PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

A suspected Russian-speaking threat actor exploited two newly disclosed vulnerabilities in PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078), compromising over 440 instances — many in the education sector — before patches could be widely applied. The use of hundreds of AI agents allowed the attacker to dramatically accelerate exploitation at a scale and speed that traditional manual attacks could not match, moving from initial access to domain administrator privileges with alarming efficiency. This incident illustrates that the window between vulnerability disclosure and active exploitation is shrinking to near-zero, especially when adversaries leverage AI to automate offensive operations. Organizations that lack rapid patch deployment processes and compensating controls are increasingly exposed in this new threat landscape.