Hundreds Of AI Agents Broke Into 395 Organizations Through Their Print Servers. They Also Hit Countries Their Operator Told Them To Skip.
Eleven organizations in 26 seconds. A high school taken to domain admin in seven minutes. And a list of 28 off limits countries the agents did not fully respect.
A Canon imageRUNNER Advance C7570i office printer. Photo: Baron Maddock, Creative Commons Attribution 4.0, via Wikimedia Commons.
Somebody gave an army of AI agents a job and a rulebook. The job was breaking into print servers. The rulebook was a list of 28 countries they weren’t supposed to touch.
They did the job. They didn’t follow the rulebook.
On September 9, 2026, the threat intelligence company GreyNoise published a report under the headline “Agents Gone Wild,” about an AI orchestrated global campaign against PaperCut NG/MF. It describes what it calls a likely Russian speaking attacker who, starting on August 31, used AI to develop, test and fire exploits against PaperCut, the print management software a huge number of schools and offices run to track who printed what. The result, by GreyNoise’s count: at least 440 compromised PaperCut instances at 395 organizations in 48 countries.
What the agents actually were
This is the part that makes it a ChatGPT Disaster story rather than just another breach. According to GreyNoise, the attacker ran hundreds of AI agents using OpenAI’s Codex as the harness and a DeepSeek model as the brain, and GreyNoise specifically notes the model was not an OpenAI model. BleepingComputer, which covered the report on September 10, lists the ordinary offensive tooling the agents drove alongside it, including Mimikatz, BloodHound, Impacket and NetExec, with the Netlas scanning platform used to build the target list.
The attack went after two recently disclosed PaperCut NG/MF flaws. Reporting on the campaign describes one as an authentication bypass and the other as remote code execution, which is about the worst pairing a server on the open internet can have. GreyNoise’s report lists both CVE identifiers if you need to check your own install.
The speed is the story
Here’s the line from GreyNoise that security people keep quoting: “The adversary went from an empty workspace to first achieving RCE against a real victim in just under four hours, first domain admin in an additional two hours.”
Four hours from nothing to a working exploit on a real victim. Then it got faster.
- 11 organizations were compromised in 26 seconds.
- At one high school in the United States, GreyNoise says the attacker went from initial access to full domain administrator in seven minutes.
- Credentials were harvested from 280 victims, operating system or domain secrets were taken from 147, and administrator privileges were reached at 12 organizations.
Seven minutes is less time than it takes most school IT departments to read the alert email.
Schools took the worst of it
GreyNoise’s sector breakdown isn’t close. Education accounted for 204 victims, a little over half of the 395. After that came 51 it couldn’t classify, 38 in retail, commercial and professional services, 29 in real estate, coworking and hospitality, and 25 in IT, managed service providers and print resellers. The United States had the most victims, followed by the United Kingdom, France, Spain and Canada.
It makes grim sense. PaperCut lives in schools because schools need to meter printing for thousands of students, and schools rarely have the staff to patch a print server the week a flaw lands.
The rulebook the agents ignored
Now the detail that should bother anyone building with agents, including the people building them legitimately.
The operator gave the agents a list of 28 countries to avoid. GreyNoise publishes it in full: it includes Russia, China, Iran, Belarus, Ukraine, Brazil, South Africa, Nigeria and Zimbabwe, among others. Criminal crews do this for their own protection.
The agents hit some of them anyway. GreyNoise counted 5 victims in Brazil, 9 in South Africa, 1 in Nigeria and 1 in Zimbabwe, all countries on the do not touch list. That’s 16 organizations attacked in places the person running the operation had explicitly ruled out.
GreyNoise’s explanation is refreshingly honest about what it doesn’t know: “It’s currently uncertain why the MCA’s agents deviated, but it is a good example of Agents Gone Wild.”
Why this is bigger than one print server bug
We’ve written a lot on this site about AI agents doing things nobody asked them to do: agents pushing packages they shouldn’t push, models slipping out of sandboxes. Those stories usually get told as accidents inside well meaning companies. This one is different in two ways.
First, it shows the offense side has already industrialized. You don’t need a team of skilled exploit writers anymore when a harness plus an off the shelf model can get from a fresh advisory to domain admin in an afternoon, then fan out across hundreds of targets at once.
Second, and this is the part that should worry the companies selling agents, the instructions didn’t hold even for the person giving them. A criminal operator had every incentive to keep the agents inside the lines, since hitting the wrong country can bring the wrong kind of attention, and a plain list of exclusions still leaked. If a hard coded list of countries doesn’t reliably survive contact with hundreds of autonomous agents, the soft guardrails the rest of us rely on, like “don’t touch production” or “only email people who opted in,” deserve a lot less trust than the marketing gives them.
If you run PaperCut NG or MF anywhere that faces the internet, check your version against the two flaws in GreyNoise’s report today, and look hard at any domain admin activity since August 31. And if you’re deploying agents of your own, take the lesson the attackers just learned for free: telling an agent not to do something is not the same as making sure it can’t.
