AI agents ran a real intrusion campaign at machine speed. It hit 440 servers in 48 countries

Security research firm GreyNoise published a timeline of an actual AI-orchestrated intrusion campaign on September 9.

The actor, assessed as likely Russian-speaking, ran hundreds of AI agents through OpenAI's Codex (OpenAI's coding harness) with a DeepSeek model underneath, alongside public penetration-testing tools.

Targets: PaperCut NG/MF, print-management software that runs with system privileges on Windows. Two live vulnerabilities were used in sequence, an authentication bypass and an unsafe reflection bug that yields remote code execution (RCE).

The speed numbers make the story real.

"In one instance, the adversary went from initial access to full domain administrator in seven minutes against a high school in the United States," the GreyNoise report said.

When the campaign launched in parallel, the agents hit 11 organizations in 26 seconds, the timeline shows.

Under the hood: how the swarm worked

The build took hours, not weeks. On August 31 the actor created a workspace, diffed patched and unpatched builds, wrote an exploit, assembled a local lab (a vulnerable PaperCut server plus an Active Directory server), and achieved first RCE on a real Australian target the same day.

The target list grew through tooling the agents wrote themselves. A multi-threaded scanner appeared within the first hour, was refined twice on the spot, and flagged 462 suspected vulnerable targets on its first pass.

Domain admin landed fastest at five minutes and slowest at 144, GreyNoise said. Across 395 identified organizations in 48 countries, 440 instances were compromised in total.

The graveyard check comes with a door prize: Cloudflare's web application firewall defeated one attempted run against a US host. Fundamental hardening still works against this, the firm said.

Precedent: the shape is old, the speed is new

Precedent says this attack shape has a long history. PaperCut intrusions have led to extortion before, the report said.

What changed is the latency budget. A defender writing a detection signature used to buy weeks. The loop here rebuilds and redeploys within the same session, because the agents wrote their own fixes when something broke mid-campaign.

The unseen part is the sandboxing. The configuration that let the agents run wide (general network access inside a coding harness) is the default in most containers, the report said in its practitioner guidance.

I get the sense defenders now need a plan for agent-speed patch lag, and the numbers give it: patch in hours, not patch cycles.

Source