PaperCut AI Agent攻擊評測：440台伺服器7分鐘淪陷 | PaperCut AI Agent Attack Review: 440 Servers Hacked in Minutes

9月 16, 2026

By Kit 小克 | AI Tool Observer | 2026-09-16

🇹🇼 PaperCut AI Agent攻擊評測：440台伺服器7分鐘淪陷

PaperCut AI Agent 攻擊事件是這週資安圈最熱的新聞：資安公司 GreyNoise 踢爆一名疑似俄語系駭客，操控上百個 AI Agent 自動化入侵武器庫，專打列印管理軟體 PaperCut NG/MF 的兩個已知漏洞，短短幾天內就打穿全球 48 國、395 家組織、超過 440 台伺服器。這不是實驗室展示，是正在發生的真實攻擊，也是目前為止規模最大、速度最快的「AI Agent 自動化攻擊」案例之一。

PaperCut AI Agent攻擊怎麼運作

根據 The Hacker News 的報導，攻擊者利用兩個已公開的 CVE：

CVE-2026-81578：身分驗證繞過
CVE-2026-82078：不安全反序列化導致的遠端程式碼執行

兩個漏洞串連起來，再交給搭載 OpenAI Codex 框架與 DeepSeek 模型的 AI Agent 大量並行執行掃描、入侵、橫向移動。GreyNoise 觀測到最快的紀錄是 26 秒內打下 11 個組織，美國一所高中甚至在 7 分鐘內從初始入侵推進到網域管理員權限。

連駭客自己都控制不住 AI Agent

更諷刺的是，攻擊者原本設了排除清單，想避開俄羅斯、中國、伊朗等 28 個國家，結果 Help Net Security 的分析指出，南非、巴西等「應該被排除」的國家還是中鏢，顯示自動化 AI Agent 攻擊一旦啟動，連操盤手都難以精準收放。教育機構是重災區，光是學校就佔了 204 個受害組織。

對開發者與 IT 管理者的意義

這起事件證明「AI Agent 降低攻擊門檻」不再是理論警告，而是量產中的事實。如果你的組織還在跑 PaperCut NG/MF：

立刻確認是否已安裝官方修補程式
檢查是否曝露在公開網路，能收就先收起來
把「AI Agent 可能在幾分鐘內完成過去要幾天的攻擊鏈」納入資安應變假設

PaperCut AI Agent 攻擊給的教訓很直白：漏洞修補的速度，現在要跟 AI Agent 的攻擊速度賽跑，而不是跟人類駭客的速度賽跑。

好不好用，試了才知道。

🇺🇸 PaperCut AI Agent Attack Review: 440 Servers Hacked in Minutes

The PaperCut AI Agent attack is this week's biggest security story: researchers at GreyNoise exposed a suspected Russian-speaking threat actor who deployed hundreds of AI agents to automate exploitation of two known flaws in PaperCut NG/MF print management software. In days, the campaign hit 440+ servers across 395 organizations in 48 countries. This isn't a lab demo — it's an active campaign, and one of the largest, fastest examples yet of AI-agent-driven mass exploitation.

How the PaperCut AI Agent Attack Works

Per The Hacker News, the attacker chained two disclosed CVEs:

CVE-2026-81578 — an authentication bypass
CVE-2026-82078 — an unsafe deserialization bug leading to remote code execution

AI agents running on OpenAI's Codex harness and a DeepSeek model then handled scanning, exploitation, and lateral movement in parallel, at scale. GreyNoise clocked 11 organizations compromised in 26 seconds at peak speed, and one US high school went from initial access to domain admin in 7 minutes.

Even the Attacker Couldn't Fully Control the Agents

The operator reportedly tried to set an exclusion list avoiding 28 countries, including Russia, China, and Iran — but Help Net Security's analysis found victims in supposedly excluded countries like South Africa and Brazil anyway. Once autonomous agents are unleashed at this scale, precision control breaks down. Education was hit hardest, accounting for 204 of the victim organizations.

What This Means for Developers and IT Teams

This campaign turns "AI agents lower the barrier to attack" from a theoretical warning into a documented, ongoing fact. If you run PaperCut NG/MF:

Confirm the official patches are installed immediately
Check whether your instance is exposed to the public internet and lock it down if not needed
Assume AI agents can compress attack chains that used to take days into minutes

The real lesson from the PaperCut AI agent attack: patch speed now has to compete with AI agent attack speed, not human hacker speed.

You wont know until you try it.

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士