The short answer
A single threat actor used hundreds of AI agents to weaponize two PaperCut NG/MF zero-days and mass-exploit them at machine speed — compromising more than 440 servers across 395 organizations in 48 countries. The agents, built around OpenAI’s Codex harness and a DeepSeek model plus standard offensive tools, turned vulnerability research into working, deployable exploits for CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution). The flaws were disclosed August 27, 2026 and patched the next day; the campaign was compromising real victims within hours, and 11 organizations fell inside 26 seconds of launch.
The practical reading: AI agents did not invent a new vulnerability class — they collapsed the timeline. What used to take a skilled team days now takes one operator hours, so the window to patch calmly is effectively gone. The durable defense is realistic, automation-driven penetration testing and security audits that assume attackers move at machine speed, backed by an emergency patch cadence for anything internet-reachable.
What happened with PaperCut
PaperCut NG/MF is print-management software that runs on tens of thousands of networks — schools, hospitals, retailers, government agencies — usually as a quiet internal server nobody thinks about. On August 27, 2026, two vulnerabilities in it were disclosed as zero-days: CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution flaw. Chained, they let an unauthenticated attacker take full control of the server. PaperCut shipped an emergency patch the following day, August 28.
What makes this incident notable is not the bugs but who exploited them and how fast. Threat-intelligence teams at Blackpoint Cyber, GreyNoise and Arctic Wolf reported in early September that a single Russian-speaking operator had turned the freshly disclosed flaws into a global mass-exploitation campaign, compromising more than 440 PaperCut deployments belonging to 395 organizations across 48 countries, including the U.S., U.K., France, Spain, Germany, Canada, Belgium, Portugal, Australia and Switzerland. The education sector took the brunt, with 204 victims, followed by retail and professional services, real estate and hospitality, IT and managed-service providers, non-profits, libraries, and manufacturing and utilities.
The operator did not do this by hand. According to the researchers, they orchestrated hundreds of AI agents — built around OpenAI’s Codex harness and a DeepSeek model, wired to off-the-shelf offensive tooling like Mimikatz, SharpHound, Certipy, Rubeus and Impacket — to handle the research, exploitation, and post-compromise work in parallel. That agentic orchestration layer is where custom AI-agent engineering stops being a productivity story and becomes a threat model: the same patterns teams use to automate legitimate workflows were pointed at vulnerable infrastructure.
How AI agents ran the campaign
Strip out the marketing gloss around “AI-powered attacks” and the mechanics are concrete. The operator used large-language-model agents to compress the whole exploitation lifecycle: read the advisory, understand the vulnerable code path, write and refine a proof of concept, wrap it in a multi-threaded validation tool, scan the internet for exposed instances, and then run the exploit-and-pivot playbook against everything it found. Each of those steps was previously a human bottleneck; agents removed the bottleneck by running them concurrently and around the clock.
The timeline the researchers reconstructed is the part worth memorizing. Vulnerability research reportedly began around August 31, 2026 and was turned into a working, multi-threaded validation tool within hours, with initial compromise against real victims achieved in under four hours. Once the campaign launched in earnest, 11 organizations were compromised within 26 seconds. At one high school, the attacker went from first access to domain administrator in seven minutes. Across the campaign, credentials were harvested from roughly 280 hosts, secrets were exfiltrated from 137, and full domain-admin control was reached at 12 organizations — a reminder that a “print server” was only the entry point, not the objective.
It is worth being precise about what the AI did and did not do. It did not discover an unknown vulnerability or defeat a patch; the flaws were public and a fix existed within 24 hours. What the agents provided was throughput and speed: the ability to turn a public advisory into a mass-deployed weapon, and to exploit the lag between “patch available” and “patch applied” across thousands of organizations at once. The operator even ran an exclusion list of roughly 28 countries — including Russia, China, Iran and Venezuela — the kind of targeting logic that agent tooling makes trivial to enforce at scale.
What it means for US & EU software teams
First, the patch window is now measured in hours. The old mental model — a critical CVE lands, you triage it this week, patch it next maintenance window — assumed a human adversary who also needed days to build a reliable exploit. That assumption is dead. When a fresh advisory can be weaponized and mass-deployed inside a morning, your exposure is defined by how fast you can find and patch the affected asset, not by how severe the CVE looks on paper. Rapid asset inventory and emergency-change discipline are now front-line security controls, not IT hygiene.
