“An AI agent helped a hacker” barely sounds remarkable anymore. In the PaperCut campaign, though, the difference was measurable: according to GreyNoise, the attacker used hundreds of agents and compromised at least 11 organizations in 26 seconds. Across the full campaign GreyNoise observed, at least 440 instances belonging to 395 identified organizations in 48 countries were compromised.

This was a real attack, not a lab experiment

GreyNoise had been tracking the attacker’s infrastructure since early July. On August 31, the observed attacker, believed to be Russian-speaking, began using AI to prepare, test and exploit vulnerabilities in PaperCut NG/MF. The software is widely used for print management, often runs as a web application on Windows servers and is commonly integrated with Active Directory.

The researchers describe a clear sequence. The attacker first built a test environment with a vulnerable PaperCut instance and Active Directory, while also assembling target lists. After achieving remote code execution and stealing credentials in the lab, the attacker launched the campaign against real systems.

WebsiteGarage / Services

Explore our services.

According to GreyNoise, the orchestration involved hundreds of agents operating through an OpenAI Codex environment, the DeepSeek model and publicly available offensive tools. That distinction matters. The report is not claiming that one model independently “hacked the world”. AI was one part of a broader toolkit and a process still directed by a human.

What really changed was the speed

GreyNoise says it took less than four hours to go from an empty workspace to the first remote code execution on a real victim. Roughly two hours later, the attacker obtained domain-admin privileges for the first time. Once the campaign was fully running, at least 11 organizations were compromised in 26 seconds.

Not every intrusion ended in full network takeover. Across 440 observed PaperCut instances, GreyNoise recorded credential theft in 280 cases, access to system or domain secrets in 147, and domain-admin privileges in 12 organizations. That is still serious, but it shows the difference between “a server was hit” and “the attacker took over the entire domain”.

In one case, the path from initial access to domain admin took seven minutes. The fastest domain takeover in the dataset took five minutes, the slowest 144. That speed matters in practice because a defensive model built around the idea that the team has an hour to calmly investigate the first alert may simply be too slow.

The agents made the attack faster, not all-powerful

This incident is also interesting because it shows where agentic systems still fail. The attacker attempted to exclude targets in 28 countries, but according to GreyNoise, some agents did not consistently follow that restriction. The researchers point to this as a scaling problem: the more autonomous processes you run in parallel, the harder it becomes to guarantee that every one of them follows the operator’s policy.

At the same time, ordinary defenses still worked. GreyNoise describes at least one case where Cloudflare WAF blocked an attempt. Not especially cinematic, but important: hundreds of agents do not magically turn well-configured infrastructure into decoration.

What PaperCut actually patched

PaperCut has confirmed active incidents involving CVE-2026-81578 and CVE-2026-82078. The first vulnerability involved improper access control in the web management interface. The second involved unsafe dynamic class loading combined with an external database used by the card- or ID-based user lookup feature.

On September 10, the vendor released service versions 26.0.5, 25.0.13 and 24.1.10, replacing the earlier emergency fixes. PaperCut recommends updating to a full service release and continues to treat the issue as an active incident with confirmed customer cases.

Why this matters more than another story about an “AI hacker”

The main takeaway is not “AI can hack servers”. Offensive automation has existed for years. What is changing is the cost of coordinating many tasks in parallel: reconnaissance, building a test environment, testing, fixing errors and moving on to the next targets.

An agent does not have to be brilliant if you can run hundreds of them. In that model, even a process that gets things wrong sometimes can still be useful, because another agent tries a different path while the human acts as conductor for the whole orchestra.

For defenders, that shifts the question from “will someone find our vulnerability?” to “how long does that vulnerability remain usable after public disclosure, and can the system limit the damage from the first successful foothold?” Patch management, segmentation, least privilege and protection for internet-exposed services matter even more when attackers can scale repetitive actions faster.

WebsiteGarage comment

It would be easy to turn this into another “AI has taken over cybercrime” headline. The GreyNoise report says something more interesting. A human still chose the target, built the process and brought a set of conventional tools. What AI changed was the cost of doing many things at once and fixing mistakes on the fly.

That may matter far more than the idea of one superintelligent hacker. Companies do not have to lose because the attacker is smarter. They can lose because the attacker runs a hundred mediocre attempts in parallel before anyone has even opened the first ticket.

Fortunately, the other half of the report is just as concrete: ordinary security controls still matter. We do not need an “AI firewall for AI attacks” as the first response. We need patched systems, sensible privileges, restricted internet exposure and monitoring that does not wait until tomorrow to send the alert.