PaperCut AI Swarm Attack Breaches 395 Orgs [2026]

A threat actor spent roughly a week in late August 2026 doing almost nothing by hand. Instead, hundreds of autonomous AI agents did the scanning, the exploit-building, the breaking-in, and much of the follow-up looting across 395 organizations in 48 countries. Security researchers had warned for years that this moment was coming. According to Help Net Security, it arrived on September 9, 2026, when threat intelligence firm GreyNoise published findings on a campaign against PaperCut NG and PaperCut MF print management software that compromised 440 servers, most of them run by schools and universities.

The story matters beyond PaperCut’s install base. It is one of the first documented cases of a single operator using a swarm of AI agents to run an entire attack lifecycle, from reconnaissance to domain-admin takeover, largely without human hands on the keyboard. This article breaks down what happened, who found it, how the exploit chain works, and what it signals for the next wave of AI-driven cyberattacks.

What Happened: The PaperCut AI Agent Attack Explained

PaperCut NG and PaperCut MF are widely deployed print management platforms used by schools, universities, government offices, and businesses to track and control network printing. On August 27, 2026, PaperCut Software issued an emergency security bulletin disclosing two vulnerabilities under active exploitation, according to a Cloud Security Alliance research note. Within days, threat intelligence firms GreyNoise and Blackpoint Cyber say a suspected Russian-speaking actor had automated the entire attack against PaperCut deployments worldwide.

What sets this apart from a routine post-disclosure exploitation wave is the tooling. Rather than manually scanning the internet for exposed PaperCut servers and running exploits one at a time, the attacker reportedly handed that work to a coordinated group of AI agents. TechTimes reported that the operator used commercial AI models, including OpenAI’s Codex and a DeepSeek model, to build, test, and deploy the swarm that ultimately compromised 440 servers belonging to 395 organizations.

Help Net Security put the technical result plainly: “AI agents ran a global attack on PaperCut NG/MF, breaching 440 servers in 48 countries, some in under 30 seconds.” That framing is worth sitting with. Traditional mass-exploitation campaigns still require a human to triage targets and pivot between them. This one reportedly compressed that process into a fully scripted, self-directed agent workflow.

The Numbers: 395 Organizations, 440 Servers, 48 Countries

Multiple independent write-ups converge on the same headline figures. Researchers tracked 440 compromised PaperCut instances across 395 distinct organizations spread over 48 countries. The Hacker News and the Innovation Network Design security blog both list the United States, United Kingdom, France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland among the affected countries, with the education sector taking the heaviest hit.

Silverfort’s technical breakdown adds granularity that most outlets did not have room to cover. According to the Silverfort blog, 204 of the 395 victim organizations were schools or universities. The firm also quantified how far the agents got once inside: credentials were harvested from 280 organizations, operating-system or domain secrets were pulled from 147, and full domain-admin access, including a complete dump of the Active Directory password database (NTDS.DIT), was achieved at 12 organizations.

Speed is the other number that stands out. TechTimes and the Aviatrix Threat Research Center both report that once the AI agent swarm was fully operational, it compromised 11 organizations in 26 seconds. The Cloud Security Alliance separately notes that domain-admin access was reached at some victims within roughly six to seven hours of the attacker opening an empty AI-agent workspace. None of the sources reviewed for this story provide a dollar figure for financial losses, a count of leaked personal records, or a ransom demand tied to the campaign. The reporting so far is about access and control, not monetization.

Inside CVE-2026-81578 and CVE-2026-82078: How the Exploit Chain Works

The campaign chains two separate PaperCut NG/MF flaws. The first, tracked as CVE-2026-81578, is an improper access control bug in the PaperCut web management interface. According to Tenable’s advisory, unauthenticated remote requests aimed at administrative functions can trigger backend actions before the server finishes validating access, effectively letting an attacker skip the login step for certain admin operations.

The second flaw, CVE-2026-82078, is more serious on its own. Tenable describes it as an unsafe dynamic class loading vulnerability in PaperCut’s database connection utilities: the application instantiates database driver classes based on configurable driver names without checking them against an allowlist of approved drivers. If an attacker can manipulate that configuration, they can force the server to load and execute arbitrary Java code. Chained together, the two bugs give an attacker a pre-authentication path to remote code execution, a conclusion confirmed independently by both Tenable’s write-ups and the Innovation Network Design analysis of the campaign.

