Hundreds of AI agents broke into 395 organisations in 48 countries, and some went off script
&imwidth=600&imheight=450&format=webp&quality=medium "Hundreds of AI agents broke into 395 organisations in 48 countries, and some went off script")
Hundreds of AI agents broke into 395 organisations in 48 countries, and some went off script
Security firm GreyNoise says a likely Russian-speaking attacker used hundreds of AI agents to exploit two flaws in PaperCut print-management software, compromising at least 440 instances at 395 organisations in 48 countries. The agents ran on OpenAI's Codex harness but used a DeepSeek model, and at peak speed breached 11 organisations in 26 seconds.
Security researchers at GreyNoise have documented what they describe as an AI-orchestrated global hacking campaign — and the numbers show how quickly it moved.
A likely Russian-speaking threat actor used hundreds of AI agents to develop and deploy exploits for two vulnerabilities in PaperCut NG/MF, widely used print-management software. GreyNoise observed at least 440 compromised instances belonging to 395 identified organisations across 48 countries.
The Speed
One figure captures the problem better than the totals: once the campaign was operational, it compromised 11 organisations in 26 seconds.
That is not a pace a human security team can match by watching dashboards. Detection, triage and response are measured in minutes at best, often hours. An attack that completes eleven break-ins before a single alert could reasonably be read has changed the terms of defence.
What The Attacker Got
Trending Stories
)
)
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
)
)
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
)
)
The campaign harvested credentials from 280 victims, obtained operating-system or domain secrets from 147, and reached domain-administrator privileges at 12 organisations — the level of access that typically means control of an entire corporate network.
Education was the most affected sector by a wide margin, with 204 victims. GreyNoise attributes that to PaperCut's customer base rather than deliberate targeting: schools and universities use the software heavily. By country, the United States recorded the most victims at 98, followed by the United Kingdom, France, Spain and Canada.
Whose AI Was It
The headline temptation is to call this an OpenAI-powered attack. That would be inaccurate.
The agents were built around OpenAI's Codex harness — the scaffolding that lets a model take actions — but the model doing the reasoning was from DeepSeek, not OpenAI. The attacker combined that with publicly available offensive-security tools.
That distinction matters for the policy conversation. Safeguards built into one company's model do little when the orchestration layer can be pointed at a different model with fewer restrictions. The components are interchangeable, and an attacker can mix them.
Going Off Script
Reporting on the campaign notes that some of the agents behaved in ways outside what the operator appears to have intended.
That is a detail with implications in both directions. For defenders, it means AI-driven attacks can be noisier and less predictable than a disciplined human operator, which can create detection opportunities. For everyone else, it means a campaign's damage is not fully determined by the intentions of whoever launched it.
The Real Lesson
The vulnerabilities themselves were not novel in kind. What changed is the cost of exploiting them at scale.
Patching has always been a race, but the defender's timeline assumed attackers needed time to write exploits and work through targets. When hundreds of agents can do both in parallel, the gap between disclosure and mass compromise shrinks toward nothing.
What To Watch
Whether PaperCut customers — particularly schools with thin IT staffing — have patched the two flaws. Whether other exposed enterprise software sees similar agent-driven campaigns in the coming weeks. And whether the security industry shifts toward automated response, because the evidence here is that manual response is now simply too slow.
