AI Agents Orchestrate Mass Exploitation of PaperCut Servers
Hundreds of AI agents, including OpenAI's Codex and DeepSeek, were used to rapidly exploit two PaperCut vulnerabilities, compromising over 440 servers globally and highlighting the growing threat of AI-assisted cyberattacks.
A sophisticated cybercrime campaign has leveraged hundreds of AI agents to exploit vulnerabilities in PaperCut NG and MF print-management servers, leading to the compromise of at least 440 instances across 395 organizations in 48 countries. The operation, detailed by GreyNoise, combined OpenAI's Codex coding-agent harness with a DeepSeek model and standard security tools, enabling attackers to rapidly develop, test, and deploy exploits against internet-facing systems.
The campaign's effectiveness stemmed from its ability to automate and accelerate the intrusion lifecycle. Researchers at Hunt.io uncovered exposed attacker directories containing detailed agent instructions, exploit code, logs, and credential-harvesting tools. These materials revealed an iterative and automated process where the AI agents were directed to continuously test, adapt their approaches after failures, and manage multiple tasks concurrently. This approach allowed the operator to move swiftly from initial testing to achieving domain administrator access and compromising internal networks.
The primary attack vector exploited two critical PaperCut vulnerabilities: CVE-2026-81578, which allows unauthenticated requests to modify certain server settings, and CVE-2026-82078, an unsafe class-loading flaw that enables remote code execution when combined with the ability to alter those settings. The synergy between these two flaws provided a clear path for attackers to gain initial access and escalate privileges.
According to GreyNoise, the malicious activity began on August 31, 2026, with the attacker using a self-hosted lab to refine the exploit. Within four hours of reaching the first real target, the attackers achieved domain administrator access. Once the broader operation commenced, they managed to compromise 11 organizations in a mere 26 seconds, showcasing an unprecedented speed of exploitation.
Beyond initial access, the attackers utilized tools to collect Windows registry data and service credentials, and deployed scripts to establish reverse SOCKS tunnels. These tunnels allowed them to route traffic through the compromised print servers, enabling access to internal network resources. The exposed files also indicated efforts to automate post-exploitation activities and package compromised system information for future access.
PaperCut has identified its current security maintenance releases as versions 26.0.5, 25.0.13, and 24.1.10, urging organizations to consult their advisories for proper upgrade procedures. Beyond patching, PaperCut recommends limiting public access to its management interfaces, restricting the XML-RPC API, enforcing strong authentication, and implementing network allowlists. Defenders are also advised to scrutinize logs and endpoint alerts for any signs of suspicious activity.
Hunt.io's analysis further suggests that administrators should look for unusual modifications to user-lookup.* settings, unexpected files in the custom/web/ directory, anomalous child processes, and evidence of chisel-based tunnels or cron persistence. The urgency to investigate extends beyond patching, as a fix only prevents further exploitation of known flaws, not the presence of an already established intruder. Post-exploitation activity to investigate includes unexpected accounts, privilege escalations, credential theft, unusual outbound connections, and signs of access to Active Directory.
This campaign underscores a significant shift in the threat landscape, where AI agents are not just tools for defenders but are actively being weaponized by malicious actors. The ability of AI to accelerate exploit development, automate complex intrusion steps, and operate at scale presents a formidable challenge for cybersecurity professionals worldwide.