From Empty Workspace to Full Network Control in 7 Minutes: Inside an AI-Agent Attack on a U.S. High School

A U.S. high school. An attacker starts with an empty workspace. Seven minutes later, the attacker holds the highest-level account on the school's network, the one that can add users, change policies, and read every file on every Windows machine joined to it.

The campaign that produced that seven-minute takeover hit 395 organizations across 48 countries, according to threat-research firm GreyNoise, in what the firm calls the most detailed public accounting yet of an AI-coordinated cyberattack in the wild. The attacker, whom GreyNoise assesses as likely Russian-speaking, used hundreds of AI agents working in parallel to break into servers running PaperCut, a self-hosted print, copy, and scan management app common in schools, offices, and government.

The numbers, stacked in order: at least 440 PaperCut servers were compromised. Eleven organizations were breached within 26 seconds of the campaign's launch. Twelve reached domain administrator, the highest-level account on a Windows network, including a U.S. high school in seven minutes. PaperCut shipped emergency fixes for the two underlying vulnerabilities in late August; updated versions did not fully land until September 10.

GreyNoise's researchers say the attacker built a lab with a vulnerable PaperCut server and a Microsoft Active Directory, the identity system that controls logins across most corporate Windows networks, and used it to develop and test exploits. To build the target list, the attacker ran queries against Netlas, a public internet search service that maps exposed devices.

The agents themselves ran on OpenAI's Codex, a coding-agent harness and not the consumer ChatGPT model, paired with a DeepSeek model and ordinary open-source offensive security tools. The split matters: Codex coordinates what the agents do, and the model behind it decides how. Combining the two let the attacker run a parallelized exploitation pipeline instead of a single script, which is how 11 organizations fell inside half a minute.

Once inside, the attacker had three ways to reach domain administrator: use privileged credentials the operator had already stolen, exploit older Windows vulnerabilities on the PaperCut server, or run on top of a PaperCut installation that operators had already granted high privileges to. That last path is the one defenders control. PaperCut is often deployed as a service account with broad rights because print jobs historically needed to write to many user folders. The attacker inherited those rights.

Post-access, the attacker did what credential-driven attackers have done for years: harvest credentials, move laterally through the network, and look for what can be sold or rented to other criminals. GreyNoise measured how fast the technique runs when wrapped in agents that do not get bored, do not need sleep, and do not stop to read the next line of their own exploit script.

The two PaperCut vulnerabilities GreyNoise exploited, an authentication bypass and a remote-code execution flaw (the latter lets an attacker run commands of their choice on the server), were disclosed in late August, before the campaign started, per the firm's account. The fix timeline was public. The attacker's pipeline was already running. The window between "patch is out" and "mass exploitation begins" collapsed to hours, and in some cases to minutes.

The organizations that came through this without a domain-admin takeover are the ones that applied PaperCut's late-August fixes or its September 10 update before their servers appeared on a Netlas query. For any team running internet-facing self-hosted software, that is the lesson: "patch fast" now means hours, not weeks.

GreyNoise documented a single, well-scoped campaign. The attacker combined public exploits, public AI tooling, and public target-list services, and a known set of PaperCut servers was still exposed when the agents started running. The campaign's clock is the part defenders can still move. That is the entire lesson.