AI Agent Swarm Compromises 440+ PaperCut Systems Across 395 Organizations in 48 Countries

From Empty Workspace to Domain Admin in Hours

What makes this campaign different from ordinary ransomware activity is not the target — PaperCut, a print-management platform widely used by schools, universities, and enterprises, has been exploited before. It is the speed and autonomy of the attack chain. Security researchers who reconstructed the timeline found the attacker went from an empty workspace to first achieving remote code execution against a real victim in under four hours, then to first domain administrator access two hours after that. Once the full campaign launched, the AI agents compromised at least 11 organizations within 26 seconds. In one case, a high school went from initial access to domain administrator in seven minutes.

Those numbers describe a tempo no human-driven intrusion team can sustain across hundreds of simultaneous targets. That is the point: the AI agents were not assisting a human operator on one target at a time, they were running the reconnaissance-to-exploitation pipeline in parallel across the entire target list.

The Tooling Behind the Swarm

The campaign exploited two PaperCut vulnerabilities: CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution flaw — both already flagged as actively exploited before this campaign was identified. The AI agents were orchestrated through OpenAI’s Codex framework paired with a DeepSeek model, reportedly chosen specifically because it carries weaker content-safety restrictions than mainstream Western models, making it more willing to generate offensive security code on request. The agents used a persistent-memory service called Hindsight to retain context across sessions and a unified graphical workspace called AionUi to coordinate their actions, alongside established offensive security tools — Mimikatz, SharpHound, Certipy, Rubeus, and Impacket — for credential harvesting and lateral movement once inside a network.

Post-exploitation activity included Windows registry data collection, Metasploit and Meterpreter Java payloads, and systematic enumeration of hosts, users, processes, and sensitive configuration data — a standard intrusion playbook, but executed by AI agents working through hundreds of targets simultaneously rather than a human team working through them one at a time.

The Scale and Its Limits

Across the campaign, the attacker harvested credentials from 280 victim organizations, obtained operating system or domain secrets from 147, and reached full administrator privileges at only 12 organizations — a reminder that mass automated compromise does not mean mass full takeover. Most victims were touched at the credential-harvesting or reconnaissance stage rather than fully breached, which is itself informative: AI-orchestrated attacks appear to scale the early, repetitive stages of intrusion far more easily than the later stages that still require judgment calls about a specific network’s defenses.

Geographically, the campaign concentrated on the education sector across the US, UK, France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland. Notably, the attacker explicitly excluded 28 countries from targeting, including Russia, China, Hong Kong, Thailand, Iran, Venezuela, Indonesia, Pakistan, and Bangladesh — a targeting pattern researchers have linked to the attacker’s likely origin, since threat actors based in or aligned with a given country routinely avoid targeting it or allied states to reduce legal and diplomatic exposure at home.

Why This Case Matters Beyond PaperCut

PaperCut is almost incidental to the significance of this campaign. What security researchers are treating as the real story is the demonstrated ability of AI agent swarms to industrialize exploitation: take a known vulnerability, automate its discovery and weaponization, and apply it across hundreds of targets in parallel with a fraction of the human labor a traditional campaign of this scale would require. The barrier to mounting a mass-exploitation campaign has dropped from “a skilled team working for weeks” to “one operator directing AI agents for hours.”

What This Means for Algerian and African Organizations

Algeria was not named among the campaign’s targeted countries, but the underlying shift in attacker capability applies everywhere PaperCut, or any similarly common enterprise software, is deployed.

1. Patch cadence now has to assume automated, near-instant exploitation of known CVEs

The exploited PaperCut vulnerabilities were already known and flagged as actively exploited before this campaign. Algerian universities, ministries, and enterprises running PaperCut or comparable print/document-management software should treat “patch available” as “exploit imminent,” not as a routine maintenance item, and should audit exposure to CVE-2026-81578 and CVE-2026-82078 specifically.

2. Education and public-sector institutions are proven soft targets for this style of attack

The campaign concentrated heavily on schools and universities — sectors that often run outdated software with limited dedicated security staff. Algerian educational institutions, many of which manage shared printing and document infrastructure with minimal IT security resourcing, should treat this campaign as a direct warning rather than a foreign curiosity.

3. Build detection around behavior, not just signatures, because AI-generated attack chains move faster than manual ones

Traditional intrusion-detection tuned to human attacker timelines (hours to days between reconnaissance and exploitation) may miss AI-orchestrated campaigns that compress that timeline to minutes. Algerian security operations teams and vendors should prioritize behavioral and anomaly-based detection — unusual authentication patterns, rapid lateral movement, abnormal credential access volume — over signature-based tools alone.

The Broader Warning

This campaign is a proof of concept that happened in the wild rather than in a lab: AI agents, given a known vulnerability and loose direction, can independently research, weaponize, and deploy an exploit across hundreds of organizations faster than most security teams can patch. The tools used — open orchestration frameworks, a permissive open-weight model, off-the-shelf offensive security utilities — are not exotic or hard to obtain. For any organization anywhere, including in Algeria, the lesson is that the cost of running a mass-exploitation campaign has collapsed, and defensive planning needs to catch up to that reality rather than to the slower, human-paced threat model of the last decade.

Frequently Asked Questions

Sources & Further Reading

• PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances — The Hacker News
• AI Agents Used in PaperCut Attacks on 395 Organizations — BankInfoSecurity
• AI-powered attack exploited PaperCut flaws to hack 395 organizations — BleepingComputer
• Third Time’s the Swarm: How AI Agent Swarms Industrialized Exploitation Across 48 Countries — Forkast News
• Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF — GreyNoise