Eleven organizations fell in 26 seconds.
The speed came from the cheap half of the attack.
On 31 August 2026, hundreds of AI agents were pointed at PaperCut NG and MF, the print management software that runs quietly in schools, libraries, and offices. GreyNoise, which observes adversary infrastructure directly, watched an operator running OpenAI's Codex harness alongside a DeepSeek model build and test exploits for two new flaws, pull target lists from an internet scanning service, and work through exposed servers with no human at the keyboard.
The campaign reached 440 PaperCut instances across 395 organizations in 48 countries, and it harvested credentials at 280 of them. It was opportunistic rather than targeted, so the victims were found, not chosen.
Only 12 of those 440 reached full domain administrator access.
That gap is the story.
Photo: S099001, CC BY 4.0, via Wikimedia Commons.
AI did not lower the height of your walls. It removed the cost of knocking on every door at once.
What still worked
The entry points were ordinary as well. The two new flaws, CVE-2026-81578 and CVE-2026-82078, were patched in PaperCut's urgent advisory on 27 August.
Everything after that was long standing Windows tradecraft. The operator lifted password hashes out of memory and reused them against a domain controller, fell back on the noPac flaws from 2021 in environments that never finished patching, and walked away with a full copy of the domain credential database either way.
- Shrink what the internet can reach. The agents did not pick their victims by hand, they pulled a list of exposed PaperCut servers from a scanning service. In at least one recorded case, a web application firewall in front of the appliance defeated the attempt outright. Inventory what is genuinely reachable from outside, then make yourself justify every item on that list. The network security skill check is a fast way to test how sharp your instincts are here.
- Break the path from appliance to domain. PaperCut NG and MF run with SYSTEM level privileges by default and are usually joined to Active Directory, which is exactly why they are convenient and exactly why they are dangerous. Keep the service off your domain controllers and run it under a dedicated low privilege account. If you want to pressure test how you reason about who can authenticate as what, work through the authentication and authorization skills track.
- Patch on the vendor's clock, not the calendar's. The operator went from an empty workspace to remote code execution at a real victim in just under four hours, and reached domain administrator two hours after that. At one United States high school, initial access to full domain administrator took seven minutes. A quarterly cycle is not a slow response to that timeline, it is a decision. The 60 minute containment playbook is worth rehearsing before you need it.
Photo: Baron Maddock, CC BY 4.0, via Wikimedia Commons.
Nearly half the victims were in education, which GreyNoise attributes to the customer base rather than to deliberate targeting. That is a polite way of saying schools run the most exposed print servers and have the fewest people watching them.
The incident also says something about the attackers. The operator handed the agents a list of countries to avoid, and the agents largely ignored it. The security rules for AI agents are still being written, and this is what it looks like when an instruction is not backed by an enforced permission.
The new arithmetic
Attackers were once limited by how many doors they could knock on in a day. That limit was economics, not skill.
It is gone, and when breadth is free, every basic control you have been meaning to fix becomes more valuable, not less.
If you had to justify tomorrow why a system is reachable from the internet, which one would you struggle to defend?