PaperCut attacker used hundreds of AI agents to breach 440+ instances

LangChain built three internal agents — GTM Agent, OpenSWE for engineering, and Content Studio for marketing — all living in Slack, acting on behalf of users, with global and user-scoped memory. A large share of runs are scheduled rather than explicitly invoked.

Palo Alto Networks Unit 42 said one attacker hit a European government entity and within two hours of exploitation had password hashes and MFA secrets, plus an NTLM-relay tunnel into Active Directory. Command batches wrapped in delimiters like ==SHELLUSER== produced machine-parseable output for an AI model to read.

On 200 biopsy-proven MILK10k lesions, a fine-tuned Inception v3 named the correct diagnosis 62% of the time versus 42% for both frontier LLMs. The dermatologist author says both models called a melanoma a harmless seborrhoeic keratosis and recommended discharge.

Pull request #31028 by am17an in ggml-org/llama.cpp merges Qwen tensors during GGUF conversion, prompting LocalLLaMA users to ask whether existing GGUFs need reconverting.