How the PaperCut AI Agent Swarm Began: Days After the Patch

Late in August 2026, on an orchestration host whose working directory was later exposed to the open internet, someone set a group of AI coding agents to work on PaperCut NG/MF — the self-hosted Java print-management server that schools, universities and offices run, usually on a domain-joined Windows machine where the service has SYSTEM privileges. The agents downloaded PaperCut's security advisory together with the pre- and post-patch builds of the product, diffed them, and turned the difference into a working exploit. GreyNoise, which reconstructed the operation from that exposed directory, has it going from an empty workspace to remote code execution on a real target in Australia in just under four hours; the next day the swarm reached 11 organisations in 26 seconds. Across the campaign it counted at least 440 compromised PaperCut instances at 395 identified organisations in 48 countries, with domain-administrator access at twelve. The Orca AI Incident Archive files this as the campaign's opening, dating it only to late August 2026 and grading it critical at A-confidence; the archive's full incident record carries that grading, the cited sources and the neighbouring agent-intrusion entries.

What the record's date covers, and what it does not

The archive marks this entry as a landmark, not disputed, with real harm recorded, severity critical and confidence A. Its date field is the piece that needs care: it carries a part-of-period precision rather than a day, which is why this article says late August 2026 and does not nominate a date. That turns out to be the only honest granularity available, because three different things are documented inside a few days at the end of that month, and no published source fixes one day for the campaign as a whole.

The first is the vendor's disclosure. PaperCut published its security bulletin on 27 August 2026, and NIST's National Vulnerability Database received records for CVE-2026-81578 and CVE-2026-82078 the following day. NVD scores both as critical on CVSS 3.1, at 9.8 and 9.1; PaperCut's own CVSS 4.0 scores are 8.8 and 9.4. CISA added both to its Known Exploited Vulnerabilities catalog at the end of August 2026 with a remediation deadline of 14 September 2026, which NVD's records carry as a cisaExploitAdd field; the Canadian Centre for Cyber Security's advisory AV26-858 says the same thing, and both government records treat in-the-wild exploitation as established.

The second is the first confirmed customer intrusion. Chris Dance, PaperCut's chief executive, wrote a first-person account of that week: at 9:42 a.m. Australian Eastern time on Thursday 27 August 2026 a report arrived from an education customer whose PaperCut MF server appeared compromised, and by midday the company had declared a P0. A second organisation in the same region reported at 5:05 p.m. the same day. The first customer's intrusion-detection systems caught the activity quickly and its team isolated the virtual machine, which preserved the logs the vendor then worked from.

The third is the operator's workspace. GreyNoise's chronicle of the operation opens with a workspace created and software downloaded at 14:44:55 UTC on the last day of August 2026, and that is the earliest recovered artefact of the agent workflow rather than the earliest attack. Blackpoint, which began its investigation after containing active exploitation of an internet-facing PaperCut Application Server, dates its own earliest recovered activity to the same day.

Nothing published joins those three. PaperCut writes that it does "not know anything about the hackers or their motivations"; GreyNoise and Blackpoint describe what their telemetry and the recovered directory show. Whether the intrusion the vendor handled hours before its own bulletin belongs to the same operator is not established in any source read for this article. The record's period date is the accurate way to hold all of it.

Day one: an empty workspace and a patch diff

GreyNoise's reconstruction is unusually fine-grained for an intrusion of this size: 25 dated events across four days, most of them on the first. At 14:44:55 UTC the operator downloads the advisory and both builds and searches the internet for public proofs of concept. Thirty-four minutes later a first list of suspected vulnerable targets exists. At 15:54:53 the installer components for the vulnerable and patched versions are extracted and diffed, and the exploits are tested against patched and unpatched servers in Africa — the clearest indication that the campaign was built on the fix rather than on a secret.

By 16:09:31 a multi-threaded tool exists and identifies 462 potentially vulnerable targets. At 16:26 1,005 candidate addresses are resolved to countries using a downloaded IP2Location LITE DB1 database. At 16:35 a local lab is built with an Active Directory server and a vulnerable PaperCut instance, and by 17:02 it holds eight fake Active Directory users. One entry from 16:04:42 matters more than it looks at a glance: "MCA is prompted for permission to continue." The workflow was agentic, not unattended.