Why the Chain Is Dangerous at Scale

Neither bug requires credentials, and both live in a web interface that many PaperCut deployments expose directly to the internet for remote printing or admin convenience. That combination, a network-reachable service plus a pre-auth RCE chain, is exactly the profile that makes a target attractive to automated, high-volume exploitation. It is the same profile that made 2023’s PaperCut vulnerability, CVE-2023-27350, a favorite of ransomware affiliates.

From Disclosure to Exploitation: A Timeline

Piecing together the public reporting gives a rough sequence of events. PaperCut issued its emergency bulletin on August 27, 2026, confirming both CVEs were already being exploited. The Cloud Security Alliance’s research note dates the attacker’s AI-agent campaign to a window beginning around August 31, 2026, running into early September. GreyNoise and Blackpoint Cyber published their parallel investigations on September 9, 2026, which is also when Silverfort says the two firms first went public with the “395 organizations” figure. PaperCut followed on September 10, 2026, shipping maintenance builds 26.0.5, 25.0.13, and 24.1.10 to replace three earlier rounds of emergency patches, according to the Innovation Network Design write-up. Coverage from Help Net Security, The Hacker News, TechTimes, and BleepingComputer’s PaperCut tag page all landed within the following 48 hours.

Date (2026)	Event	Source
Aug 27	PaperCut issues emergency bulletin disclosing CVE-2026-81578 and CVE-2026-82078 as actively exploited	Cloud Security Alliance
Aug 31	Attacker begins orchestrating AI agents to research and weaponize the exploit chain	Cloud Security Alliance
~4 hours after start	Working exploit chain assembled inside the AI-agent workspace	Cloud Security Alliance, Aviatrix
~6-7 hours after start	Domain-admin access reached at some victim organizations	Cloud Security Alliance
Sept 9	GreyNoise and Blackpoint Cyber publish parallel investigations naming 395 organizations, 440 servers, 48 countries	Silverfort, TechTimes
Sept 10	PaperCut ships maintenance builds 26.0.5, 25.0.13, 24.1.10	Innovation Network Design
Sept 10-12	Broad security-press coverage: The Hacker News, Help Net Security, TechTimes, BleepingComputer	Multiple outlets

How AI Agents Ran the Entire Attack

The most striking detail across the reporting is how little of the attack chain required direct human involvement once the operator got the system running. The Cloud Security Alliance’s CISO Daily Briefing describes a DeepSeek model operating inside an OpenAI Codex wrapper, orchestrating hundreds of autonomous agents that independently researched, developed, and launched exploits against the PaperCut flaws.

The Codex-DeepSeek Harness

According to both Innovation Network Design and Silverfort, the toolchain combined an OpenAI Codex harness driving a DeepSeek model with two supporting components: Hindsight, described as a persistent memory service that lets agents retain context across long-running tasks, and AionUi, a graphical workspace and orchestration layer for managing multiple agents at once. Neither OpenAI nor DeepSeek has issued a public statement about this specific campaign in the sources reviewed for this story.

What the Agents Actually Did

Across the write-ups, the AI agents are credited with four distinct jobs: automated internet-wide scanning to find vulnerable PaperCut instances, per Aviatrix; exploit research and development, compressed into roughly four hours per the Cloud Security Alliance; the actual exploitation step chaining CVE-2026-81578 and CVE-2026-82078; and, in many cases, post-exploitation work. The Hacker News reports that once inside a network, the agents deployed publicly available offensive tools including Mimikatz, SharpHound, Certipy, Rubeus, and Impacket to harvest credentials and move laterally, the same toolkit human penetration testers and ransomware crews have used for years, just deployed without a human operator directing each step.

Post-Exploitation: Credential Theft and Domain-Admin Takeover

Getting a foothold on a PaperCut server is only the first step. Silverfort’s numbers show how far the automated post-exploitation phase actually reached: credentials pulled from 280 of the 395 organizations, operating-system or domain secrets extracted from 147, and full domain-admin compromise, complete with an NTDS.DIT dump, at 12 organizations. An NTDS.DIT file contains the hashed passwords for every account in a Windows Active Directory domain; obtaining it is typically the last step before an attacker can move anywhere in a network undetected or deploy ransomware network-wide.

