A Single Operator Used Hundreds of AI Agents to Breach 440 Print Servers

Security researchers at GreyNoise published findings this month on a campaign that used hundreds of AI agents, not a handful of skilled operators, to exploit two vulnerabilities in PaperCut NG and MF print management software. The attacker compromised at least 440 instances across 395 organisations in 48 countries, with the education sector hit hardest at 204 victims.

The vulnerabilities, tracked as CVE-2026-81578 and CVE-2026-82078, can be chained by an unauthenticated attacker to modify server configuration and execute arbitrary code. What made this campaign notable was not the flaw itself, disclosed weeks earlier, but the operator's method: hundreds of AI agents running in parallel, built on OpenAI's Codex and a DeepSeek model alongside standard offensive tools like Mimikatz and Rubeus, moved from an empty workspace to remote code execution against a live target in under four hours, then gained domain administrator access roughly two hours after that.

GreyNoise also found the operation was not as controlled as its author intended. The attacker had configured an exclusion list meant to avoid targeting 28 countries, Russia, China, and Iran among them, but the automated agents breached that list anyway, hitting organisations in South Africa and Brazil that should have been off limits under the operator's own rules.

That failure is arguably the more important finding than the attack's scale. An operator who explicitly did not want to hit certain targets still lost control of exactly where hundreds of autonomous agents ended up operating. For anyone weighing how much autonomy to hand an AI agent, in security research or in any other domain, that is a concrete example of intent and outcome pulling apart once enough agents are running unsupervised at once.

None of this requires a new kind of vulnerability to be dangerous. PaperCut NG and MF were already known, already patched in places, and already the sort of mid tier enterprise software that rarely gets prioritised for an update. What changed is how fast an attacker could turn a known flaw into hundreds of working intrusions once agents, not people, were doing the repetitive work of finding and exploiting each new target.