When Trust Becomes an Attack Surface

An exposed print server can become an entry point.
An AI agent can amplify the impact of a simple instruction.
A critical supplier can turn continuity into a contractual obligation.

1. PaperCut: a secondary system can open the main door

PaperCut confirmed active exploitation targeting NG/MF servers and published Emergency Patch Release 3. The update addresses a vulnerability that can allow unauthorized access and remote code execution.

The central issue is not only the vulnerability. Print servers often have broad access, integration with directories, and privileged connections to other systems. An apparently secondary asset can therefore become an operational pivot.

What this means in practice

For smaller companies: confirm who administers PaperCut and whether its web interface is publicly accessible.
For IT: restrict access to trusted addresses, apply Release 3 to primary and secondary servers, and review logs for suspicious activity.
For the ISMS: record the decision, update evidence, existing exposure, and the criterion used to assess possible impact.

Leadership question: which other administrative systems are considered “secondary” but have enough access to affect critical operations?

2. AI agents: risk begins with the combination of instruction and permission

Mindgard researchers demonstrated data exfiltration from Amazon Kiro through prompt injection and crafted instructions that reached the agent’s tools and environment.

These tests do not mean that every AI tool will escape a virtual machine. They do show, however, that isolation alone is not a sufficient control when the agent can access secrets, files, networks, or execution tools.

How to reduce the blast radius

Treat repositories, documents, emails, and pages read by the agent as untrusted input.
Use ephemeral environments, least privilege, and temporary credentials per task.
Control network egress and require human approval for sensitive actions.
Log tools called, files accessed, changes made, and blocked attempts.

ISMS takeaway: the agent should be inventoried as an operational identity. Its access, responsibilities, dependencies, and revocation process must be defined.

3. Critical suppliers: continuity is becoming a demonstrable obligation

The proposed UK Cyber Security and Resilience framework provides for the designation of critical suppliers, with statutory requirements for risk management, incident reporting, and resilience testing.

The market signal is significant: cloud providers, MSPs, SaaS platforms, and other suppliers capable of affecting multiple services are moving from a procurement concern to an ISMS and continuity concern.

What to review before the contract is tested by an incident

Criticality: which suppliers could interrupt essential processes or affect several customers at the same time?
Dependencies: which fourth parties, regions, platforms, and update channels support the service?
Response: are there clear deadlines for notification, incident cooperation, and recovery?
Evidence: does the company receive periodic tests, reports, metrics, or proof of continuity and security?

The common thread

Trust needs limits, evidence, and the ability to be revoked. PaperCut shows the risk of a trusted system and a delayed patch. AI agents show the risk of excessive permissions. Critical suppliers show the risk of depending on a relationship without sufficient evidence.

A well-implemented ISMS connects these three scenarios: it identifies assets and trust relationships, assigns owners, limits access, tests dependencies, and preserves evidence for decisions.

Five checks for this week

Confirm whether PaperCut NG/MF exists in the environment and record its version, exposure, and update status.
Inventory AI agents with access to code, email, documents, networks, or credentials.
Review which agent actions require human approval and which run automatically.
Identify suppliers whose failure would interrupt critical processes or affect multiple customers.
Define which security and continuity evidence must be requested periodically from those suppliers.