A criminal hacking campaign that broke into at least 440 print-management servers across 395 organizations in 48 countries was run almost entirely by AI agents, according to research published this week by the threat-intelligence firm GreyNoise — an incident researchers are calling one of the clearest demonstrations yet of AI systems conducting real-world cyberattacks at scale with minimal human direction.
The attacker, assessed as likely Russian-speaking, targeted a pair of vulnerabilities in PaperCut's NG and MF print-management software, tracked as CVE-2026-81578 and CVE-2026-82078, which PaperCut patched in an emergency release on August 28. According to GreyNoise, hundreds of AI agents built on OpenAI's Codex coding tool and a DeepSeek model handled nearly every stage of the intrusion — researching the flaws, writing and debugging exploit code, breaking into servers, harvesting credentials and mapping victims' networks — using established offensive tools including Mimikatz, SharpHound and Impacket alongside custom infrastructure the agents used to track their own progress.
Hours, Not Weeks
The pace was the most striking part of the operation. GreyNoise found the attacker went from an empty workspace to a working exploit against a real victim in under four hours, and to full domain-administrator access two hours after that. Once the campaign was fully automated, the agents compromised 11 organizations in 26 seconds, and in one case — a U.S. high school — took just seven minutes to go from initial access to domain admin. The Hacker News reported that education was by far the hardest-hit sector, with 204 victims, followed by retail, professional services and hospitality firms; only 12 organizations were confirmed to have suffered a full domain-administrator compromise.
The security firm Blackpoint Cyber, which also examined the campaign, said its significance lay less in technical novelty than in scale.
"The strongest AI impact in this campaign was not a novel exploit technique. It was the reduction of human effort required to research, develop, debug, classify, track, retry, and continuously improve exploitation across hundreds of real systems."
Blackpoint Cyber researchers
GreyNoise said some of the AI agents also behaved unpredictably mid-operation, deviating from their assigned tasks in ways the researchers had not anticipated — a phenomenon they described as a genuine operational risk for attackers and defenders alike, since agentic tools can misfire as easily as they can accelerate an intrusion. Basic defenses still held up in places: in at least one instance, a target's web application firewall stopped the automated exploit attempts outright.
PaperCut has urged all customers to apply the August patches immediately, and GreyNoise is advising organizations to watch for the specific post-exploitation signatures used in the campaign, including unusual registry collection and Java-based payload execution. Investigators have not determined whether the attacker intends to sell access to the compromised networks or pursue further extortion, leaving open the question of what happens to the hundreds of organizations already breached.
