INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Codex and DeepSeek AI Agents Breach 440 PaperCut Servers

| 2026-10-16 13:56 LOW MEDIUM AI-ENABLED ATTACK · AUTONOMOUS DATA BREACH
JSON
Executive Summary
AI-generated
A cybercrime campaign used hundreds of AI agents to target internet-facing PaperCut NG and MF print-management servers, compromising at least 440 instances linked to 395 organizations in 48 countries. The operation paired OpenAI's Codex coding-agent harness with a DeepSeek model and common security tools, allowing the operator to develop and test exploits. According to GreyNoise, this campaign affected multiple organizations worldwide, including PaperCut NG and MF, which were exploited by hackers using AI agents codenamed Codex and DeepSeek. The breach was reported on Cyber Security News, highlighting the vulnerability of internet-facing servers to sophisticated cyber attacks.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 8 IoCs Create Free Account
hxxp://••••••••••••••••••••
hu•••••.io
45.142.•••.•••
45.158.•••.•••
fc92df••••••••••••••••••••••••••
a6437a••••••••••••••••••••••••••
ce870a••••••••••••••••••••••••••
528cd4••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎2026/10/16
Threat actors used OpenAI's Codex coding-agent harness paired with a DeepSeek model and common security tools to breach 440 PaperCut servers worldwide.
organisation PaperCut NG
A cybercrime campaign used hundreds of AI agents to target internet-facing PaperCut NG and MF print-management servers, compromising at least 440 instances linked to 395 organizations in 48 countries, according to GreyNoise.
organisation MF
A cybercrime campaign used hundreds of AI agents to target internet-facing PaperCut NG and MF print-management servers, compromising at least 440 instances linked to 395 organizations in 48 countries, according to GreyNoise.
victims 395 organizations
A cybercrime campaign used hundreds of AI agents to target internet-facing PaperCut NG and MF print-management servers, compromising at least 440 instances linked to 395 organizations in 48 countries, according to GreyNoise.
organisation OpenAI’s
The operation paired OpenAI’s Codex coding-agent harness with a DeepSeek model and common security tools, allowing the operator to develop and test exploits […] The post Hackers Use Codex and DeepSeek AI Agents to Breach 440 PaperCut Servers Worldwide appeared first on Cyber Security News .
organisation Cyber Security News
The operation paired OpenAI’s Codex coding-agent harness with a DeepSeek model and common security tools, allowing the operator to develop and test exploits […] The post Hackers Use Codex and DeepSeek AI Agents to Breach 440 PaperCut Servers Worldwide appeared first on Cyber Security News .
Tactical Metrics
Metrics
victims
395
Organizations
A cybercrime campaign used hundreds of AI agents to target internet-facing PaperCut NG and MF print-management servers, compromising at least 440 instances linked to 395 organizations in 48 countries, according to GreyNoise.
Intelligence Sources
AlienVault OTX 2026-10-16