Hundreds of AI agents, running on OpenAI's Codex and a DeepSeek model, breached 395 organizations through one print-server bug

On August 27, PaperCut got a report of a compromised print-management server at a school. By September 11, two independent security research teams -- GreyNoise and Blackpoint Cyber, working separately and publishing two weeks apart-- had traced that single report back to a campaign that ran hundreds of AI agents against the internet at once, breaking into at least 440 PaperCut servers across 395 organizations in 48 countries before most of the victims knew they'd been touched.

The software doing the breaking is boring by design: PaperCut NG and PaperCut MF are print-management platforms, the kind of thing an IT department installs once and forgets. That is exactly why it was a good target -- internet-facing by default in many deployments, rarely patched same-day, and running with the administrative trust a print server needs to talk to every desktop on a network. What made this campaign different from a decade of similar print-server attacks wasn't the bug. It was what built the exploit and ran it at scale. Print servers sit on nearly every corporate network precisely because nobody thinks about them until one goes down -- which is also why nobody notices when one starts talking to infrastructure it has no business reaching.

The two bugs, chained

PaperCut disclosed two flaws in an urgent advisory on August 27: an authentication bypass in the product's web management interface (CVE-2026-81578), which lets requests aimed at administrative functions trigger backend actions before access checks complete, and an unsafe dynamic-class-loading flaw in its database-connection utilities (CVE-2026-82078) that lets an attacker who can reach that interface run arbitrary Java code on the server. Neither one alone is fatal. Chained together, an attacker with no credentials at all can rewrite a PaperCut server's configuration and then execute code under the server's own process -- which is precisely how the campaign got in.

PaperCut's first patch didn't fully close the door. Researchers at watchTowr and Huntress found ways around the initial fix within a day, which is why the company shipped a second emergency patch on August 28 and a third, broader one -- Emergency Patch Release 3, extending coverage to the older 24.x branch -- on September 1. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on August 31, invoking Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize remediation of KEV-listed flaws on internet-facing systems; the alert itself doesn't set a specific day count for this listing, but CISA's standing guidance urges every organization, not just federal agencies, to treat a KEV addition as an active-exploitation confirmation rather than a routine advisory.

From an empty workspace to domain admin in six hours

Blackpoint's Adversary Pursuit Group recovered the attacker's own operator infrastructure -- exposed by the same carelessness that exposes most offensive tooling -- and with it a timestamped directory of the build process: vulnerability research, proof-of-concept development, tooling hardening, target sourcing, campaign execution, failure analysis, and retry waves, each state file recording what was finished, what was blocked, and what a later session should try next. That isn't a metaphor for AI assistance. It's a literal agent session log, preserved because the operator never bothered to delete it. Separate reachability scripts, run with 32 and 80 parallel workers, did the first pass of finding live PaperCut systems -- sourced through the internet-scanning service Netlas.io -- before the heavier exploitation stage ever started.

GreyNoise had been tracking the operator's infrastructure since early July, watching one IP address probe multiple unrelated platforms through its Global Observation Grid, a network of sensors the firm runs specifically to catch scanning and exploitation traffic before it hits a real target. GreyNoise dates the PaperCut exploit-development phase to August 31 -- the same day CISA added both CVEs to its KEV catalog. From a cold start, the operation reached remote code execution against a real victim in under four hours, and domain administrator credentials two hours after that. Once the campaign moved from development into full automated execution, it compromised at least 11 organizations in 26 seconds. Where the agents reached domain admin at all -- 12 of the 395 known victim organizations -- the fastest run took five minutes and the slowest took 144. One U.S. high school went from initial access to full domain control in seven minutes.

The scale of what the agents took once inside is its own data point: Blackpoint counted 280 successful credential-harvesting events and 147 exfiltrated OS or domain secrets across the campaign, alongside the 12 full domain-administrator compromises. GreyNoise also documents at least one clean defensive win in the middle of all this -- an attempt against a PaperCut instance sitting behind Cloudflare's Web Application Firewall was defeated outright, which both firms note as evidence that conventional defenses still work against this campaign when they're actually in place.

Why a DeepSeek model, and why it matters that it wasn't just Codex

The agents ran on OpenAI's Codex as an execution harness, paired with a DeepSeek model, plus persistent-memory tooling (Hindsight) and a unified agent workspace (AionUI) layered on top. Multiple outlets covering the campaign describe the DeepSeek pairing as a deliberate choice to route around the content-safety restrictions US frontier labs place on offensive-security queries -- Codex for orchestration and coding competence, a less-restricted model for the parts a safety-tuned model would refuse to help with. Neither GreyNoise's nor Blackpoint's own published report states that reasoning in those exact words; it is the surrounding reporting's inference from the pairing, not a documented fact about the operator's intent, and this piece treats it as such rather than settled fact.

Once inside, the agents reached for a conventional offensive toolkit: Mimikatz for credential extraction, BloodHound and SharpHound for mapping Active Directory, Certipy and Certify for certificate-service abuse, Rubeus for Kerberos manipulation, Impacket and NetExec for lateral movement, SpoolSample and Seatbelt for reconnaissance, plus EDR-evasion tools (EDR2trash, a Windows Defender tamper-protection disabler) and an AMSI bypass to stay unnoticed. None of that toolkit is novel -- security teams have chased these exact tool names through incident reports for years. What's new is that an AI agent decided which one to reach for, in which order, against which target, largely without a human in that loop.

