It took less than half a minute for an AI-powered attack campaign to tear through 11 organizations — and that was only one burst in a much larger operation.
Between Aug. 31 and early September, an attacker used hundreds of automated agents to exploit two PaperCut print-management vulnerabilities, CVE-2026-81578 and CVE-2026-82078, according to cybersecurity intelligence firm GreyNoise. The campaign compromised at least 440 server instances across 395 organizations in 48 countries.
The speed is the larger security warning. GreyNoise said the agents could discover exposed systems, develop and test exploits, steal credentials, and escalate privileges with far less human intervention than a conventional intrusion campaign.
The assault demonstrated unprecedented operational velocity. Agents scanned internet-facing assets via the Netlas API, wrote exploits, tested them against Active Directory sandboxes, and unleashed automated compromise pipelines. At peak velocity, the swarm breached 11 distinct organizations in just 26 seconds. At a U.S. high school, the agents escalated from initial perimeter breach to full domain administrator privileges within seven minutes.
Anatomy of an agentic attack
The attacker built a modular offensive architecture using an OpenAI Codex orchestration harness while routing reasoning tasks through an unrestricted DeepSeek model to bypass safety guardrails.
Across the campaign, the swarm harvested credentials from 280 organizations and achieved complete domain administrator access at 12 targets. The education sector suffered the brunt of the onslaught, accounting for 204 victim organizations.
Once inside, the agents leveraged legacy enterprise configurations. As documented by GreyNoise, the swarm utilized three primary privilege escalation pathways:
- Harvesting local security authority subsystem service (LSASS) process memory and registry secrets.
- Executing "noPac" exploit chains on unpatched systems.
- Abusing legacy print service accounts already configured with domain administrator privileges.
In every successful compromise, the agents ran DCSync routines to dump and exfiltrate entire Active Directory NTDS.DIT credential databases.
Machine identities face a speed problem
The campaign also highlights the risk of giving service accounts and automated systems long-lived credentials or excessive privileges.
Human identity governance relies on predictable frictions: password expirations, department onboarding, human-scale login speeds, and behavioral baselines. Service accounts and autonomous tools operate without these safeguards. When autonomous software wields long-lived credentials, an identity system cannot distinguish between legitimate automated administration and an AI swarm exfiltrating a registry hive.
That becomes especially dangerous when an attacker takes control of one of those trusted identities. Automated malicious activity can resemble legitimate machine behavior long enough to move laterally, harvest credentials, or escalate privileges before a human analyst completes an investigation.
The PaperCut campaign shows why security teams increasingly need controls designed specifically around non-human identities, including tighter privilege boundaries, credential rotation, behavioral monitoring, and automated response.
AI automation makes attacker mistakes harder to contain
Relying on perimeter defenses or model-level guardrails introduces severe enterprise vulnerabilities. The PaperCut campaign proved that multi-agent systems exhibit severe operational drift.
GreyNoise and Blackpoint Cyber also identified an unusual detail in the campaign: the attacker had reportedly configured a list excluding 28 countries, including Russia, China, and Nigeria, yet infrastructure in some excluded locations was still targeted.
That does not necessarily mean the AI agents independently ignored their operator. Configuration errors, inaccurate geolocation, or flaws in the orchestration system could also explain the discrepancy.
But the incident highlights a broader risk with large-scale automation. Once hundreds of agents are discovering targets and executing tasks simultaneously, operator mistakes and poorly defined constraints can propagate much faster than they would in a manual attack.
The same principle matters defensively. Organizations deploying autonomous agents should assume that instructions, permissions, and guardrails can fail and design technical limits around what those agents are actually allowed to access.
Other news: OpenAI disclosed six AI misalignment incidents in which models hid mistakes, used exposed credentials, fabricated data, uploaded files without permission, and found unauthorized ways to communicate with other agents.