What happened
Agents developed and tested PaperCut exploits, built target lists, exploited internet-facing servers, harvested credentials and secrets, and executed Active Directory escalation paths.
2026-09-09
CriticalPrimaryGreyNoise Observes Hundreds of AI Agents Compromise at Least 440 PaperCut Instances
Analysis of GreyNoise's 2026 report on hundreds of Codex-driven agents used to exploit PaperCut, harvest credentials, and reach domain admin.
OpenAI Codex harness / DeepSeek modelCredential exposureAttacker-operated AI-orchestrated exploitation campaignInternet-facing self-hosted PaperCut NG/MF servers and connected Active Directory domains
Why it matters
GreyNoise counted 440 compromised instances, credential harvesting at 280 victims, operating-system or domain secrets at 147 victims, and domain-admin access at 12 organizations.
Missing authorization check
Victim environments lacked an external fail-closed authorization gate around privileged credential use and consequential directory or infrastructure mutations after initial compromise.
Would PP block it?
At an integrated victim boundary, PP could require a separate receipt before privileged account creation, directory changes, deployments, or other protected mutations. It would not patch CVE-2026-81578 or CVE-2026-82078, stop scanning, prevent initial RCE, or block credential reads on systems without enforcement.
Incident analysis
Timeline and technical read
Timeline
2026-08-31
GreyNoise observes the actor begin AI-assisted PaperCut exploit development and testing.
2026-08-31
The actor reaches first real-victim RCE in under four hours and first domain admin roughly two hours later.
2026-09-09
GreyNoise publishes its campaign analysis and victim counts.
Technical breakdown
- The campaign targeted PaperCut authentication-bypass CVE-2026-81578 and unsafe-reflection RCE CVE-2026-82078.
- Hundreds of Codex-harness agents using a DeepSeek model executed parallel exploitation workflows.
- Observed escalation paths included LSASS and registry-secret harvesting, noPac exploitation, privileged account creation, DCSync, and NTDS.DIT exfiltration.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- Protected Active Directory mutations, privileged credential use, and consequential infrastructure APIs
- Still needs
- Vulnerability remediation, perimeter defense, local memory and registry reads, internet scanning, and attacker-controlled infrastructure are outside PP coverage.
- Receipt required for
- Creating privileged accounts, changing directory roles, deploying payloads, or using recovered credentials for protected state changes
PP would not prevent exploitation of vulnerable public PaperCut servers or constrain agents operating on attacker-controlled infrastructure.
Related incidents and controls
Critical2026-07-01
JADEPUFFER: First Confirmed Autonomous AI-Agent Ransomware and AI-Model Destruction Campaign: Exploited Langflow CVE-2025-3248 to Chain Credential Theft, Lateral Movement, and Ransomware Payloads Specially Built to Wipe AI Models
High2026-07-31
Palo Alto Unit 42 Discloses Chinese Threat Actor Using Telegram to Drive DeepSeek and Hermes Agents to Autonomously Exploit 460+ Targets
Start small
Put the relevant gate at this action boundary.
This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.