Domain admin in five minutes, and no one was ever asked whether it should happen.

Security researchers at GreyNoise Intelligence identified a campaign in the final days of August 2026 in which hundreds of coordinated AI agents scanned the internet for vulnerable PaperCut NG and PaperCut MF print management servers and began breaking into them without a human operator directing each individual intrusion. GreyNoise published its full findings on 9 September, by which point the swarm had reached 440 PaperCut instances across 395 organisations in 48 countries.

The agents exploited two flaws in PaperCut's software: an authentication bypass tracked as CVE-2026-81578, and an unsafe reflection bug tracked as CVE-2026-82078 that allowed arbitrary code execution. In GreyNoise's own lab testing against a real target, the agents went from an empty workspace to remote code execution in under four hours, then to full Active Directory domain admin two hours after that. Deployed against real victims, the swarm moved faster still. At the campaign's peak, eleven separate organisations were compromised in twenty-six seconds, and the fastest single intrusion, against a US high school, went from first access to domain admin in seven minutes.

The operator behind the swarm is believed, on language evidence, to be Russian-speaking. It built the campaign on OpenAI's Codex harness running a DeepSeek model, used a memory tool called Hindsight to retain context across hundreds of simultaneous targets, and coordinated the agents to run in parallel before handing them a standard offensive toolkit, including Mimikatz, BloodHound, Rubeus and Impacket, to harvest credentials and map paths to privileged accounts once inside. The operator had attempted to instruct the swarm to avoid targets in 28 countries. GreyNoise found that restraint failed in some instances regardless, a detail the researchers flagged as its own kind of warning: even the attacker did not fully control what its own agents ultimately did.

Across the campaign, the agents harvested credentials from 280 compromised instances and recovered operating system or domain secrets from 147. Twelve organisations, seven of them schools, saw the agents escalate all the way to domain admin, arriving anywhere from five to 144 minutes after first access. Education accounted for 204 of the 395 identified victims, the largest single sector, reflecting how widely PaperCut is deployed in institutions that rarely have security staff watching around the clock. No ransom note or extortion demand has surfaced publicly, and what the operator intended to do with domain admin access at twelve organisations remains unknown.

The defences that failed here were not weak by conventional standards. Patching, network monitoring and layered access controls are the baseline any of the 395 affected organisations would point to as evidence of a functioning security programme, and most of them likely had some version of all three. None of it was built to catch a swarm of autonomous agents completing an entire kill chain, from first packet to domain admin, in minutes rather than the days or weeks a human red team would need. The vulnerability sat in one product. The gap sat in every environment that let a privileged login complete without asking whether a person had actually approved it.

That question is what GoFirm puts back in the loop. A domain admin escalation, a new privileged account, or any action that reaches into the systems an organisation depends on is an execution event. Before it completes, GoFirm sends a real-time confirmation request to the named authority responsible for that system, on their own registered device, over a channel the attacker's infrastructure never touches. At any of the twelve organisations where this swarm reached domain admin, that request would have gone out the moment the escalation was attempted, and the action would have stayed blocked until a real person answered it with their own biometrics.

An autonomous agent moving at machine speed, however well resourced or fast, cannot produce that confirmation on a device it does not possess. The execution boundary holds regardless of whether the request behind it came from a patient human impersonator or a swarm of AI agents acting without one.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.

References

1. GreyNoise Intelligence. 2026. Agents gone wild: an AI-orchestrated global campaign against PaperCut NG/MF. GreyNoise, 9 September 2026.
2. Lemos, R. 2026. PaperCut AI swarm attack heralds changes for cyber kill chain. Dark Reading, 11 September 2026.
3. Abdullahi, A. 2026. AI agents help hackers compromise 440 PaperCut servers. TechRepublic, 11 September 2026.