In the waning hours of August, a likely Russian-speaking actor used hundreds of AI agents trained in a lab environment to seek out Internet-connected instances of the print management software Papercut, compromise the software, and opportunistically attempt to compromise Windows Active Directory (AD) environments, according to an analysis published on Sept. 9 by threat intelligence firm GreyNoise. The attack targeted two vulnerabilities in at least 440 instances of PaperCut NG and MF hosted by 395 organizations in 48 countries, the company said.
The incident is notable for the sheer speed with which the AI swarm was able to accomplish its goal.
"It's clear that large language models (LLM) are enabling adversaries to move at greater speed and scale," GreyNoise researchers said in their analysis. "The adversary went from an empty workspace to first achieving RCE [remote code execution] against a real victim in just under four hours, first [Active Directory] domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds."
The attack is the latest to showcase the progress that cyberattackers are making in incorporating AI agents into every stage of the cyber kill chain, which is the model of the steps attackers take to go from reconnaissance to compromise to delivering a payload. And the Papercut incident is not a one-off: In another incident reported last week, an attacker methodically breached a network, harvested credentials, gained root access, and dropped their payload — all with the assistance of frontier LLMs working as a team.
And indeed, on Sept. 8, Google warned that the most forward-looking adversaries are adding agentic capabilities through the attack life cycle and using them to achieve greater efficiency and reliability in their attacks. While nation-state actors are often the most sophisticated and likely to incorporate AI into the attack life cycle, the ready accessibility of open-weight models means that using these capabilities is becoming democratized, says Kelli Vanderlee, senior manager with the Google Threat Intelligence Group (GTIG).
AI agents are entering every stage of the attack cycle now. Source: Google
"Well-resourced state-sponsored actors likely have a head start over financially motivated actors in terms of access to commercially available AI tooling and training," she says. "However, another significant differentiator is the willingness to experiment with the capabilities of the technology — many threat actors are using chatbots to ask basic questions or troubleshoot, [while] some are building more complex, multistep workflows."
Nefarious AI in Supply Chains & Stealing Frontier Models
Beyond using AI swarms in their offensives, threat actors are also using the software supply chain to sneak their code into the software and scripts built by enterprise AI agents, according to Google; meanwhile, nation-state actors — such as the China-aligned UNC6508 — have targeted frontier AI research to steal intellectual property and more advanced models.
Every step of the attack life cycle — reconnaissance, finding vulnerabilities, creating phishing campaigns, and identifying weak points — can increasingly be automated, says Cliff Steinhauer, director of information security and engagement at the National Cybersecurity Alliance (NCA).
"It's impossible to responsibly put an exact timeline on fully autonomous attacks; however, we don't need to wait for that to happen to know AI is already changing the game," he says. "Hackers can execute more robust attacks at scale, and defenders do have less time to react."
The timeline of an AI-augmented attack shows the malicious cyber actor (MCA) quickly modifying agents to take specific actions. Source: GreyNoise Intelligence
In addition, attackers have the advantage of being able to experiment, because losing control does not necessarily mean losing the game for them. In the Papercut mass compromise, the cyberattack attempted to restrict the countries affected by the attack, but "our observed victimology shows the attempted restraint failed in some instances," GreyNoise stated.
While the expense of mounting a fully automated attack currently limits what attackers can do, in the future, costs will come down, according to Google. And more and more frequently, threat actors are taking a page from the cloud hijacks of a decade ago and co-opting their victims' own AI capabilities. LLM hijacking, or LLMJacking as Google calls the technique, has become a frequent goal of attacks.
"Adversaries are stealing developer credentials, purchasing compromised AI platform accounts, and hijacking enterprise cloud infrastructure to run unauthorized high-performance compute workloads," GTIG researchers stated in their analysis.
Fighting AI-Powered Attacks With Basic Security Hygiene
There is some good news amid the findings: Cybersecurity experts stress that AI-powered and agentic attacks can be stopped by the same good hygiene as humans and bot-based attacks. Multifactor authentication can prevent the abuse of identities and sessions; limiting permissions and reducing the lifetime of session tokens can make lateral movement more difficult; and detecting abnormal behavior can limit a threat actor's ability to operate in a compromised environment, says GTIG's Vanderlee.
"It is true that threat actors are able to execute campaigns more quickly with the aid of AI and automation, but longstanding security fundamentals still apply," she says.
Defenders need to find ways to make AI-enabled attackers' jobs harder and give humans the time they need to react, adds NCA's Steinhauer.
"Companies should be looking at ways to automate detection and response, but that doesn't mean taking humans out of the equation," he says. "AI can process huge amounts of information quickly, but experienced security professionals bring context and judgment that an automated system may miss."