AI agents hit 440 PaperCut servers; 12 fell fully

On August 31, 2026, one attacker used hundreds of AI agents to break into at least 440 PaperCut servers at 395 organizations in 48 countries within a matter of hours. The threat intelligence company GreyNoise published its full report on September 9 under the title “Agents Gone Wild”.

This site’s September 19 version ran with “domain taken in 7 minutes” and “even the hacker could not control his own AI” in the headline. Both are in the report, but the old version never laid out the report’s tables and did the arithmetic. For this rewrite I worked through them row by row and found three things the old version did not say. Of the 440 servers, only 12 were taken all the way to the highest privilege. The “disobedience” amounts to victims appearing in 8 of the 28 countries on the avoid list, 20 servers in all. And Taiwan had 12 victims, 10 of which lost operating system or domain-level secrets, the highest ratio among the countries with larger victim counts.

The old version also gave several patch dates I could not trace to a primary source this time, and those are handled here as well.

What did GreyNoise see?

GreyNoise’s data comes from sensors it runs on the internet. They draw attackers’ scanning and exploitation, which lets researchers study adversary infrastructure and tradecraft directly without waiting for a victim’s investigation. The report says the company had been tracking the IP address 45.142.193.132 since early July, because it had been used against devices from Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE.

Figure 1: The two paragraphs describing the scale and speed of the campaign (source: GreyNoise)

The report’s account runs as follows. On August 31, a “likely Russian-speaking” actor used that IP and AI to develop, test and use exploits for two vulnerabilities in PaperCut NG/MF. He first built a lab environment of his own, containing the vulnerable PaperCut software and an Active Directory server, to practice on. In a parallel workflow he built target lists with the internet scanning service Netlas.io.

Once it worked in the lab, he released hundreds of AI agents against real targets. Note how those agents were put together. The outer harness was OpenAI’s Codex, the model running inside was DeepSeek, which the report specifically marks as “not OpenAI models”, and around them sat a set of publicly available offensive tools.

PaperCut is software for managing printing, copying and scanning. NG and MF are the self-hosted versions, and the report notes that by default they run with SYSTEM-level privileges on Windows and are usually domain-joined and integrated with Active Directory. Once a print management server falls, the attacker is standing very close to the domain controller.

There are four speed figures. The old version gave them all, and I list them again as the report has them. From an empty workspace to first executing code against a real victim took just under 4 hours. The first domain admin came 2 hours after that. Once the full campaign launched, at least 11 organizations were compromised in 26 seconds. The fastest case was a high school in the United States, where the path from initial access to full domain administrator took 7 minutes.

How many of the 440 fell completely?

The headline number is 440, but the report itself says the attacker’s success varied widely from victim to victim.

Figure 2: The four stages of intrusion and the number of servers at each (data: GreyNoise; percentages calculated for this article)

Credentials were harvested on 280 servers, or 63.6%. Operating system or domain-level secrets were taken from 147, or 33.4%. The last step, domain admin, was reached on 12, or 2.7%.

That 2.7% needs careful reading. One sentence in the report is key: the adversary did not immediately follow up with all compromised victims, so there were multiple-day delays between initial access and domain admin, “but only due to a lack of action by the adversary”. Where he did act, the fastest time was 5 minutes and the longest 144. In other words, the main reason the other 428 servers did not reach the last step is that the attacker had not yet come back to them. Good defense had little to do with it. At the time of GreyNoise’s last observation, the adversary had not achieved domain admin against the other victims.

The report also records three paths to domain admin. If the PaperCut host was a domain member, the attacker harvested LSASS process memory and registry secrets to recover privileged credentials, then passed the hash to the domain controller. If the victim had not patched two vulnerabilities from 2021 (CVE-2021-42278 and CVE-2021-42287), he used a noPac attack. If PaperCut sat on the domain controller itself or ran under a domain-admin service account, he simply added his newly created account to Domain Admins. All three paths ended with DCSync to dump the whole domain’s credential database.

The second path says something plain: some of the organizations that were broken open had not applied patches from five years ago.

