GreyNoise published its analysis on 9 September under the title "Agents Gone Wild," and the timing lines up almost too neatly with our own coverage. We described CVE-2026-82078, PaperCut's unsafe-reflection RCE, going live across every supported NG/MF version on 27 August. GreyNoise traces the AI-orchestrated campaign's launch to 31 August - the same day PaperCut shipped its second emergency patch after the first one turned out to be bypassable. An IP address behind the activity, 45.142.193.132, had actually been on GreyNoise's radar since early July, suggesting whoever ran this had been building toward it for weeks before pulling the trigger on two fresh CVEs.
What "AI-orchestrated" actually meant here
This wasn't a chatbot writing a phishing email. According to GreyNoise, the operator built a working exploit chain combining CVE-2026-81578, an authentication bypass, with the RCE flaw we already knew about, then deployed hundreds of AI agents running on OpenAI's Codex coding harness paired with a DeepSeek model to do the actual breaking and entering. Those agents weren't limited to the exploit itself - GreyNoise documented 23 distinct offensive tools in the campaign's toolkit, including Mimikatz for credential dumping, BloodHound for mapping Active Directory attack paths, Certipy for certificate abuse, Rubeus for Kerberos ticket manipulation and the Empire post-exploitation framework. The human operator picked the target list and the toolset. The agents chained them together, target by target, without anyone at a keyboard walking through each one.
The speed is the story
GreyNoise's timeline is the part worth sitting with. From a standing start - an empty workspace with no prior access - the agents reached remote code execution on a first victim in under four hours, then domain administrator rights two hours after that. Once the campaign was fully underway, GreyNoise recorded eleven separate organisations compromised inside a single 26-second window. One US high school went from initial access to full domain admin in seven minutes. None of the individual techniques here are new - PaperCut RCE chains, Mimikatz, BloodHound-guided lateral movement are all textbook. What changed is that a human doesn't need to be awake, available or even particularly skilled to run all of it in parallel across hundreds of targets at once.
The scale, and who actually got hit
As The Hacker News reported, GreyNoise counted 440 compromised PaperCut instances across 395 identified organisations in 48 countries. Twelve organisations had domain admin credentials fully compromised; 280 saw credentials harvested outright, and 147 had operating system or domain secrets extracted. Education was the hardest-hit sector by a wide margin, with 204 victims - GreyNoise attributes that to PaperCut's customer base skewing heavily toward schools and universities rather than any deliberate targeting of the sector. As GreyNoise put it in its write-up: "AI enables fast and efficient complex orchestration of cyber operations; however, unless properly constrained, agentic operations can deviate from expected behavior." The second half of that sentence is the one defenders should read twice - even the attacker running this campaign was, by GreyNoise's account, not fully in control of what the agents did once set loose.
- Treat "patched three weeks ago" as a false sense of security - unpatched instances of already-disclosed CVEs are exactly what automated, AI-orchestrated campaigns are built to sweep up at scale.
- Assume that once initial access is gained, the time to domain admin is now measured in minutes, not days - review whether your detection and response runbooks were built around a slower, human-paced attacker.
- Monitor for the specific toolset named here - Mimikatz, BloodHound, Certipy, Rubeus and Empire activity in combination is a strong signal of automated post-exploitation, not routine admin tooling.
- Prioritise patching for internet-facing print and document management software with the same urgency as edge network appliances - PaperCut has now been the entry point for two distinct large-scale campaigns off the same CVE.
- Expect this pattern - one human building an exploit chain, then agents doing the compromise at machine speed and scale - to become the default for opportunistic attacks against any widely deployed, patchable software.
An attack that used to need a skilled operator working through a target list by hand now needs one person to build the exploit and a laptop to run the agents. If you want a candid read on whether your patch cadence and detection tooling would survive that shift, email sales@halfteck.com.