A likely Russian-speaking threat actor weaponized hundreds of AI agents to compromise at least 440 PaperCut servers linked to 395 organizations across 48 countries, according to GreyNoise2,9. In a parallel development, infostealer malware families began harvesting tokens and project data from the very coding agents developers rely on daily5,6. ANALYSIS Taken together, the two campaigns mark the moment AI agents became a dual-sided attack surface, simultaneously the instrument and the objective of offensive operations.
Why it matters
The PaperCut campaign is the most concrete public case of AI-agent swarms executing a full attack chain at machine speed. GreyNoise reported that the threat actor moved from an empty workspace to remote code execution against a live victim in under four hours, then obtained domain administrator privileges roughly two hours later7. In one burst, the operation compromised at least 11 organizations in 26 seconds. A U.S. high school went from initial access to full domain administrator compromise in seven minutes8. ◆ These timescales compress what traditionally took days of manual operator work into intervals that outrun most detection and response playbooks.
The big picture
The PaperCut campaign, tracked from August 31, targeted CVE-2026-81578 and CVE-2026-82078, an authentication bypass and remote code execution chain affecting PaperCut NG/MF. PaperCut issued emergency patches on August 27. The attacker, likely Russian-speaking, used an OpenAI Codex-based harness with a DeepSeek model and public offensive-security tools to build, test, and execute exploits in parallel. The AI agents also generated target lists through the Netlas internet scanning platform. GreyNoise data indicates the operation compromised at least 440 PaperCut instances linked to 395 distinct organizations across 48 countries. The attacker harvested credentials from 280 victims, obtained operating system or domain secrets from 147, and gained administrator privileges at 12 organizations. Most victims were in the education sector, accounting for roughly half of all breaches.
Post-exploitation was equally systematic. On domain-joined PaperCut servers, attackers harvested LSASS memory and registry secrets to recover privileged credentials, then used pass-the-hash techniques against domain controllers. In environments still vulnerable to CVE-2021-42278 and CVE-2021-42287, the operators used the noPac privilege-escalation technique. Where PaperCut ran directly on a domain controller or under a domain admin service account, attackers added a newly created account to the Domain Admins group. In all cases where domain admin was achieved, DCSync was used to dump the full NTDS.DIT database.
"At this time, we cannot confirm the exact end goal of this campaign," said Nevan Beal, principal MDR analyst at Blackpoint. "The threat actor's methodology is consistent with initial-access activity, but we do not yet have sufficient evidence to confirm whether they are operating as an initial access broker".
On the other side of the equation, infostealer malware families are now collecting tokens, prompt histories, and project metadata from AI coding agents including Claude, Cursor, Codex, Cline, Continue, and OpenCode. Malware families such as Amatera, Remus, CallbackBeaver, BeeStealer, HydraStealer, APEX Stealer, Otter Stealer, and macOS-focused Djinn Stealer have added AI development tools to their collection rules. Researchers identified more than 5,000 CallbackBeaver samples during a recent 30-day period. Gen Digital said the findings concern locally installed development agents, not a direct compromise of an AI model10. Separately, cybercriminals are hijacking AI user accounts via infostealer logs to create replayable tokens that bypass multi-factor authentication, granting illicit access to tools from providers like Google and Anthropic4.
ANALYSIS The infostealer pivot requires no novel exploit. Threat actors add newly popular AI tools to existing malware collection lists by updating paths, filenames, or database rules without rebuilding the malware. That low barrier means every new coding agent that stores tokens or credentials in predictable local folders inherits the full weight of the commodity stealer ecosystem on day one. The PaperCut campaign, meanwhile, demonstrates that AI agents can compress the reconnaissance-to-exploitation timeline so severely that patch windows measured in days may no longer suffice. Emergency patches shipped on August 27; the AI-driven campaign began on August 31, and the fastest escalation to domain administrator occurred in five minutes.
The convergence is structural: as organizations deploy more AI agents for development and operations, they simultaneously expand the credential surface that stealers can harvest and the tooling that adversaries can turn against them.
What's next
GreyNoise has tracked malicious use of the IP address behind the PaperCut campaign since early July 2026. The education sector, which accounted for roughly half of PaperCut victims, faces the start of a new academic year with unpatched instances still exposed. The fastest domain-admin compromise in the campaign took five minutes.