We've spent months debating whether AI will replace programmers. Turns out we should have been asking whether it would replace hackers.
GreyNoise reported today that a likely Russian-speaking operator used hundreds of AI agents to autonomously develop, test, and deploy exploits against PaperCut print servers, compromising 440 instances across 395 organizations in 48 countries. The campaign started August 31 and combined OpenAI's Codex harness with a DeepSeek model, commodity offensive tools, and target lists scraped from Netlas.
Here's what should terrify you: The attacker built a private lab with a vulnerable PaperCut installation and an Active Directory server, then let the AI agents loose to develop exploits for CVE-2026-81578 and CVE-2026-82078. They went from an empty workspace to remote code execution on a real victim in under four hours. Two hours after that, they had domain admin.
Once the system was tuned, the operator scaled it. When the full wave launched, it hit 11 organizations in 26 seconds.
This isn't some theoretical red-team exercise or a cute proof-of-concept where researchers politely notify vendors. This is a working offensive pipeline that collapsed the timeline from reconnaissance to compromise by an order of magnitude. The human operator didn't write exploits. They pointed the agents at a target class and let the models figure out the rest.
What makes this different from automated scanning tools we've seen for years is the adaptability. Traditional exploit frameworks run known attacks against known vulnerabilities. These agents built custom exploits in a sandboxed environment, tested them, and deployed only what worked. That's not scripting. That's reasoning.
The industry has spent 2026 arguing about whether AI poses catastrophic risk through bioweapons or misinformation. Meanwhile, someone just proved you can use it to break into nearly 400 organizations before anyone notices the pattern.
We're not ready for this. Detection systems are built to spot human behavior: the recon, the lateral movement, the dwell time. When the dwell time is two hours and the recon is parallelized across hundreds of agents, those assumptions break.
The AI safety conversation has focused on preventing models from answering dangerous questions. Turns out the bigger problem is when they start asking their own.