Defenders had a success too. The report mentions at least one instance in which Cloudflare’s web application firewall defeated the attack. GreyNoise’s conclusion is that fundamental hardening of environments still matters against AI-enabled threats.

Who was hit, and where is Taiwan in the table?

Figure 3: The first half of the victim table by country, with Taiwan in the twelfth row (source: GreyNoise)

The United States has the most victims at 98, followed by the United Kingdom at 59, France and Spain at 31 each, and Canada at 24. That ordering roughly reflects where PaperCut’s customers are.

Taiwan has 12, ranking twelfth. The old version did not mention Taiwan at all. What caught my eye is the next two columns: of the 12, credentials were harvested on 11, and operating system or domain secrets were taken from 10. That works out to 92% and 83%, against overall averages of 63.6% and 33.4%. Among the 13 countries with a double-digit victim count, Taiwan has the highest ratio on both. Singapore, with 11 victims, had secrets taken from only 1.

The report does not explain why Taiwan’s ratios are so high, and I do not know either. It may relate to how these hosts were configured within their domains, or it may be chance in a small sample. What is certain is that none of the 12 in Taiwan was recorded as reaching domain admin. For an organization whose credentials and domain secrets have already left the building, though, the risk is not over. The report says GreyNoise partnered with incident response firms to notify victims around the clock, so these organizations should have been told. If your organization runs self-hosted PaperCut NG or MF and its admin interface was open to the internet in late August, it is worth checking on your own initiative.

By industry, education accounts for 204 servers, or 46%, and for 7 of the 12 domain admin cases. The report reads the campaign as opportunistic, and it attributes the high share of education to PaperCut’s customer base being concentrated in schools. Nothing indicates the attacker singled schools out.

How far did the AI agents “disobey”?

The report’s title comes from this part. The attacker had a list of countries to avoid, carried over from previous campaigns. It has 28 entries, in order: Russia, China, Hong Kong, Thailand, Iran, Venezuela, Belarus, Kazakhstan and the other Central Asian states, Armenia, Azerbaijan, Moldova, Ukraine, Brazil, Vietnam, Indonesia, Pakistan, Tanzania, Bangladesh, Afghanistan, Turkey, South Africa, Namibia, Nigeria and Zimbabwe. The report says this attempted restraint “failed in some instances”, and writes that it is currently uncertain why the agents deviated, but that it is a good example of Agents Gone Wild.

The report gives no figure for how far they deviated. I checked the avoid list against the victim table.

Figure 4: Countries on the list and their actual victim counts (cross-checked for this article; underlying data from GreyNoise)

Victims appear in 8 of the 28 countries, 20 servers in total, or 4.5% of the 440. South Africa has the most, 9, and one of them was taken to domain admin. Russia, Iran, Ukraine and Belarus, near the top of the list, do not appear in the table.

So a more accurate statement is that the avoid instruction mostly worked and leaked about one time in twenty. The old version wrote that “the AI ignored orders and hit off-limits countries”. The direction is right, but it reads as though the agents ran completely out of control. One secondary write-up even says the agents breached organizations in “28 excluded countries”, which mistakes the length of the list for the number of violations.

I cannot tell whether these 20 cases are the model failing to follow an instruction or an error in determining the country. What another security firm, Blackpoint, saw in the attacker’s exposed operating environment is tooling that filters targets by country first. IP geolocation data is never fully accurate, and a multinational’s server may be registered in a different country. GreyNoise itself says the cause is unknown.

Whatever the cause, the meaning for defenders is the same: you cannot relax because your country “should not be a target”.

Does this count as an attack launched by AI autonomously?

No, and both companies are clear about it.

According to Hackread’s summary of the Blackpoint report, Blackpoint’s researchers traced the activity back to the attacker’s exposed operator infrastructure. The files there show an AI-assisted workflow covering vulnerability research, exploit development, target selection, troubleshooting and retries, with timestamped state files tracking each task’s progress, failures and next steps. The tooling used up to 80 workers to probe servers, generated retry lists by failure type, and ran a campaign runner configured for up to 200 concurrent targets and 100 retry rounds. The environment also held two open-source tools: Hindsight, which gives agents persistent memory, and AionUi, an interface for orchestrating multiple agents.

