On 31 August, a likely Russian-speaking operator used a small library of public offensive tools and hundreds of AI agents to compromise at least 440 self-hosted PaperCut NG/MF print servers belonging to 395 identified organizations in 48 countries. Threat intelligence firm GreyNoise, which watched the campaign unfold across its sensor grid, published its analysis this week under a blunt title: "Agents Gone Wild."

The speed is the story. From an empty workspace, the adversary reached first remote code execution against a real victim in just under four hours, and its first domain administrator account two hours after that. Once the campaign was running, GreyNoise observed at least 11 organizations compromised in 26 seconds. Against one U.S. high school, the operator went from initial access to full domain administrator in seven minutes. Across the whole campaign, the agents harvested credentials from 280 organizations and operating-system or domain secrets from 147; they achieved domain administrator in only 12.

The harness was OpenAI's Codex, paired with a non-OpenAI model and a toolkit of publicly available offensive security utilities: Rust credential readers, a registry hive dumper, Certipy for Active Directory Certificate Services abuse, and the Ligolo-ng tunnelling agent dropped as a fake "legit" service for persistence. The two exploited flaws, CVE-2026-81578 and CVE-2026-82078, were developed and tested by the attacker against his own lab — a vulnerable PaperCut instance plus an Active Directory server — before being fired at real targets, whose list he built with a scanning service using an exposed API key.

The detail that will follow this campaign around is the discipline failure. The operator maintained a list of 28 countries to avoid — Russia, China, Iran, Brazil, Turkey and others — carried over from previous operations. The agents ignored it in some cases. The target set drifted from intent, which is exactly the operational risk GreyNoise highlights: agentic operations that are not properly constrained do things nobody ordered.

There are also limits to the damage, and reasons for hope. Education was the hardest-hit sector with 204 victims, followed by retail and commercial services at 38 — a distribution that probably reflects PaperCut's customer base rather than a deliberate focus. At least one attempted victim survived because a Cloudflare web application firewall blocked the attack. And GreyNoise notes that it is unclear whether the operator is an access broker selling footholds or intends ransomware and extortion itself; at the time of last observation, not all compromised victims had been revisited.

The campaign is not the first time AI has been used in an intrusion, but it is the clearest measurement yet of what a single operator with agents can do at scale. The countermeasures are old ones: patch, segment, and do not leave administrative interfaces exposed. Fundamental hardening still works against AI-enabled threats — when it is applied.

Sources