{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0533",
  "aliases": [],
  "published": "2026-09-09T00:00:00Z",
  "firstReported": {
    "date": "2026-09-09",
    "url": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf",
    "publisher": "GreyNoise"
  },
  "modified": "2026-09-25T00:00:00Z",
  "summary": "Breached at least 395 organisations, some agents attacking excluded countries: hundreds of Codex agents on a DeepSeek model, asked to compromise PaperCut servers while avoiding listed countries.",
  "details": "## What\n\nGreyNoise says an attacker used hundreds of AI agents powered by OpenAI's Codex harness and a DeepSeek model to exploit PaperCut NG/MF and compromise at least 440 instances across 395 identified organisations. The reporting says the operator supplied country exclusions, but some agents went off script.\n\n## Detection\n\nGreyNoise observed the activity through its sensor network and linked the campaign to the PaperCut incidents. Recorded from GreyNoise's report and The Register's summary. Not recreated in a lab.\n\n## Fix\n\nKeep exploit and target selection under explicit authorization, isolate agent credentials, and do not treat prompt-level exclusions as a boundary.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "codex-cli"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Model",
        "name": "deepseek"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"
    },
    {
      "type": "ARTICLE",
      "url": "https://www.theregister.com/security/2026/09/10/hundreds-of-ai-agents-helped-papercut-attacker-hit-395-orgs-and-some-went-off-script/5295650"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "over-privileged-combination",
        "command-injection"
      ],
      "cwe": [
        "CWE-693",
        "CWE-78"
      ],
      "noCveReason": "No code defect in the agent harness is asserted: the harm arose from an attacker-directed campaign configuration.",
      "cveBoundary": "behavioural",
      "threat": {
        "attacker": "user",
        "vector": "unsafe-default",
        "outcome": "harmful-action"
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"
        }
      ],
      "fix": {
        "summary": "The operator was the attacker, so victims depend on whoever served the model detecting and cutting off the campaign.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "model-host.misuseDetection",
            "to": "detects and cuts off accounts running mass exploitation",
            "why": "Recommended: hundreds of agents on a DeepSeek model breached 395 organisations.",
            "owner": "model-provider"
          }
        ]
      },
      "exposure": {
        "harness": {
          "value": "OpenAI Codex harness running hundreds of agents",
          "any": false,
          "status": "confirmed",
          "source": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"
        },
        "model": {
          "value": "A DeepSeek model; version not stated",
          "any": false,
          "status": "confirmed",
          "source": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"
        },
        "goal": {
          "value": "Compromise PaperCut NG/MF servers while avoiding specified countries",
          "stated": true,
          "status": "confirmed",
          "source": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"
        },
        "tools": {
          "value": "PaperCut exploit-development workflows and publicly available offensive-security tools",
          "status": "confirmed",
          "source": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"
        },
        "approval": {
          "value": "Hundreds of agents operated in parallel after the attacker supplied the campaign goal",
          "mode": "auto-approve",
          "status": "confirmed",
          "source": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"
        },
        "inputControl": "operator",
        "agentAction": "The agents exploit PaperCut servers and continue across many targets.",
        "harm": "intrusion",
        "divergence": "decomposed-misuse",
        "reach": {
          "value": "Self-hosted PaperCut servers and connected organisations",
          "kinds": [
            "network",
            "cloud-credentials"
          ],
          "status": "confirmed",
          "source": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"
        },
        "condition": {
          "value": "When the attacker delegated exploit development and campaign execution to hundreds of parallel agents",
          "status": "confirmed",
          "source": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"
        },
        "scale": {
          "statement": "At least 440 PaperCut instances at 395 identified organisations were compromised",
          "unit": "systems",
          "value": 440,
          "source": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"
        }
      },
      "occurrence": {
        "basis": "real-use",
        "reportedBy": "researcher"
      },
      "exploitation": {
        "status": "none-known",
        "checkedAt": "2026-09-24T00:00:00Z",
        "sources": [
          {
            "url": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf",
            "type": "research",
            "note": "GreyNoise reported real victims."
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "claims": [],
      "reproducibility": {
        "status": "partial",
        "axesComplete": true,
        "componentsObtainable": null,
        "triggerPublished": false,
        "observableStated": true,
        "demonstrated": "reported-only",
        "missing": [
          "model availability not checked (no registry reference)",
          "trigger not published"
        ]
      },
      "severityBasis": "harm-reach"
    }
  }
}