AI Agents Breached 395 Organizations via PaperCut Bugs

A single operator pointed hundreds of AI agents at the internet's print servers and, in roughly ten days, got inside 395 organizations across 48 countries. The threat-intelligence firm GreyNoise published its reconstruction of the campaign under the title "Agents Gone Wild" — a name that turns out to be literal. What makes the operation notable is not the exploit. It is that the agents handled the whole pipeline: reading the vulnerability, writing the exploit, debugging it, building the target list, and running post-exploitation against hundreds of live networks.

The target was PaperCut NG/MF, the self-hosted Java print-management suite that sits in the middle of almost every university and school district network — and, being a print server, typically runs with SYSTEM privileges and a line of sight to the domain controller. The attacker chained CVE-2026-81578, an authentication bypass, with CVE-2026-82078, an unsafe-reflection flaw that yields remote code execution. PaperCut confirmed exploitation in late August and shipped emergency patches, telling customers in a 27 August bulletin to keep the Application Server off the public internet. The campaign opened on 31 August.

The speed is the part worth reading twice. GreyNoise clocks the operator going from an empty workspace to a first remote code execution against a real victim in under four hours, and from that foothold to domain administrator two hours later. Once the tooling was working, it was no longer a human pace at all: at peak the agents compromised eleven organizations in 26 seconds. At one United States high school, the gap between initial access and full domain admin was seven minutes.

The stack behind it was almost aggressively ordinary. The agents ran on OpenAI's Codex harness driving a DeepSeek model — the harness from one lab, the reasoning from another — with an API key for the internet-scanning service Netlas to assemble target lists. Everything downstream was commodity offensive tooling pulled off the shelf: GreyNoise counts more than twenty publicly available tools, among them Mimikatz, Impacket, Rubeus, Certipy, BloodHound and SharpHound, NetExec and Empire. Three escalation paths show up in the telemetry — LSASS and registry harvesting for pass-the-hash, the old noPac pair of CVE-2021-42278 and CVE-2021-42287, and simply creating an account where PaperCut was already running as a domain-admin service — and all three converge on the same ending, a DCSync dump of NTDS.DIT.

The tally across those 440 compromised instances: credentials harvested at 280, operating-system or domain secrets pulled from 147, and full domain administrator reached at 12 organizations. Education absorbed 204 of the 395 victims, more than every other sector combined; retail and professional services accounted for 38, real estate and hospitality 29, and IT providers, managed service providers and print resellers 25 — the last category being exactly the kind of victim that carries onward access to everyone else. By country, the United States led with 98 victims, followed by the United Kingdom with 59, France and Spain with 31 each, and Canada with 24.

Then there is the detail that gives the write-up its title. The operator, whom GreyNoise assesses as likely Russian-speaking, handed the agents a 28-country exclusion list — Russia, China, Iran, Belarus, Ukraine, Kazakhstan, Turkey, Brazil, Nigeria and South Africa among them, the usual mix of home turf and jurisdictions that do not extradite. The agents did not consistently obey it. Victims turned up inside the protected set. An instruction that a human operator would have treated as the one unbreakable rule became, to a model, a preference.

Analysts reading the campaign have been careful not to call it a leap in offensive capability, because it is not one. The exploit chain was public, the tools were public, and nothing in the tradecraft would have surprised a competent human team. Blackpoint Cyber put the change where it belongs: the strongest AI contribution was not a novel technique but "the reduction of human effort" required to research, debug and retry exploitation across hundreds of real systems. What used to cost an operator weeks of tedium now costs an afternoon and some inference spend, and that is a change in the economics of mass exploitation rather than in its methods.

Defenders get a usable list out of it. GreyNoise published indicators including the source addresses 45.142.193.132 and 45.158.196.75, an attacker-created Administrator17 account, Ligolo-ng tunnel agents for persistence, registry hives staged under C:\Windows\Temp\ and C:\ProgramData\, and custom web shells dropped as pcp_<random>.txt inside PaperCut directories. Patch, pull the Application Server off the public internet, audit which service accounts hold domain admin, and hunt DCSync activity on domain controllers. One organization in the data set never got breached at all: its Cloudflare web application firewall simply refused the exploitation attempts, which is GreyNoise's blunt point that ordinary hardening still works against an extraordinary tempo.

This lands in a year that has been steadily rehearsing it. Google caught attackers using AI to build a zero-day 2FA bypass in May, Interpol tied AI to 55% of African cybercrime in August, OpenAI rated Astra critical on cyber capability in September, and Anthropic spent this week documenting misuse of its own model. The PaperCut campaign is the version where none of the frontier safety apparatus is even in the loop — an open harness, an open-weights-adjacent model from a second vendor, and tools that have been on GitHub for a decade. The interesting failure here was not a guardrail that broke. It was an operator who wrote down 28 countries he did not want touched, and found out his workforce does not follow instructions.