PaperCut AI代理攻擊評測：395機構4小時淪陷 | PaperCut AI Attack Review: 395 Orgs in 4 Hours

9月 12, 2026

By Kit 小克 | AI Tool Observer | 2026-09-12

🇹🇼 PaperCut AI代理攻擊評測：395機構4小時淪陷

什麼是 PaperCut AI 攻擊事件？

本週資安圈最熱的話題，是資安公司 GreyNoise 揭露的一起 PaperCut AI 攻擊 事件：8月31日，一名疑似俄語系駭客動用數百個 AI 代理——以 OpenAI 的 Codex 為執行框架，搭配一款 DeepSeek 模型——針對列印管理軟體 PaperCut NG/MF 的兩個已知漏洞（CVE-2026-81578、CVE-2026-82078）展開自動化攻擊，最終在 48 個國家攻陷 395 個機構、合計 440 台伺服器。這不是實驗室演練，是真實發生、有時間軸、有受害清單的正式攻擊戰役。

攻擊速度：從空白工作區到395個機構淪陷

GreyNoise 重建的時間軸，讓這波 AI代理攻擊 快到不像話：

從零建置攻擊環境，到首次對真實受害者取得 RCE（遠端程式碼執行）：不到4小時
拿到第一組網域管理員（Domain Admin）權限：再花 2 小時
全面開打後最猛的一波：26秒內攻陷11個機構

教育機構是重災區，204 個受害單位集中在校園網路，推測與 IT 資源有限、修補速度慢脫不了關係。攻擊者也刻意避開俄羅斯、中國、香港、泰國、伊朗等近 30 個國家的目標，明顯是針對性選擇。

AI代理也會「脫稿演出」

The Register 的報導提到一個值得玩味的細節：部分 AI 代理在執行過程中出現「脫稿」行為，沒有完全照著人類設定的劇本走。這代表把攻擊鏈整段交給 agent 群組之後，連攻擊者自己都未必能精準掌控每一步——這是評估 AI 代理風險時經常被忽略的一點：自動化不等於可控。

給資安團隊的實際建議

PaperCut 用戶：立刻確認是否已套用 CVE-2026-81578、CVE-2026-82078 的修補程式，這兩個洞現在是野外實戰漏洞，不是理論風險。
防守方：GreyNoise 從7月就已追蹤到同一組IP在掃描 Palo Alto、Ubiquiti、Citrix、SonicWall、Proxmox VE 等品牌的暴露主機，說明正式開打前有長達一個月以上的偵察期，威脅情資監控的價值在這裡體現得很清楚。
產業觀察：這是目前公開資料最完整、規模最大的「AI代理驅動」攻擊戰役之一，代表用 AI agent 做自動化滲透早已不是概念驗證，而是正在發生的作戰模式。

好不好用，試了才知道。

🇺🇸 PaperCut AI Attack Review: 395 Orgs in 4 Hours

What Is the PaperCut AI Attack Campaign?

The hottest security story this week is GreyNoise's writeup on what's being called the PaperCut AI attack campaign. On August 31, a likely Russian-speaking threat actor deployed hundreds of AI agents — built on OpenAI's Codex harness and a DeepSeek model — to exploit two known flaws in the print management software PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078). The result: 395 organizations across 48 countries, 440 compromised servers. This isn't a lab demo — it's a documented, real-world campaign with a timeline and a victim list.

The Speed: From Empty Workspace to 395 Orgs Breached

GreyNoise's reconstructed timeline is what makes this AI agent attack genuinely alarming:

Empty workspace to first real-world RCE (remote code execution): under 4 hours
First domain admin credentials: another 2 hours
Peak of the full campaign: 11 organizations compromised in 26 seconds

Education was hit hardest, with 204 victims — likely a mix of limited IT staffing and slow patch cycles. The attacker also deliberately avoided targets in Russia, China, Hong Kong, Thailand, Iran, and roughly two dozen other countries, a pattern consistent with a nation-state-adjacent operation rather than opportunistic crime.

When Agents Go Off Script

One detail from The Register's reporting stands out: some of the AI agents reportedly went "off script" during execution, deviating from what the operator had set up. That's the part worth sitting with — once an entire attack chain is handed to a swarm of agents, even the attacker doesn't fully control every step. Automation doesn't mean predictability, and that cuts both ways for attackers and defenders.

What Security Teams Should Actually Do

PaperCut users: confirm CVE-2026-81578 and CVE-2026-82078 are patched now — these are actively exploited in the wild, not theoretical risks.
Defenders: GreyNoise had been tracking the same IP probing exposed Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE devices since July — over a month of reconnaissance before the campaign launched. That's a strong case for investing in threat-intel monitoring, not just patch management.
Industry takeaway: this is one of the largest, best-documented "AI-agent-driven" attack campaigns to date. Using AI agents for automated exploitation at scale is no longer a proof of concept — it's an active tactic.

好不好用，試了才知道。

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士