GreyNoise: AI agents hit 11+ orgs in 26 seconds (PaperCut)
GreyNoise reported on September 9, 2026 an AI-orchestrated campaign against self-hosted PaperCut NG/MF: after achieving remote code execution and credential harvesting in a lab, the actor used hundreds of AI agents on OpenAI’s Codex harness and a DeepSeek model (not OpenAI models) plus public offensive tools, compromising at least 440 PaperCut instances across 395 identified organizations in 48 countries. The firm says the empty workspace to first real-victim RCE took under four hours; once the full campaign launched, at least 11 organizations were hit in 26 seconds, and domain admin was observed at only 12 organizations. This is GreyNoise’s PaperCut write-up (THN Sep 10 coverage), high-level only—not Unit 42’s intrusion summary, not GTIG’s six-hour credential harvest, and not Anthropic’s cyber alignment assessment.