Security researchers at GreyNoise have documented what looks like one of the first large-scale cyberattacks run almost entirely by autonomous AI agents. Starting 31 August, a Russian-speaking threat actor pointed hundreds of AI agents — built on OpenAI's Codex and a DeepSeek model, coordinated through purpose-built orchestration tooling — at two flaws in PaperCut NG/MF, the print-management software widely used by schools, offices, and print shops. The agents didn't just automate a known exploit; they researched, wrote, tested, and iteratively debugged their own attack code against real targets pulled from an automated internet scan, with no human doing that work by hand.
The results were fast by any prior standard for this kind of campaign. GreyNoise, which had already been tracking the attacker's infrastructure since July, recorded the quickest breach reaching full domain-administrator access on a US school network in around seven minutes from first contact, and at one point the system compromised eleven separate organisations within twenty-six seconds of each other. By the time researchers finished mapping the campaign, it had reached 440 PaperCut instances across 395 organisations in 48 countries, roughly half of them in education, with the US, UK, France, Spain, and Canada hit hardest. The attacker deliberately avoided targets in Russia, China, Iran, and several other countries — a pattern consistent with Russian-speaking cybercrime operations. PaperCut has released security updates addressing both flaws, tracked as CVE-2026-81578 and CVE-2026-82078.
What this means for your business
The specific software matters less than the pattern behind it: an attacker can now point a fleet of AI agents at a known flaw and have a working, refined exploit chain running against real targets within hours of deciding to try, without a human writing or debugging any of the exploit code. That shrinks the safety margin that "patch within a week or two" advice used to rely on. If you run PaperCut NG/MF, apply the vendor's security updates now rather than waiting for a scheduled maintenance window — and treat any other internet-facing print, file, or document server the same way going forward, since this technique isn't tied to one vendor. Beyond that one patch, it's worth checking whether your team's normal patch cadence for internet-facing software is still fast enough, and whether a web application firewall or network segmentation covers anything you can't patch immediately; GreyNoise noted at least one target stopped the attacker cold with a properly configured WAF, even before a patch was applied.