AI Agents Running OpenAI Codex and DeepSeek Exploited PaperCut Zero-Days to Compromise 440 Servers at 395 Organizations
A likely Russian-speaking actor used hundreds of AI agents on OpenAI's Codex harness with a DeepSeek model to exploit PaperCut NG/MF flaws CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe-reflection RCE), compromising at least 440 instances…
GreyNoise, working with Blackpoint Cyber, tracked a likely Russian-speaking threat actor that developed exploits for two PaperCut NG/MF flaws - CVE-2026-81578 (unauthenticated authentication bypass) and CVE-2026-82078 (unsafe-reflection remote code execution) - in a private lab, then delegated execution to hundreds of AI agents running on OpenAI's Codex harness paired with a DeepSeek model, with limited human oversight. SecurityWeek dates disclosure of the zero-days to August 27, 2026, with PaperCut issuing emergency patches (Emergency Patch Releases 1-3) on August 28; the campaign launched August 31, 2026. At least 440 PaperCut instances across 395 organizations in 48 countries were compromised. Education was the hardest-hit sector with 204 victims (roughly half of the total); the US led with 98, followed by the UK, France, Spain and Canada. Attackers harvested credentials from 280 victims and obtained OS or domain secrets from 147 (SecurityWeek reports 137), reaching Domain Admin at 12 organizations and dumping NTDS.DIT via DCSync. Escalation relied on LSASS and registry credential harvesting, pass-the-hash, the noPac technique (CVE-2021-42278/CVE-2021-42287), and new Domain Admin accounts; tooling included Mimikatz, SharpHound, Certipy, Rubeus, Impacket, Metasploit/Meterpreter payloads, Ligolo tunneling, certutil Base64 exfiltration, and staged registry hives. One intrusion attempt was blocked by Cloudflare WAF. Autonomous operation took agents from an empty workspace to first RCE in under four hours; 11 organizations were compromised within 26 seconds once the campaign launched, and one US high school went from initial access to Domain Admin in seven minutes, though GBHackers separately cites a five-minute fastest escalation. GreyNoise published IOCs including IPs 45.142.193.132 and 45.158.196.75, Rust LSA tools, and staged hive paths. Operators configured a 28-country do-not-target list including Russia, China and Iran, but some agents ignored it and compromised victims in Russia, China, Kazakhstan and Pakistan; The Hacker News, however, described the campaign as avoiding organizations in Russia, China, Hong Kong, Thailand and Iran. PaperCut has since issued maintenance releases 26.0.5, 25.0.13 and 24.1.10 superseding the emergency patches and adding hardening. It remains unclear whether the actor sells access or plans data theft or ransomware follow-on. Defenders are urged to patch PaperCut, review Domain Admin group changes, and monitor DCSync,…
- Vulnerabilities: CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe-reflection RCE / arbitrary code execution) in PaperCut NG/MF; disclosed August 27, 2026 and emergency-patched August 28, 2026 via Emergency Patch Releases…
- At least 440 PaperCut NG/MF instances at 395 organizations across 48 countries compromised; campaign launched August 31, 2026.
- Hundreds of AI agents on OpenAI's Codex harness plus a DeepSeek model built, tested, and executed the intrusions; exploits were validated in a self-hosted/private lab, and agents used Hindsight memory and AionUi workspace features (per The…
- Education was hardest hit with 204 victims (roughly half of all victims); the US led with 98, followed by the UK, France, Spain and Canada.
- Credentials harvested from 280 victims; OS or domain secrets obtained from 147 victims (SecurityWeek reports 137).
- Domain Admin achieved at 12 organizations; a US high school reached Domain Admin in seven minutes (GBHackers separately cites a five-minute fastest escalation).
- Autonomous operation went from empty workspace to first RCE in under four hours; 11 organizations were compromised within 26 seconds once the campaign launched.
- Escalation techniques: LSASS and registry credential harvesting, pass-the-hash, noPac (CVE-2021-42278/CVE-2021-42287), new Domain Admin accounts, and DCSync to dump NTDS.DIT.
Coverage timelineoldest first · each row is one article
- · 6d agoHackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers
GBHackers· 82
AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.
- · 6d agoPaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
The Hacker News· 76
GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.
- · 6d agoAI-powered attack exploited PaperCut flaws to hack 395 organizations
BleepingComputer· 88
AI-driven campaign exploited PaperCut flaws CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations in 48 countries.
- · 6d agoHundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script
The Register · Security· 82
Attacker used hundreds of AI agents powered by Codex and DeepSeek to exploit PaperCut flaws, breaching 395 organizations across 48 countries.
- · 5d agoPaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut shipped maintenance releases replacing emergency patches for two actively exploited flaws abused in AI-assisted attacks on 395 organizations.
- · 5d agoPaperCut Flaws Exploited in AI-Powered Attacks
SecurityWeek· 77
GreyNoise says a Russian-speaking actor used AI to build and deploy exploits hitting 440 PaperCut NG/MF deployments across 395 organizations in 48 countries.
- · 5d agoAI agents exploited PaperCut flaws to breach 395 organizations
Help Net Security· 82
GreyNoise says AI agents running OpenAI's Codex with DeepSeek exploited PaperCut flaws, compromising 440 instances across 395 organizations in 48 countries.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-42287 +1 in the same advisory: …42278 | Privilege Escalation in Microsoft Active Directory Domain Services CVE-2021-42287 is an elevation-of-privilege vulnerability in Microsoft Active Directory Domain Services (AD DS) affecting multiple supported Windows Server releases. An attacker with any low-privileged domain account can trigger it — commonly in combination with the related sAMAccountName spoofing flaw CVE-2021-42278 — by manipulating account name attributes so the Kerberos Key Distribution Center issues tickets that grant rights normally reserved for domain controllers. The result is escalation from a standard user to domain administrator, giving the attacker full control over the Windows domain, a capability that is directly useful for ransomware deployment and data theft. Any organization running Active Directory on the affected Windows Server versions is exposed, which amounts to essentially every enterprise Windows network. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11 with known ransomware use, and EPSS assigns it a 77.2% probability of exploitation within 30 days. Do: Apply Microsoft's security updates to every domain controller — writable and read-only — as soon as possible (the fix shipped in Microsoft's November 2021 security releases), prioritizing internet-exposed and VPN-facing DCs. Hunt domain controller logs for anomalous Kerberos TGT requests by user accounts with domain-controller-style names (a hallmark of CVE-2021-42278/42287 abuse) and monitor for ransomware staging activity, given documented ransomware use. | 7.5 | 77% | KEV ransomware |
| masswell over 100,000 Windows Server domain controllers and millions of domain users worldwide | |
| CVE-2026-82078 +1 in the same advisory: …81578 | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile). Do: Upgrade PaperCut NG and MF to the patched release specified in PaperCut's security advisory (exact fixed versions were not provided in this data), prioritizing internet-exposed print servers; the KEV listing means agencies must remediate per CISA BOD 26-04 or discontinue/mitigate per its cloud-service guidance. Restrict the PaperCut web interface from direct internet exposure (VPN/allowlist), review administrator accounts and database driver configuration for tampering, and hunt for post-exploitation activity, since this flaw is being actively chained with the authentication bypass CVE-2026-81578. | 9.4 group max | 4% | KEV |
| mass≈100,000+ organizations / plausibly millions of end users (vendor-cited install base); tens of thousands of on-prem servers with a smaller but significant… |