AI Agents Breached 395 Orgs via PaperCut. Experts Say the Speed Isn't the Story.

Eleven organizations in 26 seconds is the number everyone quoted when GreyNoise published its report on the AI-run PaperCut campaign. It is also, according to one of the two experts we spoke to, the wrong number to lead with.

The facts first. On September 9, GreyNoise documented a campaign in which a single operator ran hundreds of AI agents, built on OpenAI's Codex paired with a DeepSeek model, against two PaperCut NG/MF flaws (CVE-2026-81578 and CVE-2026-82078). At least 440 PaperCut servers at 395 organizations in 48 countries were compromised. The agents harvested credentials from 280 victims, pulled OS or domain secrets from 147, and reached domain admin at 12. Education accounted for 204 of the victims, about 46 percent.

RelatedOracle PeopleSoft zero-day hit 100+ orgs, breached Nissan

We asked security practitioners what the speed actually changes, who owns the blame, and why schools keep showing up in these lists. Two answers stood out, and they disagree on more than you'd expect.

Four hours, not 26 seconds

Raphaël Peyret spent fifteen years in product across cloud, AI and security, including product lead at Horangi Cyber Security through its acquisition by Bitdefender, and now runs the advisory firm SHA/RP. He thinks the headline figure measures the wrong thing. "26 seconds is throughput, measured after the campaign was built and aimed," he said. "The number I'd lead with is just under four hours, empty workspace to code execution on a live target."

Then he pointed at the calendar. PaperCut published its urgent advisory on Thursday, August 27, with the flaws already being exploited. Researchers at watchTowr broke the first fix within days, which forced a second emergency patch. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on Monday, August 31, the same day GreyNoise says the campaign launched. "The attacker arrived on the first working day after the patch weekend," Peyret said.

His conclusion is not that defenders need to move faster. "Patching here wasn't one action, it was two in a week, on an internet-facing print server, over the last weekend of August," he said. What worked was already in place before the attack: GreyNoise notes that at one target, a Cloudflare web application firewall blocked the attacker outright.

The figure that worries him more is the time from foothold to domain admin, which GreyNoise put at 5 to 144 minutes. "A print server shouldn't reach domain admin at all," Peyret said. PaperCut runs with SYSTEM privileges on Windows by default and is usually joined to the domain. "That's the whole path. The agents didn't build that path, they walked it faster."

The alert queue was never built for this

Corey Ercanbrack, CTO at Vasion, comes at the same problem from the response side. Most security operations, he argues, still quietly assume a person is watching. "An alert fires, someone looks at it, someone decides what to do next," he said. "When a campaign goes from an empty workspace to domain admin in six hours and then, once it's automated, compromises eleven companies in twenty-six seconds, you're not really talking about a slow response anymore, you're talking about a process that was never built to operate on that timescale at all."

His fix sits upstream of the alert. "If the fix depends on someone noticing an alert in a timely manner, it's already lost. The exposure has to be designed out before anything gets a chance to move that fast."

Worth knowing: Vasion sells cloud print management through its PrinterLogic line, a direct competitor to PaperCut, and Ercanbrack says the company built its platform without an internet-facing application server for exactly this reason. That is a commercial position as well as a technical one. It is also the same conclusion Peyret reached with no product to sell: the servers that got owned were reachable, privileged, and patched on a human schedule.

So who is responsible?

Neither source puts it on OpenAI or DeepSeek. "The toolkit was Mimikatz, Impacket, Rubeus, Certipy, SharpHound: free, public, a decade old in places," Peyret said. "The model did coordination, which tells you coordination was the scarce resource, not offensive knowledge." He does think the model providers owe something, though: "What providers owe is abuse operations: hundreds of agents hammering third-party infrastructure from one workspace is a detectable pattern."

RelatedRevolut Breach: Fake Government Requests Fooled Compliance

Ercanbrack frames it as a category problem that predates AI. "Self-hosted, internet-facing application servers have been a recurring source of unauthenticated RCE risk in this category of software for years now, patched in one place, turning up again somewhere else," he said. "What's different this time is how much faster the existing vulnerability can now be found and used once it's out there."

Peyret also pushed back on the idea that a deliberate attack is fundamentally different from AI agents misbehaving inside a lab, as in the OpenAI swarm incident we covered earlier this month. GreyNoise found that the operator carried over a list of 28 countries to avoid, and the agents hit organizations in some of them anyway. "Whatever that boundary was made of, it didn't hold," Peyret said. "Companies handing internal agents real credentials are building the same thing and calling it policy."

Why schools, again

Education was nearly half the victim list, and both sources read that as exposure, not targeting. "Wherever you've got a lot of unpatched, internet-facing instances of the same software sitting around, that tends to be wherever IT budgets and staffing are stretched thinnest," Ercanbrack said. "It's less that attackers went looking for schools specifically and more that schools are often where this kind of exposed, unmanaged infrastructure is still sitting there waiting to be found."

Peyret had the data point to back it. In a 2023 joint advisory, after the Bl00dy ransomware gang went after schools through an earlier PaperCut flaw, CISA and the FBI found that education held about 68 percent of exposed US PaperCut servers. No AI was involved that time. "Schools run large print estates," he said. "The AI changed the tempo, not the target list."

Our take

The 26-second figure is great for headlines and not much use to the person running a print server. The two practical lessons here are older than any AI model: don't leave privileged, domain-joined software open to the internet, and don't build a defense that only works once a human reads an alert. GreyNoise's own data shows the one thing that stopped these agents outright was a WAF that was already switched on. If you run PaperCut NG or MF, our earlier patch guide covers the fixes. After that, the question to ask is what your print server can reach once someone owns it.

Quotes gathered directly by GENZ TECH from sources who volunteered to comment on this story, with full attribution. Disclosure: Vasion, where Corey Ercanbrack is CTO, sells print management software that competes with PaperCut.