AI agent swarm attacked software at 395 organizations
In late August 2026, a likely Russian-speaking attacker used hundreds of AI agents, according to security firm GreyNoise, to automatically scan the internet for vulnerable installations of the PaperCut print management software.
According to GreyNoise, at least 440 PaperCut installations across 395 organizations in 48 countries were affected. The agents exploited two known vulnerabilities and then tried to break into the victims' Windows Active Directory systems.
GreyNoise highlighted the speed of the attack: within just under four hours, the agents achieved their first successful code execution against a real victim, and two hours later gained their first full control over a company network. Once the campaign was fully underway, the firm said at least eleven organizations were compromised within just 26 seconds.
GreyNoise said the attackers appeared to try to exclude certain countries from the attack, but this restraint did not consistently work - some affected organizations were outside the regions meant to be spared.
Technology company Google also warned on September 8, according to its own statement, that the most advanced attackers are increasingly building autonomous AI systems into every stage of their attacks. Kelli Vanderlee of the Google Threat Intelligence Group said this currently gives state-sponsored groups a head start, but freely available AI models are making these capabilities increasingly accessible to other attackers too.
It remains unclear, according to the reports, how autonomous the AI agents actually were and how much humans intervened behind the scenes. The exact identity of the attackers has also not been conclusively confirmed.
WHY IT MATTERS
This case shows that AI systems can make cyberattacks significantly faster and larger in scale, leaving companies less time to react.
WHAT YOU CAN DO NOW
- Use a different password for each service Do not reuse the same password across accounts. That way, only one account is affected if a company gets hacked.
- Turn on two-factor login Enable two-factor authentication for important accounts like email or banking. Then a stolen password alone is not enough to get in.
- Take breach notifications seriously If a company tells you about a security incident, change the affected password right away. Follow the steps the provider recommends.
- Keep devices and apps updated Install available updates promptly, since attackers often exploit known weaknesses automatically and very quickly.