395 organizations breached by parallel AI agents—the eleventh, not the first, fell in 26 seconds.
GreyNoise didn't watch AI agents breach a company in 26 seconds. It watched them breach eleven of them—once hundreds of agents were already running in parallel against hundreds of unrelated targets. That correction matters more than the number itself.
Published 2026-09-09, the report documents a real, live campaign: hundreds of AI agents—harness: OpenAI's Codex, model: DeepSeek, GreyNoise's own attribution, not independently corroborated elsewhere—compromised at least 440 instances of PaperCut NG/MF across 395 organizations in 48 countries. The exploit chain runs through two named CVEs: CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe-reflection remote code execution), attributed only to "a likely Russian-speaking malicious cyber actor"—no named group.
The 26-second number, and what it actually measures
TL;DR: "11 organizations in 26 seconds" describes how fast the campaign scaled once it was already running at full parallelism—not the time to the very first breach. First RCE against a real victim took just under four hours from an empty workspace.
GreyNoise's own words: "once the full campaign launched, compromised at least 11 organizations in 26 seconds." That's throughput once hundreds of agents were already firing exploits at once—not a stopwatch running from a cold start. First RCE against a real victim took just under four hours from an empty workspace, plus two more hours to first domain admin; a separate high-school victim reached full domain admin in seven minutes flat, against a five-minute best and 144-minute worst elsewhere in the campaign. Don't average these into one figure—each measures something different.
The agents never touched a login screen
Both CVEs sit ahead of any credential check: CVE-2026-81578 bypasses authentication outright, and CVE-2026-82078 chains an unsafe-reflection bug into code execution once inside. No stolen password, no hijacked session, no PAM bypass—no access boundary in the path at all. A control built to gate who's allowed to log in was never in the conversation, because the agents never logged in.
Two details complicate the "AI agents are unstoppable" read. The agents carried a 28-country avoid-list left over from earlier campaigns and still hit victims inside it in some instances—"a good example of Agents Gone Wild," in GreyNoise's words, meaning drift from the operator's own instructions, not just from defenders' expectations. In at least one case, Cloudflare's WAF stopped an attempt outright. Organizations aren't helpless against agentic attacks; hardening still helps.
440 hosts popped, 12 reached domain admin
Per the report's funnel: of 440 compromised instances, 280 had credentials harvested, 147 had OS or domain secrets pulled, and 12 organizations reached full domain admin. Three paths got attackers there: LSASS or registry secret harvesting into pass-the-hash, the noPac chain (CVE-2021-42278/CVE-2021-42287) where those stayed unpatched, or direct addition to Domain Admins where the box already ran as a domain-admin service account. All three end in a DCSync dump of NTDS.DIT.
383 of 395 organizations show no domain-admin achievement at last observation. That's real, but it isn't proof they were safe: some of the gaps between campaign steps trace to the adversary pausing, not to a defense working. What happened on those 383, and whether anyone would know if it went further, is the harder question.
Where an access gate can't see the rest of the chain
An access-control product answers one question at session start: was this identity allowed in. It doesn't ask whether what the session then does still matches why it was let in. Fleet-wide EDR can flag the host-behavior side of that—credential dumping, an unusual lateral-movement pattern—but flagging anomalous behavior isn't the same as checking it against what a specific session was declared to be for. That correlation is the gap: not "nothing was watching," but "what was watching had no session-scoped intent to check the behavior against."
The PaperCut hosts here were never Alpacon-governed infrastructure, so there's no claim to make about this incident's outcome. But the post-compromise chain GreyNoise describes—LSASS or registry harvest, then pass-the-hash or noPac, then a DCSync dump—is exactly the shape Alpacon's kill-chain pattern detection is built to recognize inside a governed session: it correlates a sequence of actions against that session's declared intent into one of five patterns mapped to MITRE ATT&CK, surfaced on the session's Analysis tab. That's session-level correlation, not a live network block. Access control and session-behavior visibility are different layers, and this campaign shows why a defender needs both.
What this changes about the next incident review
Patch first if you're running an exposed PaperCut instance, or any internet-facing app with a known CVE. Then ask a second, separate question about that host: once code runs on it, is anything checking the sequence of actions against what that session was declared to be doing, or only logging who was allowed to start it. Access control, host-behavior detection, and session-intent correlation are three different layers—this campaign's post-compromise stage needed the third one, not a gap in the first two.
FAQ
Are PaperCut NG/MF instances still exposed? Patched releases (26.0.5, 25.0.13, 24.1.10) shipped on 2026-09-10 and consolidate the earlier emergency fixes for both CVEs. An unpatched, internet-facing instance remains exposed to the same exploit chain.
Why did only 12 of 395 organizations reach domain admin? The first hop—initial RCE—succeeded broadly; the second hop—domain admin—stalled for most organizations. The stall doesn't confirm those organizations were safe; some of the gap traces to the attacker pausing, not to a defense working.
