On September 9, 2026, GreyNoise and Blackpoint Cyber each published analyses of an exploitation campaign against PaperCut MF and NG print management servers that was run with AI agents. GreyNoise counted at least 440 compromised PaperCut instances at 395 organizations in 48 countries, and said the operator used OpenAI's Codex and a DeepSeek model to drive the work. The campaign chained two vulnerabilities, CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution flaw. Education was the most-hit sector, with 204 victims.
GreyNoise's timeline is the striking part. Going from an empty workspace to the first remote code execution took just under four hours, and reaching the first domain administrator account took about two hours more. Once the campaign was launched in earnest, at least 11 organizations were compromised in 26 seconds. The fastest domain admin takeover, against a US high school, took 5 minutes; the slowest took 144 minutes. Of the victims, 280 (63.6 percent) had credentials harvested, 147 (33.4 percent) lost operating system or domain secrets, and 12 (2.7 percent) were taken to domain admin. The operator kept an exclusion list of 28 countries, which GreyNoise says did not always hold.
Blackpoint's analysis of the operator's tooling fills in the machinery: a master list of 4,107 unique IP addresses, 200 concurrent processing threads, a research phase that began August 31 and a full campaign runner deployed by September 1, with operations continuing through at least September 3. Its conclusion is more measured than the headline numbers. The AI's biggest contribution, Blackpoint says, was reducing human effort in research, debugging and campaign maintenance, not inventing new exploitation techniques.
That is the honest reading. Nothing here required novel hacking; two known bugs in an unglamorous piece of office software were enough. What the agents changed was tempo and scale - the gap between a vulnerability being public and hundreds of schools being inside an attacker's reach shrank to hours. Defenders who still treat patch windows in weeks are now racing something that does not sleep.