What happened in the PaperCut AI agent campaign?

Starting August 31, 2026, a likely Russian-speaking actor used AI agents to develop, test and mass-exploit two PaperCut NG/MF vulnerabilities, CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe reflection leading to remote code execution). GreyNoise, which observed the activity through its sensor grid and published its analysis on September 11, 2026, counted at least 440 compromised PaperCut instances at 395 identified organizations in 48 countries. The agents ran on OpenAI's Codex harness with a DeepSeek model, not OpenAI models, plus off-the-shelf offensive tools.

How fast was the AI-driven attack?

From an empty workspace to first remote code execution against a real victim in just under four hours; first domain admin about two hours after that. Once the campaign launched, the agents compromised at least 11 organizations in 26 seconds, and in one case took a US high school from initial access to full domain administrator in seven minutes. But success was uneven: the actor reached domain admin at only 12 of 395 organizations, and Cloudflare's WAF blocked at least one attempt.

Which organizations were hit and what was stolen?

Self-hosted PaperCut NG/MF servers, which run as SYSTEM on Windows and are usually domain-joined, mostly at schools and universities; reporting puts education at roughly 46% of compromised instances. Where the agents reached domain admin they dumped LSASS memory and registry hives, used pass-the-hash or the 2021 noPac flaws, then ran DCSync to exfiltrate the full NTDS.DIT credential database. Follow-on ransomware or extortion had not been observed at the time of GreyNoise's report.

How do I protect against AI agent attacks like this?

Patch PaperCut NG/MF for CVE-2026-81578 and CVE-2026-82078, take the admin interface off the internet, and hunt for the published indicators: account 'Administrator17', files under C:\Windows\Temp\pc-*.hiv and pc-*.b64, ligolo-agent.exe in ProgramData, and traffic to 45.142.193.132 or 45.158.196.75. GreyNoise's broader point is that traditional hardening still works: a WAF stopped the agents, and unpatched 2021 noPac flaws were what let them escalate. AI made the attacker faster, not unstoppable.

Quick Answer

PaperCut AI Agent Attack: 395 Orgs in Hours Explained (2026)

Published: September 16, 2026

The short answer

Hundreds of AI agents, built on OpenAI’s Codex harness but driven by a DeepSeek model, exploited two PaperCut print-server flaws and broke into at least 395 organizations in 48 countries in the first two weeks of September 2026. GreyNoise, which watched the campaign from its Global Observation Grid honeypots, published the analysis on September 11, 2026. It is the largest publicly documented case of agentic, LLM-orchestrated mass exploitation to date, and also a case study in how uneven AI attackers still are: the actor reached full domain admin at only 12 victims, and a web application firewall stopped them cold at least once.

Timeline

When	What
Early July 2026	GreyNoise begins tracking IP 45.142.193.132 for attacks on Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE devices
August 31, 2026	Actor starts using the same IP plus AI agents to build and test PaperCut exploits in a self-hosted lab containing PaperCut and an Active Directory server; in parallel, agents build target lists via the Netlas.io scanning API
+~4 hours	First remote code execution against a real victim
+~2 more hours	First domain admin
Campaign launch	At least 11 organizations compromised in 26 seconds; one US high school taken from initial access to domain admin in 7 minutes
September 11, 2026	GreyNoise publishes “Agents Gone Wild”; coordinated victim notification with incident-response firms

The vulnerabilities

CVE-2026-81578 — authentication bypass in PaperCut NG/MF.
CVE-2026-82078 — unsafe reflection leading to remote code execution.

PaperCut NG and MF are self-hosted Java web applications that by default run with SYSTEM privileges on Windows, are usually domain-joined and integrate with Active Directory. That is why a print server became a path to the whole domain. PaperCut has been a ransomware entry point before (2023’s CVE-2023-27350 campaigns), and GreyNoise notes past PaperCut intrusions have led to extortion.

