PaperCut breach: What AI agent attacks teach us about Identity Security resilience

On September 9, 2026, GreyNoise and Blackpoint Cyber published parallel investigations into a single attacker who used AI to break into hundreds of organizations at once. 

It started with a print management server (in this case, https://www.papercut.com/), the kind of unremarkable internal system that schools, hospitals, and law firms use without a second thought. The attacker was after credentials, and they took them from 280 organizations. In twelve, they pulled the entire directory: every password in the organization, in one file. The fastest of those took five minutes. 

There is an asymmetry here worth naming. We are racing to adopt AI without understanding what it will do once it’s inside, while leaving identity—a critical control point—largely as it’s always been. This inertia gives our adversaries time to turn the same AI innovations against us. Call it adaptation anxiety: confidence on the adoption side, hesitation on the defense side, and a gap between them that widens every month. This attack is what that gap costs. 

It is one of the largest single-operator credential harvesting operations on record, and one of the most instructive because of how little effort it required. 

The speed of AI attacks leaves no time for human defenders to respond

In security, our whole response discipline assumes an interval in which an analyst has time to correlate an alert, form a hypothesis, check a second source, and finally escalate. But with PaperCut, it was four hours from empty workspace to live victim, and five minutes from foothold to full directory. The human is not slow—the human is absent from the timeline altogether. 

Attack scalability removes the need to choose. Security programs run triage on the premise that the attacker also has finite attention and will come for the crown jewels rather than a print server in a regional school. 395 organizations in parallel dissolves that premise. When compute is the only constraint for the attacker, nobody is too small or too far down the list. 

And they compound. Fast alone is survivable in one place. Wide alone is survivable slowly. Fast and wide together means the one organization that notices cannot warn the other 394 in time.

Technical details: PaperCut cyberattack

Entry: Two chained PaperCut NG/MF flaws: an authentication bypass (CVE-2026-81578) and a remote code execution flaw (CVE-2026-82078). PaperCut is self-hosted print management software; on Windows it runs as SYSTEM and is typically domain-joined and AD-integrated, which is what made it valuable. 

Tooling: Hundreds of AI agents on an OpenAI Codex harness driving a DeepSeek model, wrapped around public offensive tools (Mimikatz, SharpHound, Certipy, Rubeus, Impacket), with Hindsight for persistent agent memory and AionUi for orchestration. 

Impact: 440 servers, 395 organizations, 48 countries, 204 of them in education. Credentials harvested from 280 organizations, OS or domain secrets from 147, full domain admin in 12, each with a complete NTDS.DIT dump (the Active Directory database holding every user and computer password hash in the domain). 

Attribution: GreyNoise assess a likely Russian-speaking actor, inferred from a hardcoded 28-country exclusion list led by Russia, Belarus and the CIS states. Several agents ignored it and hit excluded countries anyway. “Agents Gone Wild,” as GreyNoise titled the report.

None of this surprises us. For the past year, we at Silverfort have been running offensive AI models against test environments in our own labs: frontier AI models with their safety controls removed or bypassed, non-American models, open-source and open-weight ones. Every one proves the same four things: 

1. An appetite for tokens, keys, identities and service accounts, which they reach for first. 
2. Speed that beats detection, roughly one second to access against three minutes to alert.
3. Simultaneity that overwhelms a security team. 
4. Adaptivity that turns an intrusion into a war of attrition, where the defenders tire and the model does not. 

The PaperCut attack campaign statistics say the same thing: under four hours from empty workspace to remote code execution against a live victim, two more hours to the first domain admin, 26 seconds to compromise; 11 organizations once it launched, and seven minutes from initial access to domain admin at a U.S. high school. Fastest overall: 5 minutes, slowest: 144. Read that as a distribution, not a headline. There is no point inside it where a human response loop arrives in time. 

Expect this pipeline to be reused. The CVEs were incidental; the machinery around them is the asset, and it will be pointed at the next edge-facing flaw within hours of disclosure. 

What this teaches security teams: identity matters

Stealth stopped being a requirement for attackers: Classic tradecraft optimized for dwell time: stay quiet, avoid the tripwire, and be patient. This operator was loud and disposable, dropping tunnels and creating an account literally named Administrator-17. By the time a typical organization notices, triages and escalates, the directory is already gone. Noise is only a liability if someone can act on it faster than you can finish. 