Second, your boring internal tools are the target. Nobody threat-models the print server, the wiki, the license manager, or the self-hosted CI runner — yet those are exactly the systems that sit on trusted networks, run with broad privileges, and rarely get patched on the same cadence as customer-facing apps. PaperCut was a foothold that led to domain admin at a dozen organizations. Treat administrative and infrastructure software as production-critical attack surface, keep it off untrusted networks, and include it in scope when you test.
Third, defenders have to adopt the same tooling. If attackers use agents to validate exploits across your entire external footprint in hours, point-in-time annual pen tests and manual patch triage cannot keep pace. The realistic answer is automation on the defensive side too: continuous exposure discovery, adversary-realistic testing that assumes machine-speed exploitation, and AI-assisted triage that ranks what to patch first. For EU teams, this also sharpens regulatory expectations — NIS2 and DORA both assume rapid detection, patching, and incident response, and “we couldn’t patch fast enough” is not a defense a regulator will accept when the exploitation timeline is public.
What to do now
- Patch PaperCut NG/MF immediately. If you run it, move to a version that fixes CVE-2026-81578 and CVE-2026-82078 without waiting for a maintenance window — and confirm the server is not reachable from untrusted networks.
- Assume compromise on exposed instances. Any internet-reachable PaperCut that was unpatched between Aug 27 and your upgrade should be treated as breached: hunt for credential dumping, new accounts, and domain-admin escalation, not just for the missing patch.
- Shrink the patch window everywhere. Build the muscle to inventory affected assets and ship emergency patches in hours. Measure your real mean-time-to-patch for a critical CVE and drive it down — that number is now your risk exposure.
- Get infrastructure tools off trusted-by-default networks. Print servers, license managers, wikis, self-hosted CI, and admin panels should be segmented, behind a VPN or zero-trust proxy, and least-privileged — not flat-networked because “they’re internal.”
- Test the way attackers now attack. Add administrative and infrastructure systems to scope and run automation-driven, adversary-realistic penetration testing that models machine-speed exploitation, not a calm week of manual poking.
Frequently asked questions
What happened in the PaperCut AI-agent attack?
A single Russian-speaking threat actor used hundreds of AI agents — built around OpenAI’s Codex harness and a DeepSeek model plus off-the-shelf offensive tools like Mimikatz, SharpHound, Certipy, Rubeus and Impacket — to research, build, test, and deploy exploits for two PaperCut NG/MF zero-days. Reported by Blackpoint Cyber, GreyNoise and Arctic Wolf in early September 2026, the campaign compromised more than 440 servers belonging to 395 organizations across 48 countries.
Which PaperCut vulnerabilities were exploited?
Two flaws in PaperCut NG/MF: CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution flaw. Chained, they let an unauthenticated attacker take over the server. Both were disclosed as zero-days on August 27, 2026, with an emergency patch released the next day. Any pre-patch, internet-reachable instance should be treated as exposed and patched now.
How fast was the attack?
Vulnerability research reportedly began around August 31, 2026 and became a working, multi-threaded validation tool within hours, with initial compromise in under four hours. Once the campaign launched, 11 organizations were compromised within 26 seconds, and one high school went from access to domain administrator in seven minutes. The collapse of the disclosure-to-exploitation window from weeks to hours is the defining feature of AI-orchestrated attacks.
What was the impact on victims?
Of the 440-plus compromised deployments, 204 were in the education sector, with dozens more across retail and professional services, real estate and hospitality, IT and managed services, non-profits, libraries, and manufacturing and utilities. The attacker harvested credentials from about 280 hosts, exfiltrated secrets from 137, and reached domain administrator at 12 organizations — full control of the victim’s Windows environment, not just the print server.
Did the AI find a new vulnerability?
No. The flaws were already public and a patch existed within 24 hours. The AI agents provided throughput and speed — turning a public advisory into a mass-deployed exploit and racing the gap between “patch available” and “patch applied” across thousands of organizations at once. That is why the primary defense is faster patching and network segmentation, not a novel technical control.
Sources
The Hacker News — PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
SecurityWeek — PaperCut Flaws Exploited in AI-Powered Attacks