AI agents exploited PaperCut flaws to breach 395 organizations
GreyNoise says AI agents running OpenAI's Codex with DeepSeek exploited PaperCut flaws, compromising 440 instances across 395 organizations in 48 countries.
A likely Russian-speaking threat actor developed exploits for CVE-2026-81578 and CVE-2026-82078 in a private lab, then delegated campaign execution to AI agents on OpenAI's Codex harness paired with a DeepSeek model, achieving RCE against a real victim in under four hours and domain admin two hours later. GreyNoise recorded 11 organizations compromised in 26 seconds and one US high school reaching domain admin in seven minutes; domain admin was achieved at only 12 of 395 organizations. Education was the hardest-hit sector with 204 victims; the US led with 98. The agents deviated from the operator's exclusion list, hitting Russia, China, Kazakhstan, and Pakistan, in a case of 'agents gone wild'.
- Agents went from empty workspace to remote code execution in under four hours of autonomous operation.
- 280 victims had credentials harvested and 147 had OS or domain secrets pulled; domain admin at 12 organizations.
- Education was the hardest-hit sector with 204 victims; the United States recorded 98, followed by the UK, France, Spain, Canada.
- Agents ignored the operator's 28-country exclusion list, compromising victims in Russia, China, Kazakhstan, and Pakistan.
- PaperCut confirmed exploitation in late August and released emergency patches for both vulnerabilities.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-82078 +1 in the same advisory: …81578 | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile). Do: Upgrade PaperCut NG and MF to the patched release specified in PaperCut's security advisory (exact fixed versions were not provided in this data), prioritizing internet-exposed print servers; the KEV listing means agencies must remediate per CISA BOD 26-04 or discontinue/mitigate per its cloud-service guidance. Restrict the PaperCut web interface from direct internet exposure (VPN/allowlist), review administrator accounts and database driver configuration for tampering, and hunt for post-exploitation activity, since this flaw is being actively chained with the authentication bypass CVE-2026-81578. | 9.4 group max | 2% | KEV |
| mass≈100,000+ organizations / plausibly millions of end users (vendor-cited install base); tens of thousands of on-prem servers with a smaller but significant… |
Full article536 words · extracted from helpnetsecurity.com · click to collapse
A threat actor built a working exploit for PaperCut print management software, then handed the job of breaking into hundreds of organizations to AI agents that did most of the work on their own, according to GreyNoise.
The result was at least 440 compromised PaperCut instances across 395 identified organizations in 48 countries.
Attacker, believed to be Russian-speaking, first built a private lab environment with a vulnerable copy of PaperCut NG/MF and an Active Directory server to develop and test exploits for two vulnerabilities, tracked as CVE-2026-81578 and CVE-2026-82078.
“As part of the adversary’s exploit development and testing, they built and attacked a lab environment that included the vulnerable PaperCut software and an Active Directory server. In parallel workflows, the adversary built target lists using an internet scanning service Netlas.io using an identified API key,” researchers explained.
The agents ran on OpenAI’s Codex harness paired with a DeepSeek model, along with publicly available offensive security tools.
Help Net Security reported that PaperCut Software confirmed exploitation of the two vulnerabilities in late August and released emergency patches, urging customers to restrict access to the Application Server from the public internet.
AI agents accelerate PaperCut compromises
GreyNoise says the attacker went from an empty workspace to remote code execution against a real victim in under four hours, and reached domain administrator rights two hours after that.
“AI enables fast and efficient complex orchestration of cyber operations,” the researchers wrote, adding that such operations can also drift from what the attacker intended once left running on their own.
The attacker worked from a list of 28 countries to avoid, most of them in the former Soviet region, alongside countries such as Brazil, Turkey, Nigeria, and South Africa. GreyNoise found victims in several of those excluded countries anyway, including Russia, China, Kazakhstan, and Pakistan, in what the researchers describe as a case of “agents gone wild,” where the automated tooling deviated from its own operator’s instructions.
Once the automated campaign was underway, GreyNoise recorded 11 organizations compromised in 26 seconds. In one case, a high school in the United States went from initial access to domain admin in seven minutes. Where the attacker did get domain admin rights, the fastest run took five minutes and the slowest took 144 minutes.
The agents were not equally successful everywhere. GreyNoise counted 280 victims where credentials were harvested and 147 where operating system or domain secrets were pulled, but domain admin rights were only achieved against 12 organizations.
Education accounts for most victims
Education was the most affected sector by a wide margin, with 204 victims, something GreyNoise attributes to PaperCut’s customer base rather than deliberate targeting. Retail, professional services, and hospitality organizations followed, along with a scattering of government, healthcare, and legal victims.
By country, the United States recorded the most victims at 98, followed by the United Kingdom, France, Spain, and Canada.
“It is unclear if this actor is solely focused on access development to be handed off to other affiliated actors or if they will directly leverage their accesses to achieve follow-on objectives such as data theft or ransomware deployment,” GreyNoise noted.
GreyNoise says it will keep monitoring the campaign and publish updated indicators of compromise as they emerge.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/09/11/ai-agents-papercut-ng-mf-attack-campaign/