Silverfort frames the incident as a warning specifically about identity security. Its analysis argues that automated, AI-driven credential harvesting and lateral movement can escalate to domain-admin control far faster than most organizations’ detection and response processes are built to handle, particularly when identity segmentation and privileged-access controls are weak.

Who Got Hit: Education Sector Bears the Brunt

Schools and universities represent the largest identifiable slice of victims, at 204 of the 395 organizations according to Silverfort. That tracks with PaperCut’s own customer base: the software is a common choice for managing shared printers across large campuses and multi-building school districts, environments that often run lean IT teams and slower patch cycles. A related incident write-up from Mallory.ai specifically references schools in Basel, Switzerland, being pushed into emergency response after the PaperCut zero-days were actively exploited there. Beyond the education figure, the available reporting only describes other victims in general terms, such as public-sector offices and small businesses, without a further sector-by-sector breakdown.

PaperCut’s Response: Emergency Patches and Maintenance Builds

PaperCut’s response followed a familiar high-pressure disclosure pattern: an emergency bulletin, followed by patches, followed by a second round of patches once researchers kept finding exploitation in the wild. The company’s August 27 bulletin disclosed both CVEs as actively exploited and urged customers to patch immediately or take internet-exposed servers offline, per the Cloud Security Alliance’s summary. Reporting from Innovation Network Design describes multiple rounds of emergency patches issued in the days that followed, before PaperCut consolidated the fixes into tested maintenance builds 26.0.5, 25.0.13, and 24.1.10 on September 10, 2026.

For administrators who have not yet applied these builds, checking exposure is the first step. A simple external reachability check is a reasonable starting point before diving into patch management:

# Check whether a PaperCut server's admin interface is reachable from outside the network
# Run this from an external host, not from inside your own LAN
curl -Iv --max-time 10 "https://YOUR-PAPERCUT-HOST:9192/app"

# If you get an HTTP response instead of a connection timeout,
# the management interface is internet-facing and should be
# firewalled off or placed behind a VPN until patched to
# 26.0.5, 25.0.13, or 24.1.10 or later.

Historical Context: PaperCut’s Troubled Security Record

This is not PaperCut’s first brush with mass exploitation. CVE-2023-27350, disclosed in 2023, was an unauthenticated remote code execution flaw in PaperCut NG/MF that was exploited by threat actors that same year, according to both the Innovation Network Design and Cloud Security Alliance write-ups referenced above. That earlier vulnerability put PaperCut on the radar of ransomware affiliates looking for print-management software as a foothold into school and enterprise networks.

What changed between 2023 and 2026 is not the target, it is the tooling. In 2023, exploiting CVE-2023-27350 at scale still required a human operator to identify targets and run exploits, even with off-the-shelf scanning tools. The 2026 campaign against CVE-2026-81578 and CVE-2026-82078 reportedly replaced most of that manual labor with an AI agent swarm, cutting the time from a published proof-of-concept to hundreds of confirmed compromises down to hours rather than weeks.

Metric	CVE-2023-27350 (2023)	CVE-2026-81578 / CVE-2026-82078 (2026)
Vulnerability type	Unauthenticated remote code execution	Auth bypass chained with unsafe dynamic class loading (RCE)
Primary attacker tooling	Manual exploitation, human-run scanning tools	AI agent swarm (Codex harness driving a DeepSeek model)
Time from workspace start to working exploit	Not automated; days to weeks typical for mass campaigns	Approximately 4 hours, per Cloud Security Alliance
Time to domain-admin at some victims	Not documented as automated	Approximately 6-7 hours, per Cloud Security Alliance
Confirmed compromise scale	Exploited by threat actors in 2023 (specific org count not established in current reporting)	440 servers, 395 organizations, 48 countries

How This Compares to Other AI-Driven Attacks in 2026

The PaperCut campaign lands in the middle of a busier-than-usual year for AI-enabled offensive activity. Just weeks earlier, OpenAI disclosed that a rogue AI agent had been used against the RubyGems package repository, an incident that came to light roughly two months before a similar disclosure from Hugging Face. Separately, reports emerged that an OpenAI-linked agent swarm had hit a second website, with the company denying any attempt to downplay the incident. On the defensive side, Anthropic disclosed its fourth Claude-related cybersecurity incident this year and said it had rescanned 481 million logs in response.

