AI Agents Help Hackers Compromise 440 PaperCut Servers
PaperCut flaws were exploited across 440 servers using hundreds of AI agents. Learn which versions are affected and what security teams should do now. The post AI Agents Help Hackers Compromise 440 PaperCut Servers appeared first on TechRepublic .
An attacker utilized hundreds of artificial intelligence agents to exploit vulnerabilities in PaperCut NG/MF print management software across 440 servers in 395 organizations worldwide. The cybercriminal, suspected to be Russian-speaking, employed AI agents to accelerate exploitation of two zero-day vulnerabilities, CVE-2026-81578 and CVE-2026-82078.
The attack chain enabled an unauthenticated attacker to modify configurations and execute arbitrary Java bytecode in the security context of the PaperCut server, affecting the education sector, with 204 victims, including a U.S. high school. The campaign, initiated on August 31, 2026, was orchestrated using OpenAI's Codex, DeepSeek model, and orchestration software like AionUI and Hindsight.
The attack entailed 200 concurrent threads, executing up to 100 automated retry loops, and compromised 11 organizations within 26 seconds. Despite attempting to exclude 28 nations, the operation infiltrated countries such as South Africa and Brazil. GreyNoise highlighted the instability of agentic tooling, as the operator's exclusion filter failed in some cases.
The campaign emphasizes the rapid reduction of time and labor required for moving from vulnerability disclosure to large-scale exploitation.
Written by urgent.news from TechRepublic's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
