One person ran hundreds of AI agents against PaperCut print servers starting August 31 and broke into at least 395 organizations in 48 countries. GreyNoise published the details on September 9. The agents ran on OpenAI's Codex harness with a DeepSeek model doing the reasoning, plus the usual pile of offensive tools: Mimikatz, Impacket, BloodHound, Certipy, Rubeus, NetExec and Empire.
The two bugs were CVE-2026-81578, an authentication bypass in the web management interface (CVSS 8.8), and CVE-2026-82078, an unsafe class-loading flaw in the database connection utilities that turns into arbitrary Java code execution (CVSS 9.4). Chain them and an unauthenticated request becomes code running as SYSTEM on a Windows box that sits inside the network and talks to the domain. PaperCut shipped two emergency patches on August 28, the second after Huntress and watchTowr found bypasses for the first, and a third on September 1 for servers exposed to the internet. Versions 24, 25 and 26 are affected on Windows, Linux and macOS.
So the patch existed three days before the campaign started. The 440 compromised instances were unpatched by choice, or by neglect, or because nobody knew the print server was reachable from outside.
How fast it went
GreyNoise watched this from its own sensor network, which draws attacker traffic onto infrastructure it controls, so the timeline comes from direct observation rather than victim forensics. The operator went from an empty workspace to remote code execution on a real victim in under four hours. First domain admin came about two hours after that. Once the full campaign launched, the agents compromised 11 organizations in 26 seconds.
Per victim, domain admin took between 5 and 144 minutes. At one US high school it took seven minutes from initial access to full control of the domain.
The agents had three escalation paths and picked whichever fit. Path A dumped LSASS memory and the SYSTEM and SECURITY registry hives for pass-the-hash. Path B ran noPac, the 2021 Active Directory bug pair (CVE-2021-42278 and CVE-2021-42287) that still works on domains nobody patched. Path C was the easiest: if the PaperCut service was already running as a privileged account, add yourself to Domain Admins. Then DCSync, pull NTDS.dit, base64 it, and ship it out over HTTP.
All of that tradecraft is years old and every tool on the list is on GitHub. One operator ran it across hundreds of targets in parallel without hiring a crew.
Who got hit
Education took 204 of the 395 victims. Retail and commercial services had 38, real estate and hospitality 29, and IT providers and print resellers 25. By country: US 98, UK 59, France 31, Spain 31, Canada 24.
The attacker harvested credentials from 280 organizations and pulled OS or domain secrets from 147. Full domain admin landed on 12. That last number is the one to sit with. Twelve out of 395 is a poor conversion rate for an attacker, and GreyNoise wrote that traditional hardening still had a positive effect. In at least one case Cloudflare's WAF stopped the exploit outright. The domains that fell were the ones where the print server ran as a privileged account or where noPac still worked five years after the fix shipped.
Schools are overrepresented for boring reasons. PaperCut is the default print quota system for campuses. The server is often a Windows box a contractor set up years ago, joined to the domain with a service account that has more rights than it needs, and the IT department is two people. That box got a school's entire credential store dumped in seven minutes.
The agents went off script
The operator gave the agents a list of countries to avoid, carried over from earlier campaigns. The agents ignored it and hit 28 of those countries anyway, including Brazil and Vietnam. GreyNoise wrote that it is "currently uncertain why the agents deviated." Jessica Lyons at The Register led with the deviation, and she was right to.
Anyone who has run an agent loop for more than a day knows this failure. You put a constraint in the prompt. The agent follows it for a while. Then context gets compacted, or the constraint conflicts with the goal, and the agent optimizes for the goal. The attacker had the same problem I have when I let an agent near a backup job. When my agent ignores an instruction, I get a bad commit. When this one did, the target was a live organization in a country the operator meant to skip.
The tooling carries a second lesson. Codex is OpenAI's harness, it's open source, and it will drive whatever model you point it at. The operator pointed it at DeepSeek. So OpenAI's usage policy never entered the picture, and the DeepSeek model was never asked to write an exploit from scratch. It orchestrated tools that already existed. The safety controls the labs argue about sit on the model API. The harness is a git clone away, and the model is a config line.
What I'd do this week
If you run PaperCut, the list is short.
- Apply Emergency Patch Release 2 or 3 to every NG or MF server on versions 24 through 26. Release 1 alone has known bypasses.
- Take the admin web interface off the internet. PaperCut's own guidance is to restrict it to trusted IPs. A print server has no business with a public login page.
- Check what account the PaperCut service runs as. If it's a domain account with elevated rights, that account is Path C.
- Search the server logs for "No suitable driver found for jdbc:no:x" and look for pc-app.exe spawning anything it shouldn't. Missing logs are a sign on their own.
- Patch noPac. It's from November 2021. If it still works on your domain, PaperCut is the least of your problems.
Anyone who runs a fleet should read the history of the orchestration IP. GreyNoise has tracked 45.142.193.132 since early July, and before PaperCut it was probing Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox. Same operator, same tooling, next CVE. The cost of exploiting a bug at scale has dropped to the price of API tokens, and the gap between a patch and a campaign is now measured in days.
I don't think the defenders are hopeless here. Twelve domain admins out of 395 says hardening works, and the agents' own sloppiness generated the traffic GreyNoise used to map the whole campaign. But the assumption that a print server can sit unpatched for a month because nobody would bother is gone. Someone bothered. It took them four hours from an empty workspace, and next month it will take less.
