A threat actor used hundreds of autonomous AI agents to build, test and launch a global hacking campaign against print-management software, compromising at least 440 servers across 395 organizations in 48 countries, according to research published this month by the threat-intelligence firm GreyNoise. Security researchers are describing it as one of the largest documented cases of an attacker letting AI agents run an intrusion campaign with minimal human direction.
The campaign targeted two vulnerabilities in PaperCut NG/MF, widely used print-management software: an authentication-bypass flaw and a separate flaw enabling remote code execution through unsafe reflection, tracked as CVE-2026-81578 and CVE-2026-82078. GreyNoise, which monitors internet-wide scanning traffic, said the operator paired OpenAI's Codex coding-agent framework with a DeepSeek model and the Netlas internet-scanning platform to find, exploit and pivot through vulnerable servers largely without human intervention.
Hours, Not Weeks
The speed of the campaign is what alarmed researchers most. According to GreyNoise's writeup, the adversary went from an empty workspace to achieving remote code execution against a real victim in under four hours, and reached domain-administrator access at a second organization roughly two hours after that. Once the operation was fully automated, the agents compromised at least 11 organizations in a single 26-second window; the fastest single intrusion, against a U.S. high school, went from initial access to full domain administrator control in seven minutes.
"LLMs are enabling adversaries to move at greater speed and scale," GreyNoise wrote, while cautioning that the outcome was not uniformly catastrophic. Of the 440 compromised instances, attackers harvested credentials from 280 victims and obtained operating-system or domain secrets from 147, but reached full domain-administrator privileges at only 12 organizations. "Fundamental hardening of environments still matters against AI-enabled threats," the firm added, noting that a targeted organization's web application firewall stopped the attacker outright in at least one case.
Education Hit Hardest
Nearly half of the compromised instances, 204 of 440, belonged to schools and universities, a sector that has historically lagged on patching internet-facing infrastructure. The remainder were spread across government, healthcare and corporate networks in the United States, the United Kingdom, France, Spain and Canada, according to reporting from Bleeping Computer, which reviewed the same research. Researchers noted the campaign appeared to deliberately avoid targets in Russia, China, Iran and several former Soviet states, a pattern often used to infer an attacker's likely origin, though GreyNoise stopped short of formal attribution beyond describing the operator as likely Russian-speaking.
The use of Codex as an agent "harness" paired with a third-party model is notable to security researchers because it suggests the attacker deliberately routed sensitive exploitation reasoning through a model with fewer safety restrictions than OpenAI's own systems, while still relying on Codex's agentic tooling to execute multi-step tasks such as writing exploit code, scanning for targets and escalating privileges autonomously.
What Comes Next
PaperCut has released patches addressing both vulnerabilities, and administrators running on-premises PaperCut NG/MF deployments are being urged to update immediately and audit logs for signs of compromise dating back to the campaign's apparent launch in late August. GreyNoise said it is continuing to track the infrastructure involved and has shared indicators of compromise with affected organizations and industry partners.
The incident is likely to intensify an already active debate in Washington and Silicon Valley over whether AI coding agents need tighter guardrails against misuse. It follows warnings earlier this month from Anthropic, OpenAI and other AI developers about the pace of frontier AI development, and researchers say it is one of the clearest real-world demonstrations yet that agentic AI tools can compress attack timelines that once took skilled human hacking teams days or weeks into a matter of hours.
