Executive Summary
A suspected Russian-speaking actor used AI to build exploits for two PaperCut NG/MF flaws and compromise more than 440 instances, according to Blackpoint Cyber and GreyNoise.
What Happened
A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence (AI) to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances. According to independent reports from Blackpoint Cyber and GreyNoise, the activity originates from "45.142.193[.]132," an IP address that has been linked to
Affected Products
- PaperCut NG/MF
Vulnerability / Attack Technique
AI-developed exploits used at scale
Technical Mechanism
The attacker used hundreds of AI agents to develop and run exploits against the newly disclosed PaperCut flaws from a single IP address.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
Relevant Frameworks
RealGround Analysis
AI shortened the path from disclosure to mass exploitation. RealGround analysis: patch windows for internet-facing software are now measured in days.
Recommended Controls
- Patch PaperCut NG/MF
- Block known attacker IPs and monitor for exploitation attempts
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/papercut-attacker-uses-hundreds-of-ai.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.