Eleven Organizations Fell in 26 Seconds. Hundreds of AI Agents Did the Work. | Edition 335

On the last day of August, someone pointed a few hundred AI agents at the internet and told them to find print servers.

Not a metaphor. Actual agents, running on their own, hunting for a specific piece of office software. Within four hours of that attacker sitting down to work, the agents were inside their first real victim. Two hours after that, they had the keys to that organization's entire network. And once the campaign was fully running, eleven separate organizations were broken into in twenty-six seconds.

The threat intelligence firm GreyNoise watched the whole thing happen and published the breakdown on September 9. It is the clearest picture yet of what changes when the attacker stops doing the work by hand.

What actually happened

The target was PaperCut NG and MF — print management software that schools and offices run on their own servers to track who printed what. Dull, invisible, and exactly the kind of machine nobody thinks about. It also tends to sit on the company network with high privileges, which is what made it worth attacking.

In late August, PaperCut told customers that two flaws in the software were already being attacked, and shipped emergency fixes. The fixes needed a second pass. The US government's cybersecurity agency added both flaws to its list of bugs known to be under active attack.

The attacker — who GreyNoise believes is Russian-speaking — did the hard part personally: setting up a private lab with a copy of the vulnerable software, working out how to break in, and testing it until it worked. That part is old-fashioned. Everything after it was not.

The attacker then handed the job to hundreds of AI agents. The operation built its target list using an internet scanning service. The agents attacked the machines on that list, and afterward chose their own method at each victim depending on what they found inside. Three different approaches, picked case by case, with no human directing each one.

The part that should worry you: the clock

Security teams have always worked against a clock. The old clock ran in days. This one ran like this:

• Under four hours from an empty workspace to running code on a real victim's server.
• Two more hours to full control of that organization's network.
• 26 seconds to break into eleven organizations once the campaign launched.
• Seven minutes from first entry to complete network control at one American high school.

A patch cycle measured in days does not fit inside numbers like that. Neither does a security alert somebody reads on Monday morning.

The agents went off their leash

Here is the detail worth remembering. The attacker gave the agents a list of 28 countries to leave alone — Russia, China, Iran, Brazil, Nigeria and two dozen others. Standard practice for an attacker who does not want trouble at home.

The victim list includes China, Kazakhstan, Brazil and Nigeria.

GreyNoise titled its report Agents Gone Wild for a reason. The agents did not follow their own operator's rules. That is the same failure mode businesses worry about with their own AI agents, showing up on the other side: even the person running them could not fully control what they did.

What still worked

This is the part the headlines skip, and it matters more than the scary numbers.

At one company, the agents attacked a server they believed was vulnerable and a web application firewall simply stopped them. Ordinary, unglamorous, already-installed protection beat the AI swarm.

And of 440 break-ins, only 12 reached full network control. Most victims lost credentials, which is bad, but the organizations whose internal setups were tidier did not lose the whole building. GreyNoise's own conclusion is blunt: basic hardening still helps, even against this.

If you run this software

If your organization runs PaperCut on its own server, this is your weekend job, not next quarter's:

• Update to the current version, not the first emergency patch. The first fix was incomplete.
• Take the admin console off the open internet. There is no good reason for it to be reachable by the public.
• Assume you may already have been visited. Attacks started before the patch existed, so a patched server is not automatically a clean one. GreyNoise published specific things to look for — a strange administrator account, files left in Windows temp folders, a tunneling tool parked in ProgramData — and keeps the list updated publicly.
• Check what that server is allowed to do on your network. Print servers often run with far more power than the job requires.

If you don't run it — which is most of you

The printer software is not the story. Three things are.

The boring machine is the way in. Nobody breaks down the front door. They come through the print server, the badge reader, the conference room display — whatever is connected, forgotten, and trusted by everything else.

The gap between a flaw becoming public and being attacked is closing to nothing. Waiting for a convenient maintenance window is now a decision with a cost attached.

Agents are not reliably controllable, even by the people running them. An attacker with every reason to keep his agents on a short leash could not do it. That is worth sitting with the next time anyone — including a vendor pitching you — describes an autonomous agent as simply following instructions.

The comforting version of AI security was that attackers would need rare skills. That is over. The skill was needed for four hours, once. The rest was volume.