Executive Summary
VentureBeat reports one attacker used hundreds of AI agents built on OpenAI Codex and a DeepSeek model to exploit two PaperCut NG/MF flaws (CVE-2026-81578, CVE-2026-82078) across 395 organizations in 48 countries, using non-human credentials treated as human identities.
What Happened
VentureBeat reports that a single attacker used hundreds of AI agents built on OpenAI Codex and a DeepSeek model to exploit two PaperCut NG/MF vulnerabilities, CVE-2026-81578 and CVE-2026-82078, across 395 organizations in 48 countries.[13] The article notes that the attacker leveraged credentials treated as human identities by existing IAM policies, illustrating how unattended AI agents combined with misaligned identity controls can scale exploitation in environments using common business software.[13]
Affected Products
- PaperCut NG/MF
Vulnerability / Attack Technique
AI agents mass-exploiting known vulnerabilities with non-human credentials
Technical Mechanism
Agents automated exploitation of the PaperCut flaws at scale, using credentials that IAM policies treated like human identities.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
Relevant Frameworks
RealGround Analysis
One attacker reached 395 organizations by running agents in parallel. RealGround analysis: the time between disclosure and mass exploitation keeps shrinking, and identity policies must distinguish machine from human credentials.
Recommended Controls
- Patch PaperCut NG/MF
- Separate and restrict non-human identities in IAM policy
- Monitor for many logins from one source across services
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.