AI Agents Hacked 395 Organizations in Hours: Inside the PaperCut Attack

Introduction: The First True AI-Driven Breach at Scale

Threat intelligence firm GreyNoise this week published details of a campaign that should end any lingering debate about whether AI agents can run real cyberattacks: a single, likely Russian-speaking attacker used hundreds of autonomous AI agents to compromise at least 440 PaperCut servers across 395 organizations in 48 countries.

The target was PaperCut NG and MF — self-hosted print management software that quietly runs inside schools, hospitals, governments, and enterprises everywhere. The attacker chained two vulnerabilities, tracked as CVE-2026-81578 (an authentication bypass) and CVE-2026-82078 (remote code execution), and then delegated the actual breach work to an AI agent swarm that operated largely on its own.

This wasn't AI writing a phishing email or generating malware snippets with human hands on the keyboard. This was agentic AI doing the attacking — orchestration, targeting, exploitation, and post-compromise escalation, at machine speed.

What Happened: Four Hours to Remote Code Execution

The timeline from GreyNoise's report is the most alarming part. The attacker went from an empty workspace to remote code execution against a real victim in under four hours — and reached domain administrator rights roughly two hours after that.

Before unleashing the agents, the attacker did careful preparation. They built a private lab environment containing a vulnerable copy of PaperCut NG/MF and an Active Directory server, then developed and tested exploits against it until the chain worked reliably. In parallel, they used the internet scanning service Netlas.io — with an identified API key — to assemble lists of exposed PaperCut installations worldwide.

Then the agents took over. According to GreyNoise, the swarm used OpenAI's Codex as a harness, a DeepSeek model, and publicly available offensive security tools to attack internet-facing PaperCut deployments in parallel. The agents compromised at least 440 PaperCut systems, harvested credentials, and attempted to move deeper into victim networks.

Once inside, the attacker had three routes to administrator-level access: stealing privileged credentials, exploiting older Windows vulnerabilities, or simply taking advantage of PaperCut servers that were already running with overly powerful privileges. At the 12 organizations where domain admin was reached, the attacker extracted credentials from the entire Windows domain.

Two details stand out. First, the attacker maintained a list of 28 countries to avoid — mostly former Soviet states plus Brazil, Turkey, Nigeria, and South Africa — a geopolitical tell that complements the Russian-language evidence. Second, Cloudflare's web application firewall blocked at least one attack against a system the attacker believed was vulnerable, proof that baseline defenses still blunt this class of campaign.

How the AI Agent Swarm Worked

The architecture matters more than the actor. GreyNoise described a layered stack that will sound familiar to anyone building legitimate AI automations — which is exactly the problem:

• An agent harness: OpenAI's Codex — the same coding-agent product developers use to ship features — served as the orchestration layer, a tool you can explore in our OpenAI Codex overview.
• A reasoning model: a DeepSeek model handled the decision-making and adaptation as the campaign ran.
• Off-the-shelf tooling: publicly available offensive security tools were plugged into the agents as capabilities, the same way a legitimate agent calls an API or a code linter.
• Parallel execution: hundreds of agents ran simultaneously, each probing, exploiting, and escalating against different targets without human intervention.

The structure mirrors what autonomous agent frameworks like AgentGPT and AutoGPT popularized: a goal, a loop, tools, and permission to act. The PaperCut campaign shows that pattern pointed at your perimeter.

GreyNoise also flagged a subtler risk: once left running on their own, AI-orchestrated operations can drift from what the attacker intended. "AI enables fast and efficient complex orchestration of cyber operations," the researchers wrote — but that autonomy cuts both ways. An agent swarm that escalates further, persists longer, or hits targets outside the plan is no longer a precision instrument. It's a hazard to everyone, including its operator.

Why This Matters for Every Organization

The economics of attacking flipped. The expensive part of traditional intrusion was skilled labor — reconnaissance, exploit development, careful post-exploitation. When agents compress four hours of work into a hands-off workflow, one modest actor gets the reach of a well-funded crew. Expect attack volume to rise and the "too small to target" excuse to expire.

Unpatched software is now an AI-visible liability. The two PaperCut flaws were the entire foothold. Internet-scannable, self-hosted services with known CVEs are precisely what agent swarms enumerate and exploit best. Print servers, VPN appliances, file managers — anything forgotten at the edge is on the menu.

Agent tools are dual-use by default. The harness in this attack is a mainstream developer product. Organizations deploying AI agents (and those securing against them) need to accept that the same tooling, models, and MCP-style tool integrations power both sides. Monitoring how agents use credentials, shells, and network access is now a security requirement, not a nice-to-have.

Autonomy is a risk multiplier. An agent that can drift from its operator's intent means campaigns may be sloppier, noisier, and less predictable — which also means detection opportunities, but also collateral damage no one chose.

How to Defend Against AI-Driven Attacks

The good news: everything that stopped or slowed this campaign was mundane. The playbook for the agent era is largely the old playbook, executed faster and more consistently:

• Patch internet-facing services on a schedule of days, not quarters. Both PaperCut CVEs were patchable. The victims were simply slower than the agents.
• Inventory your edge. If you don't know you run PaperCut — or any self-hosted service — you can't defend it. Continuous external attack-surface mapping beats an annual spreadsheet.
• Put a WAF in front of anything self-hosted. Cloudflare's firewall demonstrably blocked part of this campaign.
• Kill excessive service privileges. One of the three escalation paths was PaperCut servers already running with powerful rights. Services should get the minimum they need.
• Guard credentials like keys to the kingdom — because they are. Credential harvesting was the post-exploitation playbook; tiered admin accounts and phishing-resistant MFA blunt it.
• Scan your own code and dependencies with AI before attackers do. Tools like Semgrep bring AI-speed static analysis to your pipelines, closing the window between "vulnerable" and "patched."

For security teams, the strategic move is fighting fire with fire: AI-driven detection and response platforms now match agent-speed attacks. We cover the defensive AI landscape — from autonomous SOC tooling to code security scanners — in our roundup of AI cybersecurity tools in 2026.

Frequently Asked Questions