AI Agents Hacked 440 Print Servers: What to Patch First

On September 9, 2026 the security firm GreyNoise published its account of a campaign in which one actor used AI agents to break into at least 440 PaperCut print-management servers at 395 organisations across 48 countries. The exploit work started on August 31. PaperCut had published its advisory on August 27 and its first emergency patch on August 28. The campaign did not beat the patch. It beat the people who had not applied it.

This post is for anyone who runs software with an admin page that can be reached from the internet, and for anyone who sets patch windows. It reads the figures in the GreyNoise report, checks them against PaperCut's advisory and the National Vulnerability Database, and turns them into a patch-order rule. All campaign figures are GreyNoise's, drawn from its own sensor network rather than from victim forensics.

PaperCut NG and MF are self-hosted print-management servers. They are Java web applications that, as GreyNoise notes, run with system-level privileges on Windows by default and are usually joined to the organisation's Active Directory domain. That makes a print server a route to every credential in the building, which is why this campaign is about identity theft, not printing.

Two flaws were involved. CVE-2026-81578 lets an unauthenticated remote request change certain system settings before access checks finish, which PaperCut's advisory scores 8.8 and labels high. CVE-2026-82078 is an unsafe class-loading flaw in the database connection code that lets an attacker who can change configuration run arbitrary code as the server process, which the advisory scores 9.4 and labels critical. Chained, the first unlocks the second. Both were published to the National Vulnerability Database on August 28, 2026.

GreyNoise describes the actor as "likely Russian-speaking" and says it ran "hundreds of AI Agents" through OpenAI's Codex harness using a DeepSeek model, alongside publicly available offensive tools. The actor first built and attacked a lab copy of PaperCut and Active Directory, then built target lists from an internet scanning service, then ran the campaign. GreyNoise's figures come from its sensor network, and it says other real victims exist that it could not attribute to a named organisation.

Two numbers stop this being a story about unstoppable machines. Domain administrator was reached at only 12 of the 395 organisations. And credential harvesting succeeded on 280 servers, with operating-system or domain secrets taken from 147. A campaign that reached 440 servers in days still has to do the slow work of turning access into control, and at most victims it had not done so when GreyNoise last looked.

The dates below come from PaperCut's advisory page, which carries a change log in Australian Eastern time, from the NVD, and from GreyNoise's report. Put side by side they show the interval every patch policy has to survive.

The gap to notice is Aug 28 to Aug 31. A patch existed for three days before the first exploit was written. The old rule of thumb was that a critical patch could wait for the next maintenance window because writing a working exploit took a skilled person days or weeks. Here the exploit and the campaign were produced in one working day by agents, and the actor still had a large population of unpatched servers to hit. The scarce resource was never the exploit. It was the defender's calendar.

GreyNoise calls the targeting opportunistic and says the concentration in US education most likely reflects PaperCut's customer base rather than a choice. Education accounted for 204 of the 440 servers, and seven of the twelve domain-admin compromises. The chart shows the eight countries with the most affected servers.

The list also shows the do-not-target failure. GreyNoise says the actor reused a 28-country avoid list from earlier campaigns. Brazil, South Africa, Namibia, Nigeria and Zimbabwe are on that list, and all five appear in the victim table, as do China, Kazakhstan and Pakistan, South Africa with nine servers and a domain-admin compromise. GreyNoise says it is unclear why the agents deviated. For a defender the lesson is narrow: an attacker's own constraints on its agents are not a control you can rely on, in either direction. The same failure mode, agents acting outside their brief, is what made the July Hugging Face incident a policy story.

GreyNoise is direct that ordinary hardening worked. Its report says that in at least one case a Cloudflare web application firewall defeated the attempt against a server the actor believed was vulnerable, and that "fundamental hardening of environments still matters against AI-enabled threats". PaperCut's own field update on September 10 said new compromises had slowed considerably and that most customers now had the server behind a firewall or on a patched build, while servers that stayed publicly reachable and unpatched were still being hit.

The paths to domain admin also point at older debts. In one of the three routes GreyNoise describes, the actor used a 2021 Active Directory weakness on servers that had never been patched for it. An agent-run campaign does not need a new flaw at every step. It needs one open door and a list of old ones behind it.

Most patch policies rank by severity score. The PaperCut campaign argues for ranking by reach first. A 9.4 on a server nobody outside can see is a scheduling item. An 8.8 on a login page the whole internet can reach is an incident waiting for an agent. The table is our proposed order, built from the three facts this campaign established.

Two related reads. The September advisory from the NSA, CISA and FBI on model distillation, which we covered in what buyers should do about the distillation advisory, is the government's view of how offensive capability spreads between models. And OpenAI's decision to slow its Astra model over cyber capability, described in our post on the Astra cyber threshold, shows a lab drawing the line this campaign crossed with a different vendor's model. GreyNoise notes the agents ran a DeepSeek model, not an OpenAI one, through OpenAI's harness. We make no claim about which model, and none about either company's responsibility.

If you run agents of your own, the campaign is also a mirror. The same harness that ran this attack runs ordinary coding work. Our AI transformation practice scopes agent deployments with the network reach and credentials of each agent written down first, because the do-not-target list is proof that an instruction is not a boundary.