PaperCut is not the first widely used infrastructure software to get caught this way. A self-propagating botnet has spent nearly two years exploiting an older, disputed authentication flaw in Ray, the open-source framework that coordinates AI training runs at OpenAI and much of the Fortune 500, turning compromised GPU clusters into a cryptomining operation while Ray's maintainer argues the underlying behavior is a design choice rather than a bug. The pattern connecting that campaign to this one is the same: software built for administrative convenience, exposed to the internet more often than its threat model assumed, discovered by attackers who now have AI-assisted tooling to find and chain the bugs faster than most security teams patch them.

Where it hit

The country list runs to 48 in total, but the concentration in the United States, the United Kingdom, France, and Spain isn't an accident of who got scanned first -- PaperCut is disproportionately deployed in the public sector and education across exactly those markets, which is also where the campaign did the most damage.

Education alone accounts for more than half of every identified victim -- 204 of 395 organizations -- which tracks with how PaperCut is sold: print-quota management is a fixture of school and university IT in a way it simply isn't in, say, financial services, which shows up last on the full list at six victims. Healthcare and legal each recorded eight victims -- a small share of the total, but exactly the sectors where a domain-administrator compromise carries the highest downstream cost.

The list of countries the agents were told to leave alone

Both firms recovered the same operational detail: the attacker instructed its agents to avoid targeting 28 countries, mostly the territory of the former Soviet Union plus a scattering of others -- Russia, China, Hong Kong, Thailand, Iran, Venezuela, Belarus, Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Moldova, Ukraine, Brazil, Vietnam, Indonesia, Pakistan, Tanzania, Bangladesh, Afghanistan, Turkey, South Africa, Namibia, Nigeria, and Zimbabwe. It's the kind of exclusion list operators build to avoid drawing attention from their own country's law enforcement -- a pattern common enough in Russian-speaking cybercrime specifically that GreyNoise cites it as one basis, alongside language artifacts in the recovered infrastructure, for its "Russian-speaking" attribution. Neither firm names a specific individual, group, or state.

The instructions didn't fully hold. GreyNoise found victim organizations inside several of the supposedly off-limits countries anyway, and says plainly it doesn't know why: "it's currently uncertain why the [attacker's] agents deviated," calling it, in the title of its own report, "agents gone wild." That's not a rhetorical flourish. It's a security research firm admitting that the operator's own targeting instructions -- the closest thing this campaign had to a safety rail -- didn't reliably bind the agents executing them. GreyNoise is equally candid about what it still doesn't know: its own report says it's unclear whether the operator intends to monetize these footholds directly, through ransomware or data theft, or hand access off to a different, affiliated actor entirely -- and that its published indicators of compromise aren't exhaustive, because "the AI-enabled adversary continued to make necessary changes on the fly."

How big, really

PaperCut hadn't updated its own incident page to cite the 440-server figure as of this piece's publication. That's not necessarily a discrepancy to hold against the company -- its August 27 post is dated to the second day of an active incident, and it says so in its own text -- but it means the only account most readers will find on PaperCut's own site is the smaller, earlier one, not the count that's since been independently confirmed twice.

“As LLMs/AI make it faster for both defenders and attackers to search codebases, generate hypotheses and connect obscure behaviors, I suspect that lesson is only going to become more important.” — Chris Dance, PaperCut CEO, in PaperCut's post-incident blog

Autonomous, or just fast

"Hundreds of AI agents" is the framing GreyNoise and Blackpoint both chose, and the pace they document -- a cold start to real-world code execution in under four hours, 11 organizations breached in the 26 seconds after the campaign went live -- is hard to explain as a human operator clicking through targets one at a time. But neither report, nor The Register's own coverage of them, resolves a more basic question: how many of those "agents" were making independent judgment calls against each target, and how many were parallel copies of the same script, each one calling out to an LLM for a sub-task and reporting back. Those are different claims wearing the same headline.

This isn't the first disclosure this year of a Russian-linked actor weaponizing a frontier AI model for offensive operations. Anthropic's own fourth threat-intelligence report, published the day before this campaign came to light, separately disclosed a Russia-linked group that used Claude against Ukrainian and European targets -- a different model, a different operator, and a different kind of misuse, but the same underlying pattern: a safety-tuned frontier model providing capability a less-scrupulous actor couldn't otherwise assemble as quickly, documented independently of the vendor whose product got used. Two unrelated disclosures inside three weeks is not yet a trend line, but it's no longer a single anecdote either.

What's actually established

What changes for defenders isn't the exploit chain -- CVE-2026-81578 and CVE-2026-82078 patch the same way whether a human or an agent found them first. What changes is the response window. A vulnerability that would once have given IT teams a few days of relatively low exploitation volume before mass scanning caught up now compresses that window to hours, because the reconnaissance, weaponization, and targeting that used to take a skilled operator days of manual work now run as one continuous, largely unattended pipeline. Patch-then-verify cycles built around a human attacker's pace are the thing this campaign actually breaks, more than any single print server. That compression is the actual headline, more than any single vendor's CVE count -- and it doesn't require the 'autonomous agent' debate above to be settled in either direction to be true.

For PaperCut administrators, the practical instruction hasn't changed since August 27: apply Emergency Patch Release 3, confirm site servers and secondary print servers were patched alongside the primary application server -- PaperCut's own advisory specifically flags this as a step defenders skip -- and treat any internet-facing instance that wasn't patched before September 1 as potentially already compromised rather than merely exposed.

The bigger fact sits above any one vendor's patch cadence. This is one of the first widely documented cases of AI agents running an exploitation campaign end to end -- from reading the vulnerability research to writing the exploit to choosing which of 395 targets to hit next -- fast enough that the vendor's own two-day-old damage estimate was already an order of magnitude too small by the time outside researchers finished counting. The company whose product provided the execution harness has said nothing public about it as of publication. Neither has DeepSeek, whose model did the work Codex's own safety tuning wouldn't.