A suspected cybercriminal used hundreds of AI agents to accelerate the exploitation of vulnerable PaperCut servers worldwide.
GreyNoise researchers reported that a suspected Russian-speaking attacker used hundreds of AI agents to exploit two zero-day vulnerabilities in PaperCut NG/MF print management software. Blackpoint Cyber separately analyzed how AI accelerated the campaign’s exploit-development workflow. Tracked as CVE-2026-81578 and CVE-2026-82078, the vulnerabilities can be chained to let an unauthenticated attacker modify certain configurations and execute arbitrary Java bytecode in the security context of the PaperCut server.
The automated onslaught compromised at least 440 PaperCut instances across 395 organizations in 48 countries. The campaign heavily battered the global education sector, claiming 204 victims, including a U.S. high school that fell from initial access to full domain administrative control in just seven minutes.
Inside the autonomous attack engine #
The operation, staged partly from IP address 45.142.193[.]132, shows how AI can accelerate established cyberattack techniques. The perpetrator used OpenAI’s Codex as an execution harness alongside a DeepSeek model, paired with orchestration software like AionUI and Hindsight, a tool that provides persistent memory for AI agents.
Rather than merely generating static exploit code, the AI agents functioned as an autonomous engineering unit. According to Blackpoint, the operation began in an empty workspace on Aug. 31, 2026. The agents analyzed patches, replicated code execution paths in a local virtual lab, built Go-based multi-threaded scanning tools, and refined network probes based on real-time errors.
“The strongest AI impact in this campaign was not a novel exploit technique,” Blackpoint stated. “It was the reduction of human effort required to research, develop, debug, classify, track, retry, and continuously improve exploitation across hundreds of real systems.”
Once released onto public networks, the attack engine ran up to 200 concurrent threads, executing as many as 100 automated retry loops. When the full campaign launched, the infrastructure compromised 11 organizations in 26 seconds.
When autonomous tools jump the fence #
The incident illustrates the operational instability of agentic tooling. The operator attempted to enforce an exclusion filter prohibiting intrusions across 28 nations, including Russia, China, and Iran.
However, GreyNoise found that the exclusion controls failed in some cases, with victims identified in countries on the avoidance list, including South Africa and Brazil. GreyNoise dubbed the unpredictable behavior “agents gone wild.”
The agents escalated privileges via three distinct paths, extracting LSASS process memory, abusing outdated “noPac” flaws, or exploiting Domain Controller footholds before performing full domain credential dumps. Despite 440 compromised instances, GreyNoise observed domain administrator access at only 12 organizations. A Cloudflare Web Application Firewall also blocked the attacker in at least one attempt against an apparently vulnerable PaperCut instance.
The post-exploitation bottleneck #
The campaign shows how AI-assisted workflows can sharply reduce the time and labor required to move from published vulnerability details to exploitation at scale. It also suggests that automated attacks can generate more initial access than a human operator immediately follows up on.
GreyNoise observed multiday delays between some initial compromises and later post-exploitation activity because the actor did not immediately follow up on every victim. For enterprises, the findings suggest that newly disclosed vulnerabilities may be exploited at scale within hours or days, although delayed follow-up can still give defenders time to detect and contain an initial intrusion.
Organizations should identify internet-accessible PaperCut NG/MF servers and update affected installations immediately. The vulnerabilities affect releases earlier than the fixed versions 24.1.10, 25.0.13 and 26.0.5, depending on the installed release branch. Administrators should also restrict access to management interfaces and investigate exposed servers for unexpected child processes, newly created accounts, LSASS access, DCSync activity and unusual privilege changes.
The campaign did not result in domain administrator access at most identified victims, but that should not reduce its urgency. As AI helps attackers automate scanning and initial access, rapid patching, limited administrative exposure and internal monitoring become increasingly important barriers between a vulnerable server and a domain-wide breach.
Read more: Five Eyes cyber agencies warn that AI could accelerate attacks and shrink enterprise response windows, increasing the pressure to patch faster, reduce attack surfaces and strengthen identity controls.