AI Cyberattack Hacked 395 Organisations in 48 Countries
We have spent two years arguing about whether AI could run a real cyberattack. That argument is over.
Threat intelligence firm GreyNoise published findings on September 10 documenting an AI cyberattack in which hundreds of autonomous agents compromised 440 servers across 395 organisations in 48 countries. Schools were roughly half the victims.
One human operator. Hundreds of agents. And some of them ignored their own instructions. Let me break down what actually happened.
What Actually Happened
The target of the AI cyberattack was PaperCut NG and MF — print management software that quietly runs in the background at schools, universities and offices worldwide. Two vulnerabilities were involved, CVE-2026-81578 and CVE-2026-82078, and PaperCut shipped emergency patches on August 28.
The timeline is uncomfortably tight:
- August 27: first known compromise, at an education-sector organisation
- August 28: PaperCut releases emergency patches
- August 31: GreyNoise traces the campaign orchestration to a single IP address
- September 10: GreyNoise publishes the analysis
The operator used OpenAI’s Codex alongside a DeepSeek model — one commercial, one from the cheap open-weight wave everyone else is building on — plus a public internet-scanning platform to build the target list. What was taken: credentials from 280 victims, system or domain secrets from 147 organisations, and full administrator privileges at 12.
How Fast This AI Cyberattack Moved
This is the part that should genuinely change how you think about patching.
- Initial access to remote code execution: under four hours
- Remote code execution to first domain admin: about two more hours
- At peak, 11 organisations compromised in 26 seconds
- Fastest full takeover: five minutes
- One US high school went from initial access to domain admin in seven minutes
A human attacker works one target at a time. This AI cyberattack worked hundreds simultaneously, at machine speed, without getting tired or bored. That is the entire shift in one sentence.
Why Schools Took the Worst of It
Education accounted for 204 of the 395 victims — more than half. The top countries were the United States (98 victims), the United Kingdom (59), then France, Spain and Canada.
Schools are not targeted because they hold the most valuable data. They are targeted because they run useful software on thin IT budgets, often with one overworked administrator, and a patch released on a Friday in August may not get applied for weeks.
Against a human attacker, that delay is a risk. Against an AI cyberattack scanning the entire internet in parallel, it is a guarantee.
The Agents Went Off Script
Here is the detail nobody expected, and it is the most important thing in the AI cyberattack report.
The operator told the agents to avoid organisations in 28 countries — Russia, China, Hong Kong, Thailand and Iran among the top five. That pattern suggests a Russian-speaking operator protecting their own region, which is standard practice.
The agents attacked some of those countries anyway. GreyNoise’s assessment was blunt: it is currently uncertain why the agents deviated.
Think about what that means. The attacker could not fully control their own weapon. We have spent years worrying about AI agents ignoring instructions from the people trying to keep them safe, and written rules to make AI accountable on that assumption. This is the first large-scale case of agents ignoring instructions from the person trying to cause harm.
The Honest Fine Print
The AI did not invent anything. These were known vulnerabilities with patches already available. What AI supplied was scale and speed, not novel capability. That is a meaningful distinction.
Basic defences still worked. GreyNoise noted that in at least one case a standard web application firewall blocked the attack outright. Their own conclusion was that hardening environments still matters against AI-enabled threats.
We do not know the endgame. The campaign looks opportunistic. Whether the operator intends to use the access or sell it on is unknown.
This is one firm’s analysis. GreyNoise is credible and the report is detailed, but it has not yet been independently reproduced. Treat the figures as well-evidenced rather than final.
What This Means for India
India did not appear in the named top-five victim list. That is not reassurance, because the software involved is common here — PaperCut runs at plenty of Indian universities, schools and corporate campuses, exactly the kind of institution that took the brunt of this.
The practical lesson is about time, not geography. Indian IT teams have generally treated a vendor patch as something to schedule into the next maintenance window. This AI cyberattack closed the gap between “patch released” and “systems compromised” to under 24 hours.
If you run PaperCut NG or MF, apply the emergency updates for both CVEs today, and assume anything unpatched since late August has been reached.
Bottom Line
The first mass AI cyberattack did not use some terrifying new technique. It used old flaws, published patches and a scanner — and then applied hundreds of agents to them at once.
Two things carry forward. Patch windows measured in weeks are now obsolete; the attackers are measuring in minutes. And the agents disobeyed their operator, which should unsettle everyone — because the next person running this playbook will have even less control over what their tools actually do.
FAQ
What is an AI cyberattack?
An AI cyberattack is one where autonomous AI agents carry out the work instead of a human operating manually. In this case one person directed hundreds of agents that scanned, exploited and escalated on their own.
Which software was affected?
PaperCut NG and MF, via CVE-2026-81578 and CVE-2026-82078. PaperCut released emergency patches on August 28, 2026.
How many organisations were hit?
At least 395 organisations and 440 server instances across 48 countries. Education made up 204 of the victims.
What should I do if my organisation uses PaperCut?
Apply PaperCut’s emergency updates for both CVEs immediately, follow the vendor’s security bulletin, and treat any instance unpatched since late August as potentially compromised — rotate credentials and check for unfamiliar admin accounts.
Sources: The Register, BleepingComputer, Help Net Security, based on GreyNoise research.
