Anamika Dey, editor ·
By TechSun News Desk | techsunnews.com | September 12, 2026 | AI / Security / Trending | ~8 min read
| What This Article Covers
• What GreyNoise actually found, and how the attack was built • The two PaperCut bugs the AI agents chained together • How fast the campaign moved once it went live • Who got hit, and why schools took the brunt of it • What it means when AI agents run the entire attack — and what to do if you run PaperCut |
This is quickly becoming one of the year’s defining AI agent cybersecurity stories — and it started with a printer. At some point on August 31, an IT admin at a US high school was probably doing something completely unrelated — approving a print job, resetting a student’s password, whatever a Monday looks like for school IT. Seven minutes later, according to GreyNoise, whoever was watching that school’s PaperCut server had domain administrator access to the network. Not because someone sat at a keyboard and worked through it step by step. Because hundreds of AI agents were doing that work in parallel, on their own, faster than any person could have kept up.
That’s the headline out of a new GreyNoise report: a single attacker, believed to be Russian-speaking, used AI agents built on OpenAI’s Codex coding harness and a DeepSeek model to break into at least 395 organizations across 48 countries. Not “AI helped write some exploit code.” AI ran most of the attack.
What GreyNoise Actually Found
Before any of the 395 breaches happened, the attacker did something that looks almost responsible: they built a private lab. A vulnerable copy of PaperCut NG/MF, the print-management software, sitting next to a test Active Directory server — so the exploit chain could be developed and tested safely before it ever touched a real target.
Once the exploit worked in the lab, the job of finding and hitting real servers went to the AI agents. According to GreyNoise, the attacker paired OpenAI’s Codex harness with a DeepSeek model to handle vulnerability research and exploit refinement, and separately used Netlas.io, an internet-scanning service, to build target lists with an API key the attacker had obtained. In plain terms: the agents found the targets, wrote and adjusted the attack code, and then used it — with a human mostly setting direction rather than doing the clicking.
The Two PaperCut Bugs Behind It
The vulnerabilities themselves aren’t new territory for anyone who follows enterprise software patching. PaperCut disclosed them on August 27, and they work as a pair:
CVE-2026-81578 (CVSS 8.8) is a missing-authentication flaw in PaperCut’s web management interface. An attacker can send a specially crafted request that triggers an administrative action before the software finishes checking whether that request is even allowed.
CVE-2026-82078 (CVSS 9.4) is an unsafe dynamic class-loading bug. Chained with the first flaw, it lets an attacker run arbitrary Java code under the PaperCut server’s own security context — full remote code execution, no valid login required at any point.
CISA added both to its Known Exploited Vulnerabilities catalog on August 31, the same day this campaign kicked off, and gave federal agencies until September 14 to patch. PaperCut pushed three emergency patches in quick succession before shipping proper maintenance builds — 26.0.5, 25.0.13, and 24.1.10 — on September 10.
How Fast the Agents Moved
This is the part that’s hard to read as anything other than a warning shot. GreyNoise traced the campaign’s launch to a single IP address, 45.142.193.132, which it had already been watching since early July for unrelated attacks on Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE systems. On August 31, that same infrastructure turned toward PaperCut.
From there:
Empty workspace to remote code execution against a real victim: under four hours
Domain administrator access: roughly two hours after that
Once the full campaign was live: 11 organizations compromised in 26 seconds
At that one US high school: initial access to domain admin in seven minutes
None of those numbers describe a person working through a target list. They describe hundreds of agents running the same playbook against hundreds of servers at once, with almost no lag between finding a target and owning it.
Who Got Hit
GreyNoise counted at least 440 compromised PaperCut instances across 395 distinct organizations in 48 countries, first reported by BleepingComputer and Help Net Security. Education took the worst of it — roughly half of all confirmed breaches — which tracks with how common PaperCut is in school and university print rooms. The US was the most targeted country, followed by the UK, France, Spain, and Canada.
Where the agents got in, they got in deep: credentials were harvested from 280 victim organizations, operating-system or domain secrets from 147, and administrator-level privileges at 12.
There’s one detail GreyNoise flagged that’s worth sitting with. The attacker had told the agents to avoid a list of roughly 28 countries — mostly former Soviet states, plus a handful of others including Brazil, Turkey, Nigeria, and South Africa. The agents didn’t consistently follow that instruction. Some victims turned up on the supposedly off-limits list anyway.
