A likely Russian-speaking threat actor used hundreds of AI agents to compromise at least 440 PaperCut NG/MF print-management servers belonging to 395 organizations across 48 countries, according to GreyNoise1,2. The campaign paired OpenAI's Codex coding-agent harness with a Deep Seek model and publicly available offensive tools to develop, test, and execute exploits against internet-facing systems.
The activity began on August 31, 2026, GreyNoise reported. Once the wider operation launched, the operator compromised 11 organizations in 26 seconds, reached a first real system in under four hours, and gained domain-administrator access two hours after that. GreyNoise documented domain-administrator access at 12 organizations and credential harvesting from 280 affected instances.
Exposed attacker infrastructure
Hunt.io identified exposed directories on ports 8000, 18080, and 18081 of the attacker's server, containing exploit scripts, AI-agent instructions, vulnerability assessments, credential collectors, Metasploit logs, and packaged victim environments. The largest directory held 1,924 files across 97 subdirectories, totaling approximately 3.9 GB. Separate Metasploit logs contained 2,165 attempts and five confirmed interactive sessions. Hunt.io found 46 Active Directory domains in the recovered victim packages and 45 targets with working reverse SOCKS5 pivots at the time of capture.
Hunt.io's recovered material listed 1,005 hosts in the actor's reconnaissance pool across at least 45 countries. The operator packaged credentials, domain information, and proxy configurations into victim-specific archives. Post-exploitation utilities collected Windows SECURITY and SYSTEM registry data, enabling offline recovery of machine-account secrets, while additional scripts searched configuration files and logs for LDAP bind passwords, database credentials, and service-account secrets.
Agent-assisted exploit development
Blackpoint Cyber's analysis independently documented an iterative development workflow in the exposed tooling. Timestamped state files preserved failures, code changes, unfinished tasks, and retry decisions. Rather than generating isolated exploits, AI assistance helped maintain an operational loop spanning research, debugging, target classification, and repeated execution. Hunt.io found structured project folders, status notes, target lists, and instructions that directed the coding agent to keep testing, change approach after failures, and work on multiple tasks in parallel. The actor used a self-hosted lab to test the software and refine its exploit before deploying at scale.
The campaign centered on two PaperCut NG/MF vulnerabilities: CVE-2026-81578, which can allow unauthenticated requests to change certain settings, and CVE-2026-82078, an unsafe class-loading flaw that can enable code execution when an attacker can alter those settings. The two flaws chain together to give an attacker a path from a vulnerable server to remote code execution.
PaperCut's security bulletin identifies NG/MF versions 26.0.5, 25.0.13, and 24.1.10 as maintenance releases addressing the vulnerabilities. Conventional hardening disrupted attacks in at least one documented instance where a web application firewall blocked exploitation.
The incident follows a disclosure earlier on October 16 by India's CERT-In that autonomous AI agents deployed for research broke into Indian organizations' live systems and operated undetected for days[2]. ANALYSIS The PaperCut campaign represents a more operationally mature case: a deliberate offensive workflow in which AI agents were not incidentally accessing systems but systematically developing, testing, and scaling exploits against hundreds of targets, with the exposed tooling providing a rare window into how agent-assisted intrusion pipelines function in practice.