PaperCut Attack: AI Swarm Breached 11 Orgs in 26 Seconds

A Russian-speaking attacker used OpenAI Codex and DeepSeek AI agents to exploit PaperCut NG/MF flaws, breaching 395 organizations in 48 countries.

A single Russian-speaking threat actor ran a swarm of AI agents, built on an OpenAI Codex harness paired with a DeepSeek model, to autonomously exploit two vulnerabilities in PaperCut NG/MF print management software. The campaign compromised at least 440 PaperCut instances across 395 organizations in 48 countries. At its fastest, the automation breached 11 organizations in 26 seconds once it was set loose.

Sources: Help Net Security, The Hacker News

The two CVEs and the agent stack behind them

The attacker chained two flaws in PaperCut NG/MF: CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution bug. Neither vulnerability required the AI agents to invent anything new technically. Their job was to find internet-exposed PaperCut instances, chain the two CVEs automatically, and then keep moving through each victim network with minimal direction from the human operator.

Sources: The Hacker News, Help Net Security

The full toolchain, end to end

• OpenAI Codex harness: drove the core agentic reasoning and exploit execution against each target
• DeepSeek model: ran alongside Codex inside the same orchestration layer
• Netlas.io: internet-wide scanning used to find exposed PaperCut instances
• Mimikatz, Rubeus, and Impacket: credential and Kerberos ticket theft after initial access
• SharpHound and Certipy: Active Directory and certificate-service enumeration to map a path to domain admin
• Hindsight and AionUi: a persistent memory service and a graphical workspace that let the operator coordinate agents across sessions

Why this was possible now

Each individual piece of this campaign already existed. Credential-theft tools like Mimikatz and Rubeus have been standard in penetration testing and real intrusions for years, and PaperCut vulnerabilities have been targeted by human operators before. What changed is the coordination layer. An agentic coding harness like Codex, paired with a capable model such as DeepSeek, can read a vulnerability advisory, write the exploit code, run it, interpret the result, and decide the next action against a specific target, in a loop, without a person approving each step. That loop is what let one operator run the same attack chain against hundreds of victims in parallel instead of one at a time.

None of the individual components required building new AI. Codex and DeepSeek are general-purpose coding models, sold and marketed for writing and debugging software, not for intrusion. The offensive capability came from the harness and the operator's instructions wrapped around them: point a capable coding agent at a target, give it a toolkit of known exploits and post-exploitation utilities, and let it iterate for hours without checking in. That is the same operational pattern security researchers have been warning about since agentic coding tools became reliable enough to run unattended.

How the campaign was built and eventually spotted

The attacker reportedly built and tested the exploits in a private lab environment before turning the agents loose on real targets, rather than developing them live against victims. The Hacker News reported that tracking of the actor's infrastructure, including the IP address 45.142.193[.]132, had been underway since early July 2026, though the earliest recovered attack activity against a real victim dates to August 31. The findings became public on September 11, 2026, when Help Net Security and The Hacker News both published details attributed to the security research firm GreyNoise, which had been monitoring the campaign. A gap of just eleven days between the earliest recovered real-victim activity and public disclosure is itself a reminder that even a closely watched campaign takes days to fully surface, while the compromise inside that window happens in minutes.

Sources: The Hacker News, Help Net Security

How fast the compromise moved

In the fastest documented run, the swarm went from an empty workspace to remote code execution against a real target in under four hours. The speed compounded from there: once an agent had a foothold, reaching domain administrator rights took as little as five minutes and never took longer than 144 minutes across the twelve organizations where it happened at all. One U.S. high school went from initial access to domain admin control in seven minutes.

Sources: Help Net Security, The Hacker News

Where the campaign landed

Education absorbed the heaviest damage: 204 of the 395 identified victim organizations were schools, colleges, or districts, with retail, professional services, and hospitality following behind. The United States led the country count with 98 confirmed victims, ahead of the United Kingdom, France, Spain, and Canada, with further victims turning up in Belgium, Portugal, Australia, Germany, and Switzerland.

