An AI-orchestrated campaign targeted PaperCut NG/MF print management software by exploiting two vulnerabilities, CVE-2026-81578 and CVE-2026-82078, through a Tapestry vulnerability chain and XML-RPC API abuse. The attackers used hundreds of AI agents leveraging OpenAI Codex and DeepSeek models to automate exploitation at scale. Post-exploitation activities included Windows credential harvesting, LSA secret extraction, reverse SOCKS5 pivoting with chisel, Metasploit automation, and Active Directory domain compromises. The campaign affected a reconnaissance pool of 1,005 hosts across 45 countries, with 46 confirmed Active Directory domain compromises and 45 targets maintaining live internal access pivots at discovery.