Quick Facts
- A single AI-powered campaign breached 395 organizations across 48 countries, achieving initial compromise at 11 targets in 26 seconds.
- Attackers used OpenAI Codex and a DeepSeek model to develop, test, and deploy exploits against PaperCut servers, reaching remote-code execution within four hours of starting with an empty workspace.
- Stolen AI credentials now serve three functions simultaneously: resale commodity, compute resource, and attribution cover — and most IAM policies cannot distinguish them from human logins.
Four independent threat intelligence teams published findings within a 48-hour window in early September 2026. Together, the reports from GreyNoise, Anthropic, Google Threat Intelligence Group, and Okta describe a machine-speed attack economy where AI credentials are the weapon, the target, and the product being sold.
The most detailed account comes from GreyNoise, which tracked a campaign it named “Agents Gone Wild.” On August 31, 2026, a likely Russian-speaking actor used IP address 45.142.193.132 to build and launch an AI-powered exploit chain against PaperCut NG/MF installations worldwide.
The Attack in Numbers
The actor exploited two chained vulnerabilities, CVE-2026-81578 and CVE-2026-82078, which together allow an unauthenticated attacker to modify configurations and execute arbitrary Java bytecode on a PaperCut server. The attacker first built a replica environment, placed vulnerable PaperCut servers next to Active Directory instances, and rehearsed the full exploit chain before releasing it onto public networks.
The attack engine ran up to 200 concurrent threads with as many as 100 automated retry loops per thread. Agents reached initial compromise at 11 organizations in 26 seconds. At one U.S. high school, the attacker moved from initial access to full domain administrator in seven minutes.
Final totals: 440 servers compromised, 395 organizations affected, 48 countries hit. Credentials were harvested from 280 organizations. Full domain administrator access was confirmed at 12 organizations, including complete NTDS.DIT dumps containing every password hash in each affected Active Directory environment. Education was the hardest-hit sector, accounting for 204 of the 440 compromised deployments.
GreyNoise inferred attribution from a hardcoded exclusion list covering 28 countries led by Russia, Belarus, and CIS states. Several agents ignored the exclusion list and hit those countries anyway — behavior GreyNoise described as unpredictable and uncontrolled.
Credentials as Commodity and Cover
Anthropic’s September 10 report, covering activity from December 2025 through August 2026, documented a separate but related threat. Attackers compromised an AI evaluation sandbox and used it to steal API keys from more than 30 AI companies. A second actor, tracked internally as GTG-50021, built fraudulent Claude resellers offering discounted access while silently proxying traffic to a different model and harvesting customer credentials.
Anthropic also tracked GTG-20006, a Russian state-nexus actor the company assessed as consistent with public reporting on Midnight Blizzard, also known as APT29. That actor used Claude to run an automated detection-evasion loop: when security tools flagged malware, agents modified and rebuilt it until it passed detection, then redeployed it. The campaign ran for eight months against more than 20 government and diplomatic organizations.
In one documented case, a single stolen developer token escalated to full administrative control of a cloud environment in roughly three hours. Google’s Threat Intelligence Group reported that in Q2 2026, a threat actor compromised a cloud resource, then planned, built, and executed an agent-powered mass credential harvesting campaign in under six hours.
The IAM Gap
The central problem all four reports identify is structural. Machine credentials — API keys, service account tokens, agent session tokens — are accepted by most identity and access management systems the same way human credentials are. There is no policy layer that accounts for the speed, concurrency, or behavioral profile of an AI agent operating those credentials at scale.
Stolen AI credentials give attackers three things at once: market value from resale, free compute billed to the credential’s legitimate owner, and attribution cover because all activity traces back to that owner. Buyer demand for AI credentials has increased year-over-year, with concentration on Claude and Gemini accounts. Average prices per AI account have more than doubled in 2026.
GreyNoise could not determine the campaign’s final objective, but noted the access gained was sufficient for both large-scale data theft and ransomware deployment across all 12 fully compromised domains.
Read more: AI agents breached 395 organizations using credentials your IAM policy still treats as human