructions, including cases where a prompt appeared legitimate but the resulting behavior is anomalous. The PaperCut campaign, where some agents attacked organizations inside the operator’s exclusion list in behavior that deviated from intent, illustrates exactly why runtime enforcement matters more than policy governance alone.

CrowdStrike’s structural advantage here is real. Deployed across hundreds of millions of devices, CrowdStrike has more endpoint real estate than any competitor. Visibility at that scale is not easily replicated, and it becomes more valuable as the attack surface shifts from network perimeter to every endpoint running an AI agent.

Palo Alto Networks occupies a different but complementary position. In the third quarter of fiscal 2026, management said AI is increasing network traffic, creating more machine and AI-agent identities, and allowing attackers to find vulnerabilities and launch attacks faster. Next-generation firewall bookings grew nearly 40% year over year, while software firewall annual recurring revenues also increased 25% year over year as customers expanded capacity to inspect traffic between cloud and AI workloads. PANW trades at a meaningful premium, though back-to-back acquisitions have brought high integration-related costs that compress near-term margins.

Zscaler’s zero-trust architecture addresses the same threat from a different angle. The company ended the third quarter of fiscal 2026 with more than 700 Zero Trust Everywhere enterprises, up from over 550 in the previous quarter. As more customers adopt multiple products across the platform, Zero Trust Everywhere could help Zscaler increase customer spending and win larger deals. At a forward sales multiple of 5.92 times, significantly below Palo Alto Networks’ 19.79 times, Zscaler offers a more compressed valuation for investors willing to accept slower near-term momentum.

The PaperCut campaign is not a headline to file and forget. It is a documented proof point that the economics of cyberattack have permanently changed. When a single operator can go from an empty workspace to 395 breached organizations in days, demand for runtime enforcement, zero-trust architecture, and AI-native detection is not cyclical. It is structural. The businesses that own those capabilities at scale are worth studying carefully.