AI Agent Swarm Hacks 440 Servers via PaperCut

One operator, hundreds of AI agents, 48 countries hit in two weeks. On September 9, 2026, GreyNoise published its analysis of an attack campaign against PaperCut NG/MF, a print management tool deployed in thousands of organizations. At least 440 instances compromised across 395 organizations: the vulnerability isn't new — what's new is the collapsed cost of coordination.

What GreyNoise observed

The campaign targets PaperCut NG/MF through two known vulnerabilities, CVE-2026-81578 and CVE-2026-82078. According to GreyNoise, the actor — likely Russian-speaking — ran a swarm of agents built on OpenAI Codex and DeepSeek to exploit those flaws at scale. The toll after two weeks:

• at least 440 compromised instances across 395 organizations in 48 countries;
• 280 systems lost their credentials;
• 147 systems exposed their Windows and Active Directory secrets;
• education was the hardest-hit sector.

A pentester's playbook, orchestrated by agents

The sequence mirrors a professional pentest engagement. The attackers first built a private lab with a vulnerable copy of the software to rehearse every step. They then exploited the two flaws methodically before industrializing the process at scale through the agents.

The post-exploitation toolkit is standard fare: Certipy, Rubeus, Impacket — the open-source staples of Active Directory attacks. Nothing exotic on the technical side. The innovation sits elsewhere.

The coordination cost collapsed

A campaign of this scope used to require a structured team and weeks of preparation. Today, an API budget and a single operator are enough to orchestrate the whole thing: agents run reconnaissance, exploitation and collection while a human supervises.

One positive note: lateral movement stayed largely contained. Only about a dozen victims reportedly progressed all the way to domain control, according to initial analysis.

What this changes for defenders

The lesson is not in the CVEs — both flaws were known and patchable. It's in the speed. When an agent swarm can sweep 48 countries in two weeks over a single print-management vulnerability, the patching window becomes the critical variable. The same old principles apply, with far less slack: inventory exposed services, patch without delay, and segment to limit lateral movement toward Active Directory.

The open question is symmetrical: if offense industrializes with agent swarms, defense will have to automate its response too, from patching to containment.