Skip to content
NewsIncident

Suspected Russian actor used hundreds of AI agents to breach 395 organizations via PaperCut flaws

· by Pondero Newsdesk

The short version

A coordinated AI agent swarm built on OpenAI Codex and DeepSeek compromised 440 PaperCut instances at 395 organizations across 48 countries starting August 31, 2026, harvesting credentials from 280 victims.

Suspected Russian actor used hundreds of AI agents to breach 395 organizations via PaperCut flaws

An AI agent swarm hit 11 or more organizations in under 26 seconds after launch on August 31, 2026. In just seven minutes at one U.S. high school, the same campaign went from first access to full domain administrator. By the time researchers at GreyNoise documented the operation, 440 PaperCut print-management instances across 395 organizations and 48 countries had been compromised.

What happened

A suspected Russian-speaking threat actor built the attack infrastructure around hundreds of AI agents running on OpenAI Codex and a DeepSeek model, pairing them with commodity offensive tools including Mimikatz, Certipy, BloodHound, Rubeus, and Impacket, per The Hacker News. Two PaperCut NG/MF vulnerabilities formed the exploitation chain: CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution flaw. Both were flagged as actively exploited in early September 2026.

Speed was the defining feature. Starting from an empty workspace, the actor reached working multi-threaded validation tooling and a first victim RCE in under four hours, per BleepingComputer. Concurrent agents handled vulnerability comparison between patched and unpatched PaperCut builds, generated custom exploitation code, and ran progressive target expansion with automated failure analysis. A custom persistent-memory service called "Hindsight" retained context across sessions; a graphical workspace called "AionUi" managed concurrent agent execution.

Post-exploitation results were severe. Credentials were harvested from 280 of the 395 victim organizations. Operating system or domain secrets were exfiltrated from 147. Full domain administrator access was established at 12, per BleepingComputer. Education accounted for roughly half of all breaches, with primary victim concentrations in the United States, United Kingdom, France, Spain, and Canada. A geo-exclusion list blocked Russia, China, Iran, Ukraine, Belarus, and more than 20 other countries from targeting.

Why it matters

No documented attack has previously deployed a coordinated AI agent swarm, not a single model or AI-assisted workflow, as primary attack infrastructure at this scale. That shift matters in practical terms. Traditional campaigns require human operators or scripted bots to validate exploitability one target at a time; an agent swarm concurrently triages, ranks, and exploits a candidate list while adapting to each target's configuration. Custom memory tooling suggests the swarm retained learnings across sessions, compounding its effectiveness over time.

Four hours from an empty workspace to first RCE. Twenty-six seconds to breach more than 11 organizations. Seven minutes to domain admin at a single site. Those timelines collapse the detection-and-response window that defenders rely on once active exploitation begins.

Operators running PaperCut NG or MF on public-facing or network-reachable servers should treat CVE-2026-81578 and CVE-2026-82078 as critical-priority patches. The 26-second mass-compromise window means that by the time an alert fires on active scanning, exploitation at reachable instances may already be complete.

What to watch next

PaperCut had not published affected version ranges or confirmed patch availability for both CVEs as of September 13. Monitor the PaperCut security advisory page for patch release. A second signal: whether OpenAI responds publicly to the use of Codex as attack infrastructure. A formal response would set a visible precedent for how frontier labs handle documented misuse of their models in criminal campaigns.

Sources