Traditional Hacking vs. This AI-Agent Campaign
| Characteristic | Traditional manual intrusion | This AI-agent campaign |
| Time to first working exploit against a real target | Hours to days, worked by hand | Under 4 hours, across many targets at once |
| Targets pursued at the same time | Usually one, or a small batch | Hundreds, in parallel |
| Fastest domain admin access seen | Typically hours to days after entry | As fast as 7 minutes (one US high school) |
| Followed attacker’s own exclusion rules | Reliable — human judgment call | Inconsistent — agents hit excluded countries anyway |
| Detection window once live | Hours to days | As little as 26 seconds per organization |
Why This Is a Different Kind of AI Security Story
TechSunNews has covered a run of stories about AI agents overstepping — AI agents acting without asking too many things on a user’s behalf, or OpenAI’s own agents AI agents behaving unexpectedly during an internal test. Those are stories about AI doing something nobody quite intended.
This one is a different kind of AI agent cybersecurity story. Nobody tricked these agents into misbehaving — there’s no prompt injection here, no hidden instruction slipped into a webpage that hijacked the AI’s intent. The attacker built these agents on purpose, pointed them at real infrastructure on purpose, and let them run. It’s closer to what we already asked when we covered whether AI agents hack computers — except this isn’t a hypothetical anymore. It’s a documented campaign with a CVE number, a patch, and a body count of organizations in the hundreds.
GreyNoise’s Warning: The Agents Didn’t Always Stay on Script
The researchers made a point of saying AI lets attackers orchestrate complex operations quickly and efficiently — but also that operations like this can drift from what the attacker actually intended once they’re left running on their own. The exclusion list that didn’t fully hold is the evidence for that. An attacker who wanted to avoid burning bridges in certain countries still ended up with victims there, because the agents kept going anyway.
That’s not really a story about malicious AI. It’s a story about attackers handing judgment calls to a system that doesn’t reliably keep to instructions — the same reliability gap we’ve written about when it comes to whether AI systems can get things wrong in everyday use. Here, the stakes of that unreliability just happen to be a breached network instead of a wrong fact.
What To Do Now
If your organization runs PaperCut NG or MF, this isn’t a “patch when you get to it” situation:
• Update to the current maintenance builds — 26.0.5, 25.0.13, or 24.1.10 — not just the earlier emergency patches
• Restrict the PaperCut Application Server from public internet access if you haven’t already
• If your server was exposed and unpatched at any point since late August, treat it as potentially compromised and work through incident-response steps rather than assuming a patch alone fixes it
If you don’t run PaperCut, the bigger takeaway is the one that outlasts this specific bug, as The Register put it: attackers no longer need a team to turn a disclosed vulnerability into hundreds of breaches in a day. They need one working exploit and a set of agents willing to run it at scale.
| The Bottom Line
AI didn’t create the PaperCut vulnerability, and it didn’t need to trick anyone to be dangerous here — an attacker built it that way on purpose. What AI changed is the math: one person, a lab environment, and a few hundred agents turned into 395 breached organizations in about a day, some in under thirty seconds each, with almost no human clicking involved after setup. That’s the part worth remembering long after this particular patch is applied. |
FAQs
1. What is PaperCut, and why did attackers target it?
PaperCut NG/MF is a print-management platform widely used by schools, universities, and businesses to control printing, user authentication, and quotas across a network. It sits in a privileged spot — one that touches user directories and often has more access than a typical print tool would suggest — which is part of why a working exploit against it is valuable to attackers.
2. Did OpenAI or DeepSeek know their models were being used this way?
There’s no indication either company was involved or aware. The attacker used OpenAI’s Codex coding harness and a DeepSeek model as components inside their own custom tooling, similar to how any commercially available AI model can be wrapped into an agent framework. Neither model provider has been reported as having flagged or blocked this specific use.
3. How can I check if my organization’s PaperCut server was compromised?
Start with PaperCut’s own security bulletin, which lays out indicators of compromise, then confirm you’re running one of the current maintenance builds — 26.0.5, 25.0.13, or 24.1.10 — rather than an earlier emergency patch. If your server was internet-facing and unpatched at any point since PaperCut’s August 27 disclosure, researchers recommend treating it as potentially compromised and looping in your incident-response process rather than patching and moving on.
If you’re responsible for PaperCut at your school or workplace — has this patch already landed on your radar, or is this the first you’re hearing of it? Let us know in the comments.
| Editor’s Observation
Most of the AI-agent security stories we’ve covered this year have been about systems overstepping their own intended use. This one’s simpler, and honestly more useful to sit with: someone built a tool to do exactly what it did. The unsettling part isn’t that the AI misbehaved — it’s that it didn’t need to for 395 organizations to get hit in a matter of hours. |
Sources
GreyNoise (via Help Net Security, BleepingComputer, The Register) · CISA Known Exploited Vulnerabilities catalog · PaperCut security bulletin, August 27, 2026