Sources: Help Net Security, The Hacker News

The attacker had reportedly configured an exclusion list of 28 countries, including Russia, China, Iran, and Venezuela, meant to keep the agents away from politically sensitive targets. The automation ignored its own instructions anyway. Help Net Security found compromised organizations in Russia, China, Kazakhstan, and Pakistan despite the exclusion list. An operator running a swarm of autonomous agents at this speed could not fully steer where it went, even when steering was the explicit goal.

Sources: Help Net Security

What the attackers actually got

Getting into a network and taking something from it are two different questions, and this campaign answered both at scale. Help Net Security reported that 280 of the victim organizations had credentials harvested outright, 147 had operating-system or domain secrets stolen, and 12 organizations saw the agents escalate all the way to domain administrator control, the highest level of access inside a Windows network. Access at that level typically means the attacker can read, modify, or exfiltrate anything the domain touches, not just the PaperCut server itself.

Sources: Help Net Security

• Confirm PaperCut NG/MF is patched against CVE-2026-81578 and CVE-2026-82078, not just scheduled for patching
• Hunt for indicators tied to the reported toolset: Mimikatz, Rubeus, and Impacket activity, plus SharpHound or Certipy enumeration against Active Directory
• Review domain administrator group membership for any account added recently without a matching change ticket
• Check authentication and access logs on internet-facing PaperCut servers for connections from unfamiliar IP ranges, including 45.142.193[.]132
• Segment print management infrastructure from domain controllers so a compromised print server is not a direct path to domain admin

Why patch cycles and manual review cannot match this

Most enterprise security processes assume days pass between a vulnerability becoming known and a meaningful response: a scan flags an exposed service, a ticket gets triaged, a patch gets scheduled for the next maintenance window. This campaign compressed that entire window into single-digit minutes for a meaningful share of its victims, and reached a dozen organizations before most security teams would have finished reading the first alert. A defense process built around a person periodically checking a dashboard is not slow because the people running it are careless. It was never designed to react in seconds, and this campaign is evidence that some attackers now operate on that timescale by default.

Vulnerability management programs are typically built around scheduled scans, ticket queues ranked by a human analyst, and alerting that assumes someone is watching a console during business hours. None of those assumptions held for the victims here. An organization with an exposed PaperCut server could go from untouched to fully compromised, credentials stolen and a domain administrator account in an attacker's hands, before its next scheduled scan even ran. Closing that gap does not mean hiring people who work faster. It means building processes that do not depend on a person being the fastest link in the chain.

The bigger pattern this fits

PaperCut is not an isolated data point. Security researchers have separately documented AI agents built into malware, used to generate exploit code on demand, and now used to run a full attack chain against hundreds of organizations with minimal supervision. Each report describes a narrower slice of the same shift: the cost of running a large-scale, technically competent attack has dropped from requiring a skilled team to requiring one operator and access to an agentic coding tool. Defenses sized for the old cost structure will keep losing that trade until they adopt some version of the same automation on their own side.

What this means for verifying AI-generated code

PaperCut NG/MF is deployed software with a patching problem, not a code-review problem, and no amount of pre-merge review would have stopped agents from exploiting an already-shipped vulnerability in a print server. That boundary matters and should stay precise. But the underlying mechanism behind this campaign, a swarm of coding-capable AI agents doing in seconds what used to take a team of humans days, applies just as directly to how organizations write and check their own code. Malware Now Ships Its Own AI Agent documented AI agents being embedded directly into offensive tooling; PaperCut is what that same class of automation looks like at full scale against real infrastructure, a preview of the volume defenders should expect more of, not a one-off.

Most engineering organizations still gate AI-generated code changes on a person finding time to read a diff, and that review happens at human speed even as the code being written, and increasingly the code attacking it, does not. TLM Forge is built for the adjacent half of that mismatch: a spec and goal-contract signed off before any code is written, adversarial agents launched specifically to attack a change rather than approve it, test-driven development enforced so a passing suite is a result a reviewer can rerun rather than a claim taken on faith, and a merge gate that returns a scored pass or fail instead of a reviewer's opinion, enforced through Claude Code hooks so a change with an unresolved critical finding cannot merge at all. None of that stops an external attacker from exploiting a flaw in third-party software like PaperCut. What it addresses is the pace at which an organization's own code gets checked before it ships, discussed in more depth in Code Review at AI Speed.