Brute force became a wave, not a knock: Credential attacks used to be sequential and throttled, slow enough for lockout policy to matter. At machine-speed and scale, it’s the inverse. Hundreds of agents spray a few likely passwords across thousands of accounts at once, staying under the per-account threshold while covering the directory in seconds, treating each failure as feedback for the next wave. No single account looks unusual. The pattern exists only in aggregate, and nothing in a conventional IAM stack is watching the aggregate in real time. 

Identity was 100% of the focus: GreyNoise documented three paths to domain admin:  

1. Harvest LSASS and registry secrets then pass-the-hash to the DC;  
2. Exploit an unpatched noPac, or 
3. Find PaperCut running as a domain-admin service account and simply add your account to Domain Admins. 

The last path to domain admin did not require an exploit, just a misconfiguration nobody revisited. The CVE was a delivery mechanism for reaching credentials; everything after it was credential theft, credential reuse, or privilege assignment. Identity moves at the pace of a login, looks legitimate to every tool you own, and behaves the same against legacy AD and a modern IdP. It is also the one thing all three paths must cross, which makes it the only control point that stops all three.

6 questions for CISOs and IAM leaders to answer after the PaperCut breach

1. Do you know what to expect if an AI-driven adversary targets you, and what holds versus what breaks? Walk the timeline above against your own estate and name the control that engages at each step. Whatever you cannot name is what breaks. 
2. What is your dwell time, and can you still afford a human response? Measure to an enforced outcome, not to an alert. If it is minutes, the human loop is decoration. 
3. What happens when a password spray campaign starts and one account falls? Thousands of failures under the lockout threshold, then one success. Does anything change automatically for that account and the ones around it, or does the SOC just get a ticket? 
4. What percentage of your authentications can you actually enforce on? Not licensed for MFA. Deniable. Count service accounts, Kerberos and NTLM, legacy apps, command-line, machine-to-machine. The remainder is the attacker’s path. 
5. How many standing privileged accounts do you have, and how many are non-human? The metric is accounts holding privilege they are not using right now. 
6. Can you condition access, or only report on it? If every response path ends in a ticket, that is not a control. That is telemetry. 

How to prepare for AI attacks

Make identity a security control point.  

Identity doesn’t just connect people to systems—it connects attackers, too. You need technology and process evaluating every authentication and every attempt individually, at runtime. You need an inline control that assesses each part of a brute force wave, with the greatest context available, before letting it through. You cannot rely on logs accumulating, shipping late to an external source, an analyst investigating, a rule base running, a policy being changed. By the time that loop closes, the traffic is already past, and at this speed there is no response time to work with. The decision has to be made inline. 

In practice, implementing Identity Security controls that can: 

1. Read signals across the entire environment, inline and in real time. Unfamiliar sources, a service account authenticating somewhere it never has, a privilege request out of pattern, a machine identity suddenly behaving like a user. These have to be interpreted by a model or engine sitting in the authentication path rather than beside it, so that whatever reads the signal is also what decides the outcome. 
2. Allow, deny or condition on the spot, and use a control to resolve the ambiguity. Most suspicious authentications are ambiguous, and you will not resolve them from logs after the fact. Step up to MFA, require JIT elevation, or block. The control itself is how you establish, in the moment, whether this is an attack or a legitimate user having an unusual day. 
3. Cover service accounts, Kerberos, NTLM and legacy applications. That is where every documented path in this campaign ran. 
4. Treat privilege as temporary by default. Standing domain admin on a service account is the cheapest thing an attacker can find. 

We are not going to out-detect an adversary that is iterative, parallel, and indifferent to being seen. We can decide differently, at the moment of authentication, which is exactly where their seven minutes were spent. 

See how a real-world AI attack runs

Reading about a five-minute path to domain admin is one thing. Watching one execute is another. 

In our lab we built this exact environment: an AD-joined estate carrying the ordinary misconfigurations most organizations have, and we run offensive AI models against it live: the spray wave forming, the service account discovered, the privilege assigned, the directory dumped. Then we run it again with identity and access run-time security in the path, and you see where each step stops. 

We are taking this on the road over the coming months. If you want to see the attacks in action, answer the six questions against your own environment, or host a session for your team, reach out.

References

GreyNoise: “Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF”, September 9, 2026. 

Blackpoint: “Death by a thousand papercuts: AI-driven exploitation at scale”, September 9, 2026.