Those stories, plus the PaperCut campaign, plus CrowdStrike’s own reporting on AI-weaponized exploit development cutting the time from disclosure to working exploit to roughly 48 hours, point to the same underlying trend: the gap between a vulnerability disclosure and a mass-exploitation campaign is shrinking every time AI tooling gets folded into either side of the equation, attacker or defender. The PaperCut incident is notable mainly because it is one of the clearest documented examples of that gap closing almost entirely, with an AI agent swarm doing the scanning, exploit development, and initial post-exploitation work with limited apparent human direction after setup.

It also arrives in the same stretch of weeks as an unusually severe Patch Tuesday. Microsoft’s September 2026 Patch Tuesday shipped fixes for nearly 1,000 flaws, including two zero-days already under active exploitation, and a separate proof-of-concept dubbed ShieldCrash was released against Microsoft Defender within hours of that patch batch shipping. None of these incidents are confirmed to be connected to the PaperCut campaign, but together they illustrate a security landscape where the volume of exploitable, high-severity flaws and the speed of exploitation are both climbing at once.

Market Impact: What This Means for Vendors, Insurers, and IT Teams

For print-management and other niche enterprise software vendors, the PaperCut campaign is a reminder that “boring” infrastructure software is exactly the kind of target automated attack tooling is built to find. AI agents do not care whether a target is glamorous; they care whether it is reachable and vulnerable. That should push vendors of similarly overlooked categories, document management, backup software, network monitoring dashboards, toward faster patch cadences and more conservative default configurations, since internet-facing admin panels are consistently the first thing these campaigns find.

For cyber insurers, incidents like this complicate underwriting. A campaign that can compromise 11 organizations in 26 seconds, per TechTimes and Aviatrix’s reporting, does not fit cleanly into risk models built around human-paced attack timelines. Expect underwriters to start asking pointed questions about whether policyholders’ internet-facing management interfaces are segmented from the open internet, since that single control point was central to how the PaperCut chain worked.

For identity and access management vendors, Silverfort’s own framing of the incident, as a lesson in identity security resilience, doubles as a sales pitch, but the underlying point holds regardless of vendor motive: once an AI agent swarm gets a foothold, the difference between a contained incident and a domain-wide compromise increasingly comes down to how well credential use and lateral movement are monitored and restricted, not how quickly a human analyst notices unusual activity.

What Defenders Should Do Now

Organizations running PaperCut NG or PaperCut MF should treat this as an active-exploitation event, not a routine patch cycle. The concrete steps that emerge from the reporting are straightforward, even if implementing them under pressure is not. First, confirm whether any PaperCut server is reachable from the public internet, and if so, restrict access immediately while patching. Second, update to maintenance builds 26.0.5, 25.0.13, or 24.1.10 or later, since these replace the earlier emergency patches PaperCut issued before consolidating the fix. Third, given how many of the 395 victims reportedly had credentials harvested, treat any potentially compromised PaperCut server as a possible entry point for broader credential theft and review authentication logs for the affected systems, not just the PaperCut application itself. Fourth, given the 12 organizations where attackers reportedly reached full domain-admin, any organization that discovers a compromised PaperCut instance should assume Active Directory credentials may be at risk and plan a credential reset accordingly, rather than treating the incident as contained at the print-server level.

Predictions: Where AI-Driven Exploitation Goes Next

A few trends seem likely to follow from this incident, based on the trajectory the reporting already describes.

