Hundreds of AI Agents Used to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide

The campaign represents a significant development in the use of AI for cyberattacks. Rather than using artificial intelligence simply to generate code or assist individual operators, the attackers deployed large numbers of AI-driven agents to automate reconnaissance, exploitation, credential theft and Active Directory attacks against exposed PaperCut systems.

Researchers at GreyNoise said the operation successfully compromised 440 PaperCut servers across 395 organizations in 48 countries. The campaign primarily targeted internet-facing PaperCut NG and MF installations and combined newly disclosed vulnerabilities with established Windows and Active Directory attack techniques. 

The activity follows the disclosure of two vulnerabilities in PaperCut NG and MF: CVE-2026-81578, an improper access-control flaw that can enable authentication bypass, and CVE-2026-82078, an unsafe dynamic class-loading vulnerability that can ultimately provide remote code execution. When chained together, the vulnerabilities can allow an unauthenticated attacker to gain control of an affected PaperCut server. 

Category	Details
Target	PaperCut NG / MF
Compromised servers	At least 440
Organizations affected	395
Countries	48
Primary vulnerabilities	CVE-2026-81578, CVE-2026-82078
AI infrastructure	Hundreds of autonomous AI agents
AI stack	OpenAI Codex harness and DeepSeek model
Confirmed domain-admin compromises	12
Most targeted sector	Education
Threat actor profile	Russian-speaking actor

Two PaperCut Vulnerabilities Form the Initial Access Chain

The campaign focused on two recently disclosed vulnerabilities affecting PaperCut NG and MF.

CVE-2026-81578 is an improper access-control vulnerability in the PaperCut web management interface. Under certain conditions, an unauthenticated attacker can cause administrative actions to be performed before authorization checks are properly completed.

CVE-2026-82078 affects PaperCut's database connection utilities. The flaw involves unsafe dynamic class loading, allowing attacker-controlled Java code to be executed through a malicious database-driver configuration.

Individually, the vulnerabilities are serious. When chained, they provide a path from unauthenticated access to remote code execution on the PaperCut Application Server. 

PaperCut responded with multiple emergency releases after exploitation was discovered. The vendor's third emergency release superseded the earlier emergency patches and added further hardening. 

How the AI-Driven Campaign Operated

The most notable aspect of the campaign was not simply the exploitation of PaperCut.

It was the scale at which the exploitation was automated.

According to GreyNoise, the threat actor used hundreds of AI agents built around an OpenAI Codex harness and a DeepSeek model. These agents were combined with conventional offensive-security tools and were capable of carrying out different stages of the attack against individual environments. 

The AI agents did not necessarily introduce completely new attack techniques. Instead, their value came from their ability to automate decision-making and coordinate established techniques at scale.

A simplified attack flow was:

Internet reconnaissance → PaperCut exploitation → Remote code execution → Credential discovery → Active Directory attacks → Privilege escalation → Domain compromise

This model allows an attacker to run numerous parallel attack workflows instead of requiring a human operator to manually handle each compromised system.

440 Servers Compromised Across 48 Countries

GreyNoise identified at least 440 compromised PaperCut instances belonging to 395 organizations.

The victims were distributed across 48 countries, demonstrating that the campaign was not restricted to a particular geographic region. 

Education was by far the largest affected sector.

Industry	Compromised Servers
Education	204
Other / Unclassified	51
Retail / Commercial / Professional Services	38
Real Estate / Coworking / Hospitality	29
IT / MSP / Print Resellers	25
Non-profit / Religious / Charity	21
Library / Archive	13
Manufacturing / Industrial / Energy / Utilities	13
Government / Public Sector	9
Healthcare / Social Care	8
Legal	8
Financial / Insurance	6

The concentration in education is particularly significant because PaperCut is widely deployed in schools, universities and other educational environments where print-management servers can be deeply integrated into Windows and Active Directory infrastructure.

