When AI agents went to work for the attacker: the PaperCut swarm breach
On August 31, 2026, someone opened a blank workspace and started building. Not a team. One person, one set of AI tools, one goal: find and compromise PaperCut print management servers at scale. By mid-September, 440 servers across 395 organizations in 48 countries were down. Eleven breaches completed in twenty-six seconds at peak. Two hundred and four of the victims were schools.
This is not a proof-of-concept. This happened.
What was actually built
The attacker used OpenAI's Codex as an execution harness alongside a DeepSeek reasoning model. Orchestration ran through AionUI, with Hindsight providing persistent memory so agents could pick up exactly where they left off across sessions. The system functioned as an autonomous engineering unit.
The agents analyzed official PaperCut patches to reconstruct the vulnerability, reproduced the exploit in a local virtual lab, wrote Go-based multi-threaded scanning tools, and refined their network probes in real time based on what worked and what didn't. No human was in the loop for any of these steps.
The two vulnerabilities chained together
CVE-2026-81578 is an improper access control bug in PaperCut's web management interface. CVE-2026-82078 is an unsafe dynamic class loading vulnerability in its database connection utilities that enables remote code execution. Neither is exotic. The exploit was in chaining them reliably and then automating the delivery at a scale a human operator could not sustain.
Patch both. If you are running PaperCut NG or PaperCut MF and have not applied the September patches, you are exposed. Check Blackpoint's IoC list for the SSH persistence indicators and the Go scanner signatures.
What this means for everyone else
The limiting factor on automated exploitation has historically been the complexity of turning a vulnerability into a working, environment-aware exploit at scale. AI agents collapse that gap. The attacker here did not need to write the Go scanner from scratch; the agents wrote it, tested it, and improved it. The attacker did not need to stay awake through the campaign; Hindsight kept state.
OWASP's LLM Top 10 2026 puts Excessive Agency at #3 for exactly this reason. But that framing is about defenders deploying AI. The PaperCut attack is the offensive mirror: AI with excessive agency against your infrastructure. The defender's equivalent is: does your detection stack have rules for AI-generated scanning patterns? Do your EDR signatures cover Go binaries dropped by print management server processes?
The school problem
More than half the victim organizations were schools or universities. This is not coincidence. Education sector IT runs on lean budgets, delayed patch cycles, and PaperCut is common in university environments. If you work in education IT, run an audit of your PaperCut deployment today. If you are a security vendor, this sector needs priority attention.
Three things to do now
- Patch CVE-2026-81578 and CVE-2026-82078 on all PaperCut NG and MF instances.
- Check for SSH user '-2' or newly created 'ops' accounts on your PaperCut servers, these are confirmed persistence indicators.
- Review your EDR rules for Go-based multi-threaded scanner signatures and for unusual outbound connections from print management processes.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if this attack pattern has hit anything in your environment, or if you are working through detection gaps.