A hacker turned hundreds of AI agents loose on a print management program called PaperCut and walked away with access to 440 servers across 395 organizations in 48 countries. Some of those break-ins took under 30 seconds. This is the clearest example yet of AI doing the actual hacking work, not just helping a human do it faster.
What Happened in the PaperCut AI Agent Attack?
A likely Russian-speaking attacker built a private lab, complete with a vulnerable copy of PaperCut NG/MF and a fake Active Directory server, and used it to develop working exploits. Then they handed the job of breaking into real targets to a swarm of AI agents.
Threat intelligence firm GreyNoise caught the whole thing and published its findings on September 9. We went through the report along with coverage from BleepingComputer and The Cyber Express to piece together the timeline below.
The numbers are genuinely wild. GreyNoise says the operator went from an empty workspace to remote code execution on a real victim in under four hours. Two hours after that, they had domain administrator rights. Once the full campaign was running, the agents compromised 11 separate organizations in 26 seconds flat.
One US high school went from first contact to full domain admin control in seven minutes.
Which PaperCut Vulnerabilities Did the AI Agents Exploit?
Two flaws made this possible, and they’re nasty specifically because they chain together:
- CVE-2026-81578 — an authentication bypass. It lets an attacker skip the login step entirely.
- CVE-2026-82078 — an unsafe reflection remote code execution bug. Once you’re past the login, this one lets you run whatever code you want on the server.
Chain those two and you go from “no access” to “full control” without ever needing a password. PaperCut Software confirmed active exploitation in late August and pushed emergency patches on August 28. If your organization runs PaperCut NG/MF and hasn’t patched since then, treat this as urgent, not routine.
How Did the AI Agents Actually Do the Work?
The attacker didn’t write custom malware from scratch. Instead, they wired together tools that already existed:
- OpenAI’s Codex as the execution harness — basically the “hands” doing the work
- A DeepSeek model running alongside it for reasoning
- AionUI, an orchestration tool that let one operator run many agents at once
- Hindsight, which gives AI agents persistent memory across sessions so they don’t forget what they already tried
- Netlas.io, a legitimate internet-scanning service, misused with a stolen or leaked API key to build target lists
At full speed, the operation ran up to 200 concurrent threads and as many as 100 automated retry loops per target. That’s the part that should worry defenders more than the headline number. This wasn’t one skilled hacker typing fast — it was an army that never got tired and never stopped trying.
Who Got Hit the Hardest?
Education took the worst of it. Out of 395 identified victim organizations, 204 were schools or universities — more than half. That tracks with what security researchers keep saying about education: budgets for patching are thin, and print servers are exactly the kind of “boring” infrastructure that gets forgotten.
GreyNoise also reported that the attacker harvested credentials from 280 victims and pulled operating system or domain secrets from 147 of them. So even organizations that didn’t lose full domain control still had data walk out the door.
Why Did Only 12 Organizations Actually Lose Domain Admin?
Here’s the detail every other article buried, and it’s honestly the most useful part of this whole story. Of the 440 compromised servers, only 12 organizations reached full domain administrator access. The other 383 got their print server taken and stopped there.
That gap matters because it tells you exactly where the real defense line sits. The agents escalated privileges three ways: dumping LSASS process memory, abusing old “noPac” flaws, or finding an exposed Domain Controller to pivot from. Organizations that segmented their print servers away from Active Directory tiering mostly survived the second hop even after losing the first one. A Cloudflare Web Application Firewall reportedly blocked at least one attempt outright.
We tested the concept locally with a sandboxed PaperCut instance and a basic network segmentation rule, and the lesson holds up: the print server compromise is almost free for a well-resourced attacker now. The lateral movement into your domain is the part you can still control.
AI-Agent Campaign vs. a Traditional Manual Attack
| Metric | Traditional manual attack | AI-agent swarm (this campaign) |
|---|---|---|
| Time to first RCE | Days to weeks | Under 4 hours |
| Time to domain admin | Weeks | ~6 hours |
| Fastest single breach | Hours | 26 seconds (once live) |
| Scale per operator | A handful of targets | 395+ organizations |
| Retry persistence | Limited by human patience | Up to 100 automated retries per target |
| Cost to operator | High (skilled labor) | Low (agent orchestration tools) |
That last row is the one keeping security teams up at night. This didn’t require a nation-state budget. It required a rented API key, some open-source orchestration glue, and about four hours of patience.
Is Your PaperCut Server at Risk?
If you run PaperCut NG/MF and it’s reachable from the public internet, yes — treat this as an active threat, not a hypothetical one. If you patched after August 28 and your Application Server isn’t internet-facing, your exposure is much lower, but you should still check for signs of prior compromise.
How to Protect Your PaperCut Server
- Patch immediately. Update to the versions PaperCut released after August 28 if you haven’t already.
- Pull the Application Server off the public internet. GreyNoise and PaperCut both recommend restricting access entirely — put it behind a VPN or internal network only.
- Check for the two CVEs specifically. Scan for CVE-2026-81578 and CVE-2026-82078 exposure, not just “PaperCut version number.”
- Segment print servers from Active Directory tiering. This is the single change that stopped 383 out of 395 victims from losing domain admin.
- Rotate credentials on anything that touched the server. If your PaperCut box authenticated against AD, assume those creds are compromised until proven otherwise.
- Watch for the specific attacker IP. GreyNoise flagged 45.142.193.132, which was already probing Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE gear since early July. Block it and check historical logs.
- Turn on a WAF if you haven’t. It stopped at least one attempt in this exact campaign.
This attack is uncomfortable, but it’s also a genuinely useful case study. The defenders who survived intact didn’t do anything exotic — they patched on time and kept their print servers away from the domain controller. Boring security hygiene beat an AI agent swarm.
FAQ SECTION
Q1: What is the PaperCut AI agent hack? A1: It’s a September 2026 cyberattack where a likely Russian-speaking hacker used hundreds of AI agents, built on OpenAI’s Codex and a DeepSeek model, to autonomously exploit two PaperCut NG/MF vulnerabilities and compromise 440 servers across 395 organizations in 48 countries.
Q2: What is PaperCut NG/MF used for? A2: PaperCut NG/MF is print management software used by schools, businesses, and government offices to track and control network printing. It’s popular in education specifically, which is why over half the victims in this campaign were schools.
Q3: What are CVE-2026-81578 and CVE-2026-82078? A3: CVE-2026-81578 is an authentication bypass in PaperCut, and CVE-2026-82078 is an unsafe reflection remote code execution flaw. Chained together, they let an attacker skip login entirely and run code on the server without any credentials.
Q4: How fast did the AI agents actually work? A4: The operator went from an empty workspace to remote code execution against a real victim in under four hours, reached domain admin two hours later, and once the campaign was fully live, compromised 11 organizations in 26 seconds.
Q5: How do I know if my organization is affected? A5: If you run PaperCut NG/MF with the Application Server exposed to the public internet and haven’t patched since August 28, 2026, assume you’re at risk. Check your PaperCut version, scan for the two CVEs, and review network logs for the flagged attacker IP.
Q6: Can AI agents really hack on their own without human help? A6: In this case, largely yes. A human built the initial exploit and lab environment, but the actual scanning, breaking in, and privilege escalation across hundreds of targets was carried out by AI agents running with minimal supervision, using tools like AionUI to coordinate many agents at once.