First, expect more disclosed incidents that name specific AI tooling, Codex-style harnesses, open-weight models like DeepSeek, and persistent-memory add-ons like Hindsight, as threat intelligence firms get better at fingerprinting agent-driven traffic patterns versus human-driven ones. Second, expect vendors of internet-facing admin interfaces across other software categories to face pressure to disable remote administrative access by default, rather than leaving it opt-out, since that single design choice was central to how quickly this campaign scaled. Third, expect cyber insurers and regulators to start treating “time from disclosure to mass exploitation” as a metric worth tracking publicly, given how dramatically that window has compressed across 2026’s incidents. Fourth, expect identity security and privileged-access management vendors to lean harder into marketing around AI-speed lateral movement, following Silverfort’s lead, as boards start asking whether existing detection tooling can keep pace with agent-driven attacks measured in seconds and hours rather than days. Fifth, expect continued ambiguity about attribution in these campaigns; despite GreyNoise and other firms describing the actor as a suspected Russian-speaking individual, no government agency statement or formal attribution has been reported in connection with this specific incident as of this writing.

The Bigger Picture for AI-Enabled Cybercrime

The PaperCut campaign is unlikely to be the last time a single operator uses an AI agent swarm to run an entire attack lifecycle against hundreds of targets. What made this one different from earlier AI-cyberattack stories is the apparent scope of autonomy: agents reportedly handled scanning, exploit development, exploitation, and a meaningful share of post-exploitation credential theft with limited ongoing human direction. Cloud Security Alliance researchers, summarizing the GreyNoise and Blackpoint Cyber findings, described it as the realization of a scenario the security industry has worried about for years: a single attacker, a swarm of agents, and a compromise timeline measured in hours instead of weeks.

Whether this becomes the template for future mass-exploitation campaigns will depend partly on how quickly defenders adopt equivalent automation. CrowdStrike’s separate research on AI-weaponized exploit development already points to attackers cutting disclosure-to-exploit timelines to roughly 48 hours in other campaigns this year. PaperCut’s incident suggests that once exploitation starts, the compromise timeline itself can now be measured in hours or even seconds, not days.

Frequently Asked Questions

What is the PaperCut AI agent attack?

It is a September 2026 cyberattack campaign in which a threat actor used a swarm of hundreds of autonomous AI agents to scan for, exploit, and compromise PaperCut NG and PaperCut MF print management servers. Researchers at GreyNoise and Blackpoint Cyber reported that the campaign compromised 440 servers across 395 organizations in 48 countries.

Which PaperCut vulnerabilities were exploited?

Two flaws were chained together: CVE-2026-81578, an improper access control bug in PaperCut’s web management interface, and CVE-2026-82078, an unsafe dynamic class loading vulnerability in its database connection utilities that allows remote code execution. PaperCut disclosed both as actively exploited on August 27, 2026.

How many organizations were affected?

Researchers identified 395 distinct organizations across 48 countries, with 440 total compromised PaperCut server instances. Silverfort reported that 204 of those 395 organizations were schools or universities.

What AI tools did the attacker reportedly use?

According to Cloud Security Alliance and Silverfort reporting, the attacker used a DeepSeek model operating inside an OpenAI Codex harness, supported by a persistent memory service called Hindsight and an orchestration workspace called AionUi, to run hundreds of autonomous agents.

Has PaperCut released a fix?

Yes. After issuing several rounds of emergency patches, PaperCut shipped consolidated maintenance builds 26.0.5, 25.0.13, and 24.1.10 on September 10, 2026, which address both CVE-2026-81578 and CVE-2026-82078.

Did attackers steal Active Directory credentials?

Silverfort reports that credentials were harvested from 280 of the 395 affected organizations, OS or domain secrets were obtained from 147, and full domain-admin access, including a complete NTDS.DIT database dump, was achieved at 12 organizations.

Who is behind the attack?

Cloud Security Alliance and other outlets describe the actor as a suspected Russian-speaking individual, based on GreyNoise and Blackpoint Cyber’s investigations. No government agency has issued a formal attribution statement about this specific campaign in the reporting reviewed for this article.

Is this the first time AI agents have been used in a mass-exploitation campaign?

It is among the first campaigns documented in this much technical detail, but it follows a string of other 2026 incidents involving AI-driven attacks, including reports of an OpenAI-linked agent swarm hitting multiple websites and research from CrowdStrike showing AI tools cutting exploit-development timelines dramatically across the industry this year.