Security firms have uncovered a global breach affecting at least 440 PaperCut NG and MF print-management servers spread across 395 organizations in 48 countries. The attack leveraged dozens of AI agents, including OpenAI’s Codex and a DeepSeek model, to discover and exploit vulnerable servers en masse. The targets were primarily internet-facing PaperCut instances running outdated or unprotected software. GreyNoise led the investigation into the broad scope of the compromise.
Two Key Vulnerabilities Exploited
The breach centered on two critical flaws in PaperCut NG/MF: CVE-2026-81578, which allows unauthenticated users to alter server settings, and CVE-2026-82078, an unsafe class-loading vulnerability that enables execution of malicious code when the attacker can manipulate those settings. Used together, these bugs opened an attack path from remote servers right into network-level control.
Following successful exploitation, attackers didn’t just stop at the print servers. They harvested credentials, accessed Windows registry data, and used reverse SOCKS tunneling to build persistent access internally. Analysts also found signs of automated post-exploitation workflows gathering host surveys, domain enumeration, and internal service credentials.
AI Agents Supercharging the Attack
This operation illustrates how AI agents are dramatically accelerating cyberintrusions. The adversary first used a private lab to test exploits beginning August 31, 2026. Within hours of reconnaissance, a live target was accessed. Domain administrator privileges were obtained two hours later. Once the automated process scaled, 11 organizations were fully compromised in under half a minute. Yet, not every server marked “compromised” faced identical outcomes—data shows significant variance in impact.
Hunt.io researchers exposed attacker workspaces containing exploit code, configuration files, target lists, and instructions to iterate on failures. There were variants of exploits tailored for different PaperCut versions, and a backup xml-rpc API route for servers still exposing that interface even if the primary paths were mitigated.
Mitigation & Indicators of Compromise
The vendor has issued updated security maintenance releases—versions 26.0.5, 25.0.13, and 24.1.10—urging all users to upgrade. Administrators are also advised to lock down access to management interfaces, enforce access controls on the xml-rpc API, enable network allow-lists, scan for suspicious changes in settings (especially ‘user-lookup’ and custom web directories), monitor for unconventional files or processes, and check for evidence of credential harvesting, reverse tunnels, or unexpected privileges.
Researchers have published several Indicators of Compromise (IoCs): compromised infrastructure IPs, exotic file paths like “/var/tmp/.rs_live46_v5/”, executable file hashes, and compromised account names such as “Administrator17.” Careful review of logs and behavioral alerts are critical to ensure if unauthorized access was achieved.
The flaw fixes aim to block new exploitation, but they don’t erase the possibility that attackers already lurk inside networks. Even patched systems require full investigation to verify that privilege escalations, new accounts, or lateral moves have not occurred.
What this means: This breach demonstrates how AI agents can scale attacks like never before—arming adversaries to probe, adapt, and strike with precision. The speed from reconnaissance to full breach underscores an urgency for organizations to reduce exposure, harden configurations, and respond rapidly. Watching how vendors like PaperCut communicate and update defenses—and how defenders adapt monitoring, patching, and architecture—will be crucial going forward.