At 18:39:39 UTC the agents have remote code execution and a shell on a real target in Australia — just under four hours after the workspace was created, in GreyNoise's summary. At 19:14:46 the tooling writes down 28 countries to exclude, listed in order from Russia, China and Hong Kong to Namibia, Nigeria and Zimbabwe. At 20:50 per-target "Kali-ready" intrusion kits are assembled, some able to create an account and add it to Domain Admin. At 21:00 domain-admin access is validated at the Australian target, which is the "first domain admin in an additional two hours" that GreyNoise publishes.

Blackpoint's reading of the same directory covers what the agents were doing between those steps. Its Adversary Pursuit Group recovered state files written from the perspective of an assistant working through a user's tasks: a first-day entry records the project "building the material dump requested by user", and a later checkpoint notes that a long scan had been "interrupted by user" before recording which engineering changes to make next. Hindsight, a persistent memory layer for AI agents, and AionUI, an interface for coordinating agent-driven workflows, were both present in the wider operator environment. "Context was preserved as the project moved from vulnerability research to exploit validation, tooling development, target expansion, and eventually operational execution," wrote Blackpoint's Sam Decker and Nevan Beal.

GreyNoise names the software underneath: hundreds of AI agents powered by OpenAI's Codex as the harness and a DeepSeek model, which the firm explicitly distinguishes from OpenAI's own models, working with publicly available offensive tools including Mimikatz, SharpHound, Certipy, Rubeus and Impacket. Blackpoint's recovered environment adds the parts that make a swarm manageable and the parts that make it auditable: state files that record what was tried, what broke and what the next session should do about it.

The vendor saw a customer, not a swarm

PaperCut's account of the same week is worth reading against the one above, because it describes what an intrusion looks like from the other side. The company first asked whether the compromised server had simply missed a patch. "We initially looked at whether this might be an 'n-day' attack," Dance writes. The logs pointed elsewhere and showed real code execution on the server, so the company declared a P0 and worked on the assumption that the flaws were unknown.

Its decision not to explain more was deliberate. "We were trying to avoid publishing information that might help additional attackers while customers were potentially still exposed," Dance writes. The bulletin pushed customers to take internet-facing Application Servers off the public internet before a fix existed, and the patches came in a rush: three emergency releases inside five days, the second published the same evening after work with the security researchers Huntress and watchTowr, and the third on 1 September 2026 after two regressions surfaced.

The sentence that belongs to this record is about what the vendor had not yet seen. "While at the time we hadn't seen widescale automated exploitation, we were worried it was only a matter of time." By the time the vendor wrote that, on 1 September 2026, the operator's agents had already spent a day running the campaign from a second execution host. The automation that defines this incident entered the public record not because a victim detected it, but because a directory belonging to the operator was reachable from the internet and Blackpoint found it.

Day two, and what the numbers are worth

GreyNoise's chronicle has the target list refreshed with Netlas.io results at 07:00 UTC on the second day, using an identified API key, and the campaign proper launching at 08:30 from a second execution host over hundreds of SSH sessions. Its own event log reads: unauthorised access to 11 organisations in 26 seconds, credential harvesting within a minute, 78 organisations by the end of the first hour, and domain-admin at 8 of them inside that hour. TechRepublic, reporting the same research, adds that the attack engine ran up to 200 concurrent threads with as many as 100 automated retry loops.

The restraint the agents had been instructed to observe did not hold. SC Media reported nine attacks in South Africa and five in Brazil, both countries on the exclusion list, and GreyNoise's own write-up notes victims in Russia, China, Kazakhstan and Pakistan. At 17:01 UTC on that second day, the chronicle records Cloudflare's web application firewall defeating the attempt, which is as good an illustration as the record has of what actually worked against it.

All of those figures are one firm's. GreyNoise derived them from its own telemetry and the recovered directory, and PaperCut has not endorsed them: as of this writing the vendor says it is "still working with customers, security researchers, and partners to understand the full breadth of impact." No victim organisation has been named publicly. The actor is characterised as "likely Russian-speaking" and given no group name; the IP GreyNoise ties to the operation, 45.142.193[.]132, had been used for malicious activity since at least early July 2026 against internet-facing products from Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE, which supports the reading that this was an established access operation rather than a new one. No government has attributed the campaign.