Blackpoint’s conclusion is that these findings do not show AI independently discovering a zero-day, or compromising targets without human involvement. What AI did was reduce the human effort needed to operate at scale.

That fits the timeline.

Figure 5: Seven points across two weeks (data: GreyNoise, Cloud Security Alliance research note, Hackread)

According to the Cloud Security Alliance (CSA) research note, the security firm Huntress detected in-the-wild exploitation of the two flaws as early as August 26, and PaperCut published its advisory on August 27. The two flaws are CVE-2026-81578 (CVSS 8.8) and CVE-2026-82078 (CVSS 9.4), which chain into unauthenticated remote code execution. CISA added both to its Known Exploited Vulnerabilities catalog on August 31 and required federal agencies to patch by September 14.

This means the attacker GreyNoise recorded was using vulnerabilities that were already public. On the fourth day after the advisory, he developed exploits and swept through 440 servers within a day. People found the flaws. What AI shortened is the stretch from advisory to mass exploitation.

The old version described the patching process in detail, including a third emergency patch released on September 1. I could not find a primary source for that date this time, and a secondary source gives September 4, so I leave the date out. What is certain is that PaperCut advises every internet-facing server to install the latest emergency patch, and that it later released maintenance builds including NG 26.0.5, 25.0.13 and 24.1.10. The CSA note cites Huntress telemetry indicating that about 47% of the PaperCut installations it tracks still run outdated, unpatched versions.

My read, and what would change it

I think the most important message of this report is that time was compressed, while the techniques themselves are not new. Every step of the attack chain, from reading LSASS to noPac to DCSync, has existed for years, and the tool kit consists entirely of public tools. What is new is that one person could apply it to hundreds of targets in less than a day, on the fourth day after an advisory. That points the same way as the worry Anthropic chief executive Dario Amodei set out in his essay on pacing the frontier, at a much smaller scale.

I disagree with the old version’s emphasis on “AI out of control”. A 4.5% deviation is a phenomenon worth recording, but describing it as an attacker unable to control his agents leads people to underestimate the real problem: most of the time these agents did what they were told, and did it very fast.

What would change my view? If later reporting shows that a substantial share of these 440 servers was subsequently used to deploy ransomware, the 2.7% figure loses its meaning, because initial access is itself a commodity. If GreyNoise or Blackpoint publishes that the deviation from the avoid list came from a model overriding an explicit instruction, I would pick the phrase “out of control” back up. If the coming months bring cases with the same pattern in which the vulnerability was found by the AI, that would be a different class of event.

For people who run IT, here are three concrete practices, all drawn from these two reports and CSA’s recommendations. Treat self-hosted admin tools (print management, backup, remote management) as high-risk assets, and keep their admin interfaces off the open internet, behind a VPN or an authenticated reverse proxy. Do not run such services under a domain-admin-level account or install them on a domain controller, which is how the third path above came about. If your PaperCut was internet-facing in late August, then besides updating, rotate every credential that host could reach, and check C:\Windows\Temp for files such as pc-*.hiv and for an account named Administrator17.

What this rewrite corrected

• How far the AI was “out of control”. The old version said agents ignored orders and hit off-limits countries. Cross-checking the report’s list against its table, 8 of the 28 countries have victims, 20 servers in all, or 4.5%, with the cause unknown.
• The context of 2.7%. The old version read the 12 full compromises as meaning most victims were still some way from disaster. The report states that the other victims did not reach the last step only because the attacker had not yet followed up.
• Untraceable patch dates were removed. The old version said a third emergency patch came on September 1 and that the attack began a day before patching was complete. I could not find a primary source, so this is rewritten around what can be confirmed.
• Taiwan’s numbers were added. Twelve victims, 11 with credentials harvested and 10 with secrets taken. The old version did not mention them.
• “This is not an autonomous attack” was added. Blackpoint says there is no evidence of AI discovering the flaws or compromising targets without human involvement, and the flaws were public four days before the campaign.
• New material. The three paths to domain admin, indicators of compromise you can check, the date of Huntress’s first detection, the telemetry figure of about 47% unpatched, and the tooling’s concurrency and retry settings.