A presumed Russian-speaking attacker has reportedly used hundreds of AI agents to automate the exploitation of two vulnerabilities in the printing software PaperCut NG/MF, according to the security firm GreyNoise. The campaign compromised at least 440 server instances at 395 organizations in 48 countries. The attacker achieved the first remote access in under four hours.
Codex controls hundreds of agents within hours
OpenAI’s Codex tool served as the orchestration layer: it coordinated sessions, distributed tasks to individual agents, and intercepted errors, while the actual attack logic came from a DeepSeek model. The attacker initially built a functioning attack chain in a test environment with a vulnerable PaperCut installation and an Active Directory server before deploying it against real targets. The agents identified target servers through the scanning service Netlas.io, to which the attacker had an access key. Each step was automatically logged by the agents, which adjusted their approach independently in case of failures before the attacker launched the campaign on a large scale against real targets.
GreyNoise describes the speed of the campaign as unprecedented: from an empty workspace to the first successful remote access to a real server took less than four hours, with an additional two hours to gain domain admin rights. Once the full campaign was underway, the agents compromised eleven organizations within 26 seconds. Targets in Russia, China, Hong Kong, Thailand, Iran, and 23 other countries were deliberately excluded from the attacks — a pattern that suggests the presumed origin of the attacker.
DeepSeek provides the attack technique without restrictions
For the actual exploit development, the attacker specifically chose a model from DeepSeek, according to GreyNoise, because it does not enforce content restrictions on offensive security queries comparable to those of top U.S. models. Two vulnerabilities were exploited: CVE-2026-81578, an access control error in the web management interface that triggers administrative actions before the authorization check is completed, and CVE-2026-82078, an insecure dynamic class loading flaw that allows arbitrary Java code to run with the system rights of the PaperCut server process — SYSTEM rights by default on Windows. Security researchers rate both vulnerabilities with CVSS scores of 8.8 and 9.4 respectively, classifying them as high to critical; only the combination of both flaws grants an unauthenticated attacker full remote access.
This is not the first case in which an open model from DeepSeek has been misused for automated attacks: in August 2026, another attacker, according to Palo Alto Networks, used the Hermes Agent framework to turn DeepSeek into a tool for attacks on more than 460 systems. The current case thus joins a growing dossier on open models and cyber risk.
Educational institutions bear the brunt of the attacks
About half of all affected organizations come from the education sector, hit significantly more often than any other industry. The agents stole credentials from 280 victims, operating system or domain secrets from 147, and gained administrator rights at twelve organizations. PaperCut released a security bulletin on August 27, 2026, and had to issue a second emergency patch within 48 hours after attackers bypassed the first fix. Affected organizations are additionally advised to reset all credentials and keys managed through the compromised servers as a precaution, since successful and failed access attempts are often not reliably distinguishable afterward.
It will be crucial whether security teams can adjust their response time to this new attack pace. The U.S. agency CISA set a deadline of September 14, 2026, for federal agencies regarding the more critical of the two vulnerabilities — just two days after this article. It remains unclear how many affected educational institutions with limited IT resources can meet this deadline, especially since the manufacturer’s first emergency patch was bypassed within two days.