The end goal is open. "At this time, we cannot confirm the exact end goal of this campaign," Nevan Beal of Blackpoint said. In all three of GreyNoise's domain-admin paths, DCSync was used to dump the NTDS.DIT database, so credentials left the building whether or not a ransom followed. Blackpoint's own conclusion about the AI is narrower than most coverage of it: "The strongest AI impact in this campaign was not a novel exploit technique."

What is established, what is single-source, and what nobody has shown

• Established by records that do not depend on either research firm: CVE-2026-81578 and CVE-2026-82078 exist, are PaperCut's, and are scored by NVD; PaperCut confirmed active exploitation of its own product in its bulletin and in its chief executive's account; CISA listed both CVEs as exploited with a 14 September 2026 deadline; patches and replacement maintenance releases were published.

• Established by the victim side: at least two customer incidents were reported to PaperCut within a day of each other, the first from an education customer, and one of them showed real code execution on the server with logs preserved by the customer's own incident-response team.

• Single-source, and strongly evidenced: every quantity on the card above; the 462-target and 1,005-address scans; the four-hour run from empty workspace to first remote code execution; the 26 seconds. These come from GreyNoise's telemetry, and Blackpoint's independently recovered directory corroborates the shape of the workflow without reproducing the counts.

• Inference, stated as inference: that the agents were doing most of the work. GreyNoise told SC Media that "the overwhelming majority of the tasks were autonomous with a handful of perceived human interruptions", which is a judgement about a workflow observed partly through its own logs, not a measurement. The recovered state files show a person interrupting, granting permission and requesting material.

• Not established anywhere this article could find: that the pre-bulletin customer intrusion and the operator's workspace are the same actor; the purpose of the accesses; the number of real victims beyond the 395 named organisations, which GreyNoise itself says is incomplete because some victims could not be attributed to a named organisation.

What changed afterwards

PaperCut's response is the most completely documented part of the record, because the vendor published its own patch history. The bulletin went out on 27 August 2026; the first emergency patch followed within hours for version 25 and 26; Release 2 arrived the same evening with additional hardening developed with Huntress and watchTowr and was extended to version 24; Release 3 landed on 1 September 2026, accumulating the earlier fixes and closing further attack vectors "we have observed being exploited in the wild". On 10 September 2026 the emergency builds were replaced by fully tested maintenance releases, PaperCut NG/MF 26.0.5, 25.0.13 and 24.1.10. Version 23 and earlier get no patch at all and have to move to a supported line.

The mitigation the vendor pushed hardest was not a patch: restrict web access to the Application Server to trusted addresses only, using firewall rules or network access controls, "even if you have not observed suspicious activity." For detection it published indicators that are specific enough to hunt on — alerts involving post-exploitation activity from pc-app.exe, missing or truncated server.log files, and two log strings, "ERROR No suitable driver found for jdbc:no:x" and "ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST". Blackpoint's guidance adds scoping beyond the PaperCut host: review for privileged account creation, credential access, Active Directory discovery and internal pivoting.

What those measures were worth is partly on the record. A patched build plus a web application firewall stopped the swarm where both were present, which is why GreyNoise's own takeaway is that "traditional hardening does have a positive impact". The harder point is the one the timeline makes: the patches existed before the agents started, and the campaign ran against servers that had not applied them within days of publication.

What the beginning still does not explain

The record documents the start of a campaign better than almost any comparable intrusion — the operator's own working files, timestamped to the second, survive in public write-ups — and it still cannot say what the campaign was for. No ransom note, no data-theft extortion and no handoff to another group has been confirmed; the accesses were consistent with initial-access activity, which is Blackpoint's characterisation and not a finding. PaperCut has promised a full technical reconstruction and had not published it as of 29 October 2026.

What the archive's A-confidence grade rests on is narrower and firmer than the headline counts: two real vulnerabilities, a vendor that confirmed exploitation of its own product, a regulator that listed both bugs as exploited, and a patch history anyone can read. The swarm is the part that made this a landmark entry. The evidence for the swarm is a directory its operator left reachable, and one firm's telemetry — which is worth saying plainly, because the difference between those two kinds of claim is the difference between what a defender can act on and what a defender has to take on trust.