AI Agents Moved Beyond Initial Exploitation

After obtaining control of a PaperCut server, the campaign did not simply stop at the initial compromise.

The agents attempted to identify credentials and secrets that could provide access to other systems.

GreyNoise observed multiple routes for moving from a compromised PaperCut server into the surrounding Active Directory environment. These included credential harvesting from LSASS memory and Windows registry secrets, followed by techniques such as pass-the-hash and pass-the-ticket. 

Where suitable credentials were not immediately available, the attackers could also rely on established Active Directory attack techniques involving tools such as Rubeus, Certipy and Impacket.

This combination allowed the AI-driven workflows to select different approaches depending on what was discovered on the compromised system.

Only a Small Fraction Reached Domain Administrator

Despite compromising hundreds of servers, the campaign did not achieve domain administrator privileges on every victim.

GreyNoise confirmed domain administrator access on 12 of the 440 compromised instances.

The time required to reach that level of access varied significantly, with successful escalation reportedly taking between five minutes and 144 minutes, depending on the environment and available credentials. 

The relatively small number of confirmed domain-admin compromises is an important reminder that AI-driven automation does not automatically translate into universal attack success.

However, the ability to attempt hundreds of attacks simultaneously changes the economics of exploitation.

An attacker can tolerate individual failures when an automated system can continuously test new targets and adapt its approach.

The AI Was an Accelerator, Not a Completely New Arsenal

The campaign illustrates an important distinction in the current AI threat landscape.

The attackers were not necessarily using an AI model to invent previously unknown exploitation techniques.

Instead, AI acted as an automation and orchestration layer over established offensive-security capabilities.

Tools and techniques observed in the campaign included:

• Mimikatz-style credential extraction
• LSASS memory access
• Windows registry credential harvesting
• Pass-the-hash
• Pass-the-ticket
• Rubeus
• Certipy
• Impacket
• Active Directory enumeration
• Domain privilege escalation

The significance comes from combining these capabilities with autonomous agents capable of evaluating results and choosing subsequent actions. 

Reconnaissance Infrastructure Was Active Before PaperCut Exploitation

GreyNoise traced the campaign's infrastructure to the IP address 45.142.193.132, which had been observed conducting reconnaissance against internet-facing systems since early July 2026.

Before focusing on PaperCut, the infrastructure was reportedly probing products from vendors including Palo Alto Networks, Ubiquiti, Citrix, SonicWall and Proxmox VE.

The infrastructure later shifted toward PaperCut targets, indicating that the operation was capable of changing its targeting priorities as new opportunities became available. 

PaperCut Servers Are Valuable Network Targets

PaperCut servers can represent an attractive foothold because they frequently operate inside trusted enterprise environments.

In many Windows deployments, PaperCut services can run with high privileges, while the server may also be joined to an organization's Active Directory environment.

That creates an opportunity for attackers to move from a specialized application server toward broader corporate infrastructure.

The risk is therefore not limited to unauthorized printing or compromise of the PaperCut application itself.

A successful attacker may potentially use the server as a stepping stone for:

• Credential theft
• Active Directory reconnaissance
• Lateral movement
• Privilege escalation
• Domain compromise
• Deployment of additional malware
• Access to sensitive organizational information

PaperCut Exploitation Was Already Being Observed

The AI-driven campaign follows active exploitation of the PaperCut vulnerabilities in the wild.

Huntress previously observed attackers exploiting the vulnerabilities to execute commands on compromised systems. Observed activity included commands used to identify the logged-in account and Windows version, along with Java class files capable of running commands on Windows and Linux systems. 

PaperCut itself said the August 2026 incident involved an authentication bypass followed by a complex exploit chain leading to remote code execution. The company also warned customers to remove internet-facing Application Servers from public exposure and apply emergency mitigations.

What Organizations Should Do

Organizations running PaperCut NG or MF should treat internet-facing instances as a high-priority security concern.

