Every writeup of this week’s PaperCut campaign put OpenAI’s Codex in the headline, and every one of them skipped the sentence that actually matters. GreyNoise’s own report says the attacker ran hundreds of agents on the Codex harness with a DeepSeek model behind it, explicitly not OpenAI models, and that single distinction is the story of the whole week: the harness is the product now, and the model is a slot you fill with whatever is cheap.<\/p>\n\n\n\n
Once you see it, the rest of the day lines up behind it. Salesforce shipped seven agents and its loudest proof point belongs to a company it had owned for one day. Cohere is raising at triple last year’s valuation on deployment, not on a frontier model. Harvey took $550 million and titled its own announcement around owning the intelligence rather than renting it. Five stories, one argument, and I run enough of this stack to tell you which parts of it I am changing this week.<\/p>\n\n\n\n
Breaks your stack.<\/strong> A Russian-speaking operator chained two PaperCut NG\/MF bugs, CVE-2026-81578 for authentication bypass and CVE-2026-82078 for unsafe reflection RCE, and let agents do the rest. GreyNoise counted<\/a> 440 compromised instances across 395 organizations in 48 countries, with education taking 204 of the victims because that is who buys PaperCut, not because anyone targeted schools. The speed is the part people quote: 11 organizations compromised in 26 seconds once the campaign was live, and a run from empty workspace to working RCE against a real victim in just under four hours.<\/p>\n\n\n\n Here is what almost nobody reported. Of those 440 compromised instances, exactly 12 reached domain admin. Credentials were harvested at 280, operating system or domain secrets at 147, and then the campaign mostly stalled. The agents were devastating at the wide, shallow, repetitive part and ordinary at the part that requires judgment, which is the same performance curve every one of us has watched in production.<\/p>\n\n\n\n So the operator read for me is not “AI hacked 395 companies.” It is that the scarce ingredient in offensive tooling just became free. The Codex harness handles sessions, retries and orchestration, a DeepSeek model does the token generation at Chinese pricing, and the attacker supplies public offensive tools and a target list. Help Net Security’s writeup<\/a> frames it as an AI attack. I would frame it as a commoditization event. When OpenAI put that same harness behind a public API this week, which I covered in Wednesday’s roundup<\/a>, it did not create this capability. It priced it.<\/p>\n\n\n\n Patch PaperCut today if you run it. Then go look at what your own agents are allowed to reach, because the next section is about the walls you assumed were holding.<\/p>\n\n\n\n Breaks your stack.<\/strong> Researchers at Accomplish, including chief executive Amit Avner and chief technology officer Or Hiltch, spent the summer reporting sandbox escapes in the coding agents most of us use daily. Upstarts Media published the timeline<\/a> on Thursday, and the timeline is the finding. Cursor fixed its issue in roughly a week after a July report. OpenAI addressed both of the issues sent to it during August and said on the record that it is tightening controls on where agents can write files. Anthropic took about 50 days, shipping something like 30 software updates in the window without fixing it, and did not respond on the record. Neither did Cursor.<\/p>\n\n\n\n If these frontier models are so good, how come they’re not finding these critical vulnerabilities in their own products?<\/p><\/blockquote>\n\n\n\n That is Hiltch, and it is the right question asked in the wrong direction. The models are not the problem. The disclosure process is: no CVEs get issued for any of this, fixes ship silently inside routine version bumps, and there is no advisory feed an operator can subscribe to. I run Claude Code as the center of my content engine and I could not have told you which of those 30 updates closed a sandbox escape, because nobody told me one was open.<\/p>\n\n\n\n I am going to say the uncomfortable thing plainly, because I like the product and that is exactly why it needs saying. Fifty days is not defensible when two competitors cleared comparable reports in one week and one month. Anthropic publishes more thoughtful safety research than anyone in the industry, and a vendor that markets containment as a differentiator does not get to treat its own containment bugs as a low priority backlog item. Ship the fix fast or publish an advisory, ideally both.<\/p>\n\n\n\n Marketing, with a real acquisition underneath it.<\/strong> Four days before Dreamforce opens, Salesforce announced seven named agents<\/a>: Casey for help, Paige for IT and HR service, Carter for shoppers, Marshall for supply chain, Piper for inbound pipeline, Fin for customers, and Hunter for outbound sales, which stays in pilot until November. The headline number is 7 billion Agentic Work Units delivered across Agentforce and Slack, 3.2 billion of them in Q2.<\/p>\n\n\n\n An Agentic Work Unit is a unit Salesforce invented, defined by Salesforce, counted by Salesforce, and reported without a denominator. It is not a task completed, a ticket closed or a dollar saved. Treat it as a telemetry counter with a marketing name and move on.<\/p>\n\n\n\n Now the part worth your attention. The strongest customer result in the release is Anthropic, where 79% of the conversations Fin sees are resolved autonomously. Fin is the company formerly known as Intercom, and Salesforce closed that acquisition on September 10<\/a>, one day before the launch, picking up more than 30,000 customers and a support-specific model suite Salesforce did not build. So the flagship proof point for Agentforce was earned by another company’s product running another company’s model, before Salesforce owned it for a full day.<\/p>\n\n\n\n That is not a scandal, it is a strategy, and it is the through line again: Salesforce did not need a better model, it needed distribution and a working harness, so it bought both. If you are evaluating Agentforce, evaluate Fin on its own record and ignore the AWU figure entirely.<\/p>\n\n\n\n Matters.<\/strong> The Globe and Mail reported Thursday that Cohere is in advanced talks to raise between $2 billion and $3 billion<\/a> at a $20 billion valuation, with financing from the Canadian government alongside existing backers. Note the tense, because a lot of coverage got it wrong: this is advanced talks, not a closed round, and the terms can still move. Cohere was valued at $7 billion a year ago.<\/p>\n\n\n\n Nearly tripling in twelve months while never seriously contending for the frontier crown tells you what enterprise buyers are paying for, and it is not benchmark position. It is deployment on your own infrastructure, under your own jurisdiction, with a vendor your regulator can reach. Sovereign AI stopped being a slogan the moment a national government started writing cheques into the cap table.<\/p>\n\n\n\n Matters.<\/strong> Harvey closed $550 million at a $15.5 billion valuation on September 9, co-led by Diffusion and Lightspeed, less than six months after raising $200 million at $11 billion. It is past $400 million in annual recurring revenue with more than 3,000 customers, including 80% of the top 100 law firms and half the Fortune 10. The company titled the announcement around helping legal teams own their intelligence<\/a>, which is a polite way of saying stop renting.<\/p>\n\n\n\nYour Coding Agent’s Sandbox Leaks, and Anthropic Sat on It for 50 Days<\/h2>\n\n\n\n
Salesforce Shipped Seven Agents, and the Best One Is a Company It Bought on Wednesday<\/h2>\n\n\n\n
Cohere Is Raising at $20 Billion, and the Money Is Partly Ottawa’s<\/h2>\n\n\n\n
Harvey Named the Whole Trend in Its Own Headline<\/h2>\n\n\n\n