An AI agent swarm took 440 PaperCut servers

Two weeks ago we told you to patch PaperCut today. Now we know what "today" was worth. GreyNoise published a reconstruction of the campaign on September 11, and the headline is not the CVE — it is the operator. A single threat actor pointed hundreds of AI agents at the internet and compromised at least 440 PaperCut servers at 395 organizations across 48 countries. The AI agent swarm went from an empty workspace to remote code execution on a live victim in under four hours.

What actually happened

Per GreyNoise's report, the operator started August 31 by building and testing exploits in a self-hosted lab, then scaled out. The stack was unremarkable and that is the point: OpenAI's Codex as the harness, a DeepSeek model doing the reasoning, Netlas.io for internet-wide target discovery, and off-the-shelf offensive tooling. Nothing bespoke. Nothing that cost real money.

The exploit chained the two bugs PaperCut disclosed in late August — CVE-2026-81578 (unauthenticated config change) and CVE-2026-82078 (arbitrary Java bytecode execution) — into pre-auth RCE on the application server.

The clock is the part to sit with:

• Under 4 hours from first exploit development to RCE on a real victim
• 2 hours after that to first domain admin
• 11 organizations in 26 seconds once the campaign went wide
• 7 minutes from initial access to domain admin at one U.S. high school
• Of the 12 orgs where domain admin landed, 5 minutes was the fastest, 144 the slowest

Downstream: credentials harvested at 280 organizations, OS or domain secrets pulled from 147. Education took the worst of it with 204 victim organizations, and the U.S. led by country with 98.

Two details deserve more attention than they will get. The agents drifted off their instructions — GreyNoise observed hits in countries the operator had explicitly excluded, including Russia and China. And per Help Net Security, boring hardening worked: a Cloudflare WAF stopped the thing cold at least once.

Why an AI agent swarm changes your patch window

You have been budgeting patch urgency against a human attacker's calendar. That budget is gone.

Your patch window is hours, not weekends. The old model assumed a gap between disclosure and mass exploitation: a vendor advisory makes the rounds, someone weaponizes it, scanning ramps. A swarm collapses all three into one afternoon. A maintenance window that runs "next Saturday" is not a patch process, it is a hope.

Exposure is the variable you control. PaperCut's guidance is to keep the Application Server off the public internet. Most of these 440 boxes were reachable because somebody wanted print release to work from home in 2021 and nobody revisited it.

The victim profile is the tell. Schools, small professional services firms, MSPs, non-profits — not because they were chosen, but because they were reachable, and a swarm does not triage. Being small used to mean being uninteresting. It now means being cheap to attack.

The move this week is unglamorous: list every server in your business with a public port, and for each one answer why. Then patch the ones you cannot justify closing, and close the rest.

Sources: GreyNoise: Agents Gone Wild — An AI-Orchestrated Global Campaign Against PaperCut NG/MF, Help Net Security, BleepingComputer.