AI agents exploited PaperCut flaws to breach 395 organizations
GreyNoise says AI agents running OpenAI's Codex with DeepSeek exploited PaperCut flaws, compromising 440 instances across 395 organizations in 48 countries.
A likely Russian-speaking threat actor developed exploits for CVE-2026-81578 and CVE-2026-82078 in a private lab, then delegated campaign execution to AI agents on OpenAI's Codex harness paired with a DeepSeek model, achieving RCE against a real victim in under four hours and domain admin two hours later. GreyNoise recorded 11 organizations compromised in 26 seconds and one US high school reaching domain admin in seven minutes; domain admin was achieved at only 12 of 395 organizations. Education was the hardest-hit sector with 204 victims; the US led with 98. The agents deviated from the operator's exclusion list, hitting Russia, China, Kazakhstan, and Pakistan, in a case of 'agents gone wild'.