Recommended actions include:

Apply the latest PaperCut emergency release

Organizations should ensure they are running the latest security release rather than relying on an earlier emergency patch. PaperCut's third emergency release superseded the previous emergency releases. 

Remove unnecessary internet exposure

Where possible, PaperCut Application Servers should not be directly accessible from the public internet. Access can instead be restricted to trusted networks, VPNs or controlled administrative paths. 

Hunt for exploitation indicators

Security teams should review PaperCut logs for suspicious database connection activity, unusual Java class files and unexpected command execution.

Investigate Active Directory activity

If a PaperCut server was exposed while vulnerable, organizations should investigate credential access, Kerberos activity, lateral movement and unexpected authentication events.

Review privileged accounts

Determine whether administrators or other privileged users authenticated to compromised PaperCut servers and investigate whether their credentials may have been exposed.

Monitor outbound activity

Unexpected connections from PaperCut servers to external infrastructure should be investigated, particularly when they occur alongside suspicious process execution.

Why AI-Driven Exploitation Changes the Threat Model

Traditional mass exploitation often relies on predefined scripts.

An automated scanner finds a vulnerable service, sends a known exploit and records whether it succeeds.

AI agents introduce another layer of flexibility.

An agent can potentially:

1. Identify a target.
2. Determine which attack path is applicable.
3. Execute an initial technique.
4. Analyze the result.
5. Select another technique if the first attempt fails.
6. Enumerate the newly compromised environment.
7. Search for credentials.
8. Attempt privilege escalation.
9. Continue until the available attack paths are exhausted.

At hundreds of simultaneous targets, even modest success rates can produce substantial numbers of compromises.

This makes rapid patching increasingly important. Defenders may no longer be dealing with attackers who need to manually scale every stage of an intrusion.

Detection and Threat Hunting Priorities

Security teams should pay particular attention to PaperCut servers that were publicly exposed during the exploitation window.

Useful hunting areas include:

• Unexpected child processes launched by PaperCut services
• Java class files appearing in PaperCut directories
• Suspicious database connection strings
• Commands used to enumerate users or operating-system versions
• LSASS access from unexpected processes
• Credential-dumping activity
• Rubeus or Certipy execution
• Abnormal Kerberos ticket activity
• Pass-the-hash authentication
• Pass-the-ticket behavior
• New administrative accounts
• Unexpected connections to domain controllers
• Unusual outbound network connections
• Remote-access software installed after compromise

PaperCut and security researchers have previously published indicators associated with exploitation, including suspicious database errors, unexpected .class files and command execution artifacts. 

The Bigger Security Lesson

The PaperCut campaign demonstrates that the most important change introduced by AI-assisted attacks may not be the discovery of entirely new vulnerabilities.

It may be scale.

A human attacker can compromise one system, investigate it and decide what to do next. Hundreds of autonomous agents can perform similar workflows against hundreds of targets in parallel.

That means organizations should increasingly assume that vulnerable internet-facing systems can be discovered, exploited and investigated at machine speed.

The defensive response must therefore emphasize rapid vulnerability remediation, strong network segmentation, least privilege, credential protection and continuous monitoring.

Conclusion

The compromise of 440 PaperCut servers across 395 organizations in 48 countries demonstrates how AI-assisted automation can amplify the impact of conventional vulnerabilities.

The campaign combined CVE-2026-81578 and CVE-2026-82078 to gain initial access and remote code execution, before using established credential-theft and Active Directory techniques to pursue deeper access. 

The use of hundreds of AI agents is the most notable aspect of the operation. While the underlying attack techniques were largely familiar, AI enabled them to be executed and adapted across a large number of environments.

For organizations running PaperCut NG or MF, the immediate priority is to apply the latest security release, eliminate unnecessary public exposure and investigate potentially compromised servers for credential theft and lateral movement.

The incident also provides a broader warning: as autonomous AI agents become more capable, attackers can increasingly turn individual vulnerabilities into scalable, semi-autonomous intrusion campaigns.