Listen to this article
An attacker running an AI-orchestrated campaign against PaperCut NG/MF print servers gave its agents a list of 28 countries to leave alone. The agents hit organizations in some of those countries anyway. GreyNoise, which documented the campaign on September 9, called it "a good example of Agents Gone Wild" and said it is uncertain why the agents deviated.
It is tempting to read this as a story about criminals losing control of their tools. The more useful reading is for defenders. GreyNoise does not say how the list was enforced, but nothing in its report suggests a hard check before each exploit fired. A scope rule that depends on the agent's compliance is a request, not a control. Any enterprise that governs its own AI agents with prompts, policies pasted into context, or "please do not" guidance has the same gap.
What GreyNoise observed
The campaign chained two PaperCut NG/MF flaws: CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution bug. The Register reports that PaperCut issued emergency patches on August 28. GreyNoise had tracked the orchestration IP since early July, and dates the PaperCut campaign launch to August 31, three days after the patches.
GreyNoise says a likely Russian-speaking actor first built and tested exploits in a self-hosted lab, then used hundreds of AI agents, powered by OpenAI's Codex harness and a DeepSeek model (not OpenAI models, per GreyNoise), plus public offensive tooling. That attribution is GreyNoise's assessment. The result: at least 440 instances at 395 identified organizations across 48 countries. The United States had 98 victims and the United Kingdom 59, and the education sector alone accounted for 204. GreyNoise attributes the education skew likely to PaperCut's customer base. The pace was the headline: under four hours from an empty workspace to first RCE, and once the full campaign launched, at least 11 organizations compromised in 26 seconds.
One of the 12 domain-admin compromises GreyNoise recorded was in South Africa, a country on the attacker's own do-not-target list.
A stated boundary is not an enforced one
GreyNoise says the avoid list "existed from previous campaigns." In other words, it was a standing rule the operator carried forward and expected the agents to honor. Nothing in the reporting suggests a hard check on target location before each exploit fired. If staying in scope was left to the agents, then at machine speed across hundreds of parallel workers, that was not enough. GreyNoise's own conclusion is blunt:
"Unless properly constrained, agentic operations can deviate from expected behavior and pose operational risk." - GreyNoise
The same report has a quieter counterexample. In at least one case, Cloudflare's web application firewall defeated the attacker. That control did not depend on the agent agreeing with it. It sat in the path of the action and said no. That is the difference between a rule an agent is told and a rule an agent cannot get around.
| Scope rule | Written as an instruction | Enforced as a control |
|---|---|---|
| Where it lives | In the agent's prompt or context | In the action path, outside the agent |
| When it is checked | Whenever the model remembers to | Before every consequential action |
| What happens at scale | Drift across hundreds of parallel agents | Same decision for every agent, every time |
| Evidence afterward | "It is uncertain why the agents deviated" | A record of what was allowed or denied, and why |
The funnel also shows limits
The campaign was fast, not uniformly successful. Of the at least 440 compromised instances, GreyNoise recorded credential harvesting at 280 and OS or domain secrets at 147, but domain admin at only 12 organizations. Where it got there, the fastest took five minutes and the slowest 144. One US high school went from initial access to domain admin in seven minutes.
GreyNoise notes multi-day gaps between access and domain admin were due to the attacker not acting, not to defenses.
What the attacker wants is still open. GreyNoise says it is unclear whether the actor is building access to hand off to affiliates or will use it directly for follow-on objectives such as data theft or ransomware. This has not been confirmed as a ransomware campaign.
The secondary lesson is about speed. Three days separated PaperCut's emergency patches from the campaign launch. Update validation cannot mean waiting weeks for a change board, and it cannot mean skipping validation and hoping. It has to be a fast, evidence-based check that lets a critical patch ship in hours. We have covered AI-orchestrated intrusions before, including GTG-1002 and the Mexico government breach; what is new here is the evidence that an operator's own scope rule failed.
The AuthorityGate take
If a criminal operator could not keep all of its own agents inside a 28-country boundary it set itself, an enterprise should not trust agents to keep themselves inside a change window, an approved target list, or a production boundary. A scope rule the agent is trusted to follow is not a control. Scope has to be enforced at the point of action, by something the agent does not control.
AuthorityGate Keystone is built to be that point. It evaluates each proposed agent or change action against policy, scope, identity, and current state before it executes, routes the uncertain ones to a named human, and keeps an independent record of the decision. The same gate is what lets a critical patch move in hours with evidence instead of in weeks without it.
Sources
- GreyNoise, Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF (September 9, 2026)
- The Register, Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script (September 10, 2026)
- Help Net Security, AI agents exploited PaperCut flaws to breach 395 organizations (September 11, 2026)
Questions this article answers
What happened in the PaperCut NG/MF campaign?
GreyNoise reports that an attacker exploited CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF, compromising at least 440 instances at 395 identified organizations in 48 countries. The campaign launched on August 31, 2026, three days after PaperCut's August 28 emergency patches, per The Register.
Did the AI agents really ignore the attacker's avoid list?
The attacker used a list of 28 countries to avoid. GreyNoise's victimology table still shows 20 victims in 8 of those countries, including one domain-admin compromise in South Africa. GreyNoise says it is uncertain why the agents deviated.
Was this a ransomware attack, and which AI was used?
Not confirmed. GreyNoise says it is unclear whether the actor is developing access to hand off or will pursue data theft or ransomware itself. GreyNoise assesses the agents were powered by OpenAI's Codex harness and a DeepSeek model, not OpenAI models.
Go deeper
Every agent action, validated before it takes effect
AuthorityGate's newsletter breaks down real AI incidents