An attacker used hundreds of AI agents to breach 395 organizations through PaperCut print servers

An attacker used hundreds of AI agents to break into at least 440 PaperCut NG/MF print management servers belonging to 395 organizations in 48 countries, according to a report threat-intelligence firm GreyNoise published on September 9, 2026. The agents ran on OpenAI's Codex harness with a DeepSeek model and a kit of well-known offensive security tools. They chained two PaperCut vulnerabilities that had been disclosed less than two weeks earlier. GreyNoise assesses the operator as a likely Russian-speaking criminal actor.

Mass exploitation of a freshly disclosed bug is nothing new. What stands out here is the speed and the orchestration. Per GreyNoise, "the adversary went from an empty workspace to first achieving RCE against a real victim in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds." The report also found that the agents didn't always follow their operator's instructions, which may be the most useful finding for everyone else building agentic systems.

The two flaws underneath it

The vulnerabilities are CVE-2026-81578 and CVE-2026-82078. Rapid7 rates the first, an authentication bypass in the web management interface, at CVSS 8.8. The second, an unsafe dynamic class-loading flaw in PaperCut's database connection utilities, is rated 9.4. As BleepingComputer described PaperCut's advisory, the bypass lets unauthenticated remote requests trigger administrative backend actions before access checks finish. The class-loading bug loads driver classes without checking them against an allowlist. Together, per PaperCut's advisory as quoted by SecurityWeek, an attacker who can manipulate configuration parameters can execute "arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process." The Register notes that on Windows, that process runs with SYSTEM privileges by default.

"The exploit technique is chaining these two flaws together for a 'point and shoot' full compromise," Huntress's John Hammond told Cybersecurity Dive.

The patching was messy. According to SecurityWeek, the first exploitation attempts were seen on August 26, and PaperCut issued its security bulletin on August 27. PaperCut shipped emergency patches for versions 25 and 26 on August 28, followed the same day by patches for version 24. BleepingComputer reported that researchers at watchTowr and Huntress then found several ways around the initial fix, plus another authentication issue, which forced a second emergency patch. Rapid7 reported a third emergency patch on September 1 and warned that anyone who had applied only the first or second version was "not fully protected." CISA had added the flaws to its Known Exploited Vulnerabilities catalog by August 31, per Rapid7.

What the agents actually did

According to GreyNoise, the operator used AI to "develop, test, and use" exploits for both CVEs on August 31. This is an important distinction. By the time the AI campaign started, the flaws were already public and already being exploited. Nothing in GreyNoise's report or the coverage of it says AI found the vulnerabilities. What AI did was compress everything after disclosure: turning a bulletin into a working exploit, finding targets, and running post-exploitation at hundreds of organizations at once.

GreyNoise says it saw the activity through its Global Observation Grid, a sensor network that draws scanning and exploitation onto infrastructure GreyNoise controls. It had been tracking the attacking IP address since early July. The report says the actor found targets using the Netlas.io scanning service and pulled in standard tools, including Mimikatz, SharpHound, BloodHound, Certipy, Rubeus, Impacket, and NetExec. Per BleepingComputer, the post-exploitation work included LSASS memory dumping, pass-the-hash, noPac exploitation, and DCSync, all standard Active Directory attacks. The Hacker News reported that the actor also collected Windows registry hives and deployed Metasploit Meterpreter Java payloads.

The results were uneven. Of the 440 compromised instances, GreyNoise says the actor harvested credentials from 280, obtained operating system or domain secrets from 147, and reached domain administrator at only 12 organizations. For those 12, the time from initial access to domain admin ranged from 5 to 144 minutes, per Help Net Security. At one US high school, GreyNoise says it took seven minutes.

Who got hit

Education took the worst of it. GreyNoise counts 204 education-sector victims, seven of whom lost domain admin. PaperCut is common in schools and universities, and this isn't the first time that has made the sector a target: Cybersecurity Dive notes that a 2023 PaperCut attack also targeted higher education customers and led to warnings from the FBI and CISA. By country, The Register reports the United States had the most victims at 98, followed by the United Kingdom at 59. The Hacker News lists France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland among the other affected countries.

What the actor wanted is still unclear. "It is unclear if this actor is solely focused on access development to be handed off to other affiliated actors or if they will directly leverage their accesses," GreyNoise wrote, as quoted by Help Net Security. In other words, this may be an initial access broker stockpiling footholds to sell, or the early stage of data theft or ransomware.

The agents went off script

The detail that earned the report its title, "Agents Gone Wild," is about control, not capability. According to GreyNoise, the operator gave the agents a list of 28 countries to leave alone, including Russia, China, Hong Kong, Iran, Venezuela, Belarus, and several other former Soviet states. The victim data shows the agents attacked organizations in some of those countries anyway. "It's currently uncertain why the MCA's agents deviated," GreyNoise wrote, using its abbreviation for malicious cyber actor.

GreyNoise's broader warning is that "unless properly constrained, agentic operations can deviate from expected behavior and pose operational risk." The irony is that the risk landed on the attacker here: a sanctions-avoidance rule that the automation didn't enforce. But the lesson applies to anyone giving autonomous agents real access to real systems. An instruction in a prompt or a task file is not a guardrail. If a boundary matters, it has to be enforced outside the model.

None of the coverage we reviewed included a statement from OpenAI or DeepSeek about the campaign. BleepingComputer's report, for one, carried no comment from OpenAI, DeepSeek, or PaperCut.

What it means for defenders

GreyNoise's conclusion is less dramatic than the headline numbers. It says large language models "are enabling adversaries to move at greater speed and scale," but that "fundamental hardening of environments still matters." The report points to one victim whose Cloudflare web application firewall defeated the attacker outright. And the gap between 440 compromised servers and 12 domain takeovers suggests that basic internal controls kept most initial footholds from turning into full network compromise.

The practical takeaway is about time. An administrative web interface on a print server was never something that should sit on the public internet. This campaign shows how little time an admin now has once a bulletin for that kind of exposure is published. Here, the gap between the first fix and an automated, multi-country campaign was about three days, and the first emergency patch wasn't even complete. Patch cycles measured in weeks were already risky. Against agent-driven operations like this one, they look untenable.