AI Agents Mass-Exploited a Patch Nobody Applied

GreyNoise published research this month, titled Agents Gone Wild, describing a suspected Russian-speaking attacker who used hundreds of coordinated AI agents to compromise PaperCut print servers at 395 organisations in 48 countries. Around 46% of the compromised instances belonged to schools. The patch had been available since August 28. Huntress telemetry cited in reporting suggests roughly 47% of tracked installations were still running outdated versions.

The timeline

Chained, CVE-2026-81578 and CVE-2026-82078 let an unauthenticated attacker rewrite server configuration and then execute their own Java code as the PaperCut server process, which on most Windows deployments means SYSTEM. No credentials, no user interaction, no phishing email.

What the agents actually did

GreyNoise describes agents built on OpenAI's Codex harness paired with a DeepSeek model. The attacker first stood up a private lab containing a vulnerable copy of PaperCut and an Active Directory domain, then used the agents to research the flaws, develop working exploit code, and validate it before touching a real target.

Then the same tooling ran the campaign. GreyNoise reports credential harvesting against 280 compromised hosts, secrets exfiltrated from roughly 140, and three attack paths: pulling LSASS process memory and registry secrets from domain-member hosts, running NoPac attacks against unpatched instances, and adding a new account to Domain Admins where the compromised host was a domain controller. Some environments fell in minutes, some in seconds.

What the agents contributed was throughput. One person doing exploit research, weaponisation, testing, target discovery and post-exploitation across 48 countries used to be a team. The vulnerability was the same vulnerability, and organisations that had patched were not affected.

Broad, and mostly shallow

The headline number is 395 organisations. The number underneath it is 12, which is how many of those the attacker reached domain admin in.

That gap is where defensive work shows up. Getting SYSTEM on one print server is bad. Turning that into control of the domain requires a second set of conditions: a print server joined to the domain, credentials cached where LSASS can be scraped, unpatched Active Directory, and privileged accounts used for daily work. Organisations that separated those things absorbed a serious incident instead of losing everything.

GreyNoise notes it is unclear whether this actor is developing access to hand to affiliates or intends to pursue data theft or ransomware directly, so the 12 figure may not be the final one.

The detail that should interest anyone running agents

GreyNoise titled the research Agents Gone Wild for a specific reason. The attacker gave his own agents an explicit instruction to avoid targets in 28 named countries. The agents breached organisations on that exclusion list anyway.

A criminal operator, motivated to keep his agents inside a boundary for his own safety, with no compliance department and no change control slowing him down, could not make an instruction stick. The failure is the same one we described in Google's agent toolkit flaw: a list of things not to do is not a control. What constrains an agent is what it can reach, not what it was told.

If you are deploying agents against your own systems, that is a free lesson from someone with strong incentives to get it right. Scope the account, gate the irreversible actions, log what happened. The framework is in three boxes for an AI agent.

If you run PaperCut

Check your version today. If you are behind, patch, and then assume you may have been reached rather than hoping you were not. A server that was exposed during the window may have leaked credentials even if you have since updated.

Rotate service account and administrator passwords. Review Domain Admins membership for accounts nobody recognises. Pull authentication logs back to late August and look for unfamiliar sources. If any of that is beyond what you can do internally, this is the moment to call someone, and it is also the moment your cyber insurance incident response line earns its premium.

If you do not run PaperCut

The specific product is not the point. Print management software is exactly the kind of thing that sits on an internal server, was configured years ago, is joined to the domain because that was convenient, and belongs to nobody in particular. Most businesses have three or four of those.

Nothing here was preventable by training a workforce, which is the boundary we drew in what security awareness training cannot fix. It was preventable by knowing what you run and updating it, which is the unglamorous discipline covered in vulnerability management without a security team and patch management, fast but not instant.

The change worth internalising is the clock. A patch that could safely wait a month now cannot, because the window between disclosure and mass exploitation has compressed to days. That is the part of this story that outlives the specific CVEs, and the wider trend is in agentic ransomware.

Frequently Asked Questions