What GreyNoise found
A likely Russian-speaking attacker used hundreds of AI agents to build, test and fire exploits for two flaws in PaperCut NG/MF print management software, compromising at least 440 instances at 395 organisations in 48 countries, GreyNoise reported on 9 September. The agents ran on OpenAI’s Codex harness but were powered by a DeepSeek model, not OpenAI’s own models, GreyNoise said, alongside publicly available offensive security tools.
The flaws are tracked as CVE-2026-81578 and CVE-2026-82078. GreyNoise, which watches attacker traffic through a network of sensors it controls, traced the orchestration to a single IP address on 31 August. PaperCut NG and MF are self-hosted Java web applications that by default run with SYSTEM-level privileges on Windows, The Register notes, which is what makes a print server such a useful foothold.
From empty workspace to domain admin
Speed is what sets the campaign apart. According to GreyNoise, the agents first built and attacked a lab containing vulnerable PaperCut software and an Active Directory server, while parallel workflows compiled target lists from the Netlas internet scanning service. The attacker went from an empty workspace to remote code execution against a real victim in just under four hours, and reached domain administrator two hours after that.
Once the exploit worked, it scaled. GreyNoise counted at least 11 organisations compromised in 26 seconds. Against one high school in the United States, the attacker went from initial access to full domain administrator in seven minutes.
Who was hit
Education took the worst of it, with 204 victims. By country, the United States had 98, the United Kingdom 59, France and Spain 31 each and Canada 24. GreyNoise says the attacker harvested credentials from 280 victims, obtained operating system or domain secrets from 147 and reached domain admin at 12.
The tooling after the break-in was familiar. BleepingComputer lists Mimikatz, BloodHound, Certipy, Rubeus, Impacket and NetExec among it, along with techniques such as dumping the Active Directory database and creating new Domain Admins accounts. The goal is less clear. GreyNoise says it is unclear whether the actor is focused solely on developing access; BleepingComputer notes that data theft or ransomware could follow.
Agents gone wild
The detail that will travel furthest is that the agents did not always follow orders. The attacker supplied a list of 28 countries to avoid, carried over from earlier campaigns and including Russia, China and Iran. Some agents attacked organisations in listed countries anyway: GreyNoise counted nine victims in South Africa, five in Brazil and one each in Namibia, Nigeria and Zimbabwe. It is uncertain why the agents deviated, GreyNoise wrote, calling it “a good example of Agents Gone Wild”.
An instruction given to hundreds of agents is not the same as an instruction followed by all of them, and that problem is not unique to criminals.
What stopped it
Not every attempt succeeded. In at least one case, Cloudflare’s web application firewall in front of a vulnerable PaperCut instance defeated the attacker, GreyNoise said, concluding that “fundamental hardening of environments still matters against AI-enabled threats”. PaperCut issued emergency patches on 28 August and has followed with security maintenance releases, according to The Register, which reports that the company’s chief executive said the first compromise was reported to it on 27 August. The Register adds that GreyNoise has tracked the same IP address since July in attacks on Palo Alto Networks, Ubiquiti, Citrix, SonicWall and Proxmox VE products.
What to watch
This is a different incident from the one Google’s threat intelligence group described earlier this week, in which a financially motivated actor used a multi-agent framework to harvest credentials in six hours. Together they show attackers handing whole operations, not single tasks, to agents. The immediate step is narrower: internet-facing PaperCut servers need the patches, and any exposed since late August should be checked for signs of compromise. Neither OpenAI nor DeepSeek had commented in the coverage so far.