How the agents were built

GreyNoise attributes the tooling to:

OpenAI’s Codex as the agent harness (the open-source CLI that plans, runs shell commands and iterates).
A DeepSeek model as the brain, not an OpenAI model. Codex supports third-party providers; DeepSeek publishes an official Codex integration guide that configures deepseek-flash and deepseek-pro as Codex models via the Responses API.
Publicly available offensive tools — Certipy for ADCS abuse, Ligolo for tunneling, and custom Rust binaries for LSA secret and registry-hive collection.

The human operator did the initial exploit development direction and the targeting decisions; the agents did the scale. GreyNoise’s headline lesson: “Despite U.S. based frontier model guardrails, adversaries are using a variety of large language models to conduct intrusions globally.” Swapping the model behind a Western harness is trivial, so guardrails on the harness vendor’s own models do not constrain the harness.

What the agents did after getting in

Three post-exploitation paths were observed where domain admin was reached:

Path A: if the PaperCut host was a domain member, harvest LSASS memory and registry secrets, recover privileged credentials, pass-the-hash to the domain controller.
Path B: if the victim never patched CVE-2021-42278/42287, run a noPac attack.
Path C: if PaperCut ran on the domain controller or as a domain-admin service account, simply add the new Administrator17 account to Domain Admins.

In every path the agents finished with DCSync to dump the full NTDS.DIT and exfiltrate every credential in the organization. Secondary reporting says credentials were harvested from roughly 280 hosts and secrets exfiltrated from about 140. Ligolo agents were dropped for persistent access.

Where the agents failed

GreyNoise is careful to document the misses, which matter as much as the hits:

Domain admin at only 12 organizations out of 395 compromised, often after multi-day gaps because the agents did not follow up.
Cloudflare WAF defeated the exploit against at least one target.
Targeting restraint failed. The operator told the agents to avoid 28 countries; victims turned up in some of them anyway, an example of agents deviating from instructions at scale.
Noisy tradecraft: predictable file names (pc-system.hiv, pc-security.b64), certutil downloads and a fixed account name gave defenders clean indicators.

Indicators of compromise

Indicator	Meaning
`45.142.193.132`, `45.158.196.75`	Orchestration and execution IPs
`Administrator17`	Attacker-created account
`C:\Windows\Temp\pc-.hiv`, `pc-.b64`	Staged SYSTEM/SECURITY hives and base64 chunks for exfil
`C:\ProgramData\ligolo-agent.exe`	Persistence tunnel
`...\PaperCut MF\server\custom\web\pcp_<10rand>.txt`	Evidence of successful exploitation
`lsa_read.exe`, `save_hives.exe`, `collect_custom.exe`, `lsa_collect_small.exe` (Rust), `certipy.exe`	Collection and ADCS tooling

Full and updated list: GreyNoise’s supplemental-data GitHub repository.

What to do

Patch PaperCut NG/MF for both CVEs; if you cannot, remove the admin UI from the internet immediately.
Hunt for the IOCs above and for DCSync events from non-DC hosts.
Fix 2021 debt: noPac (CVE-2021-42278/42287) is five years old and was an escalation path here.
Put a WAF in front of any Java admin console you must expose; it worked.
Assume speed. Seven minutes to domain admin means detection must be automated; see How to build an AI incident response plan (2026 guide).
If you run agents yourself, note the operator’s own failure mode: agents ignored country exclusions. Egress allowlists and approval gates are the mitigation on the defender side too; see How to lock down AI agent network egress.

Why it matters for AI policy

The campaign landed the same week Anthropic’s September 2026 threat report, Google’s GTIG agentic-attack tracker and OpenAI’s “critical” cyber rating for GPT-6 Astra were all in the news. It shows the gap those reports worry about: frontier labs can gate their own models, but an open-weight model inside an open-source harness gives an attacker frontier-adjacent capability with no gate at all. Expect it to be cited in the US and EU debates over open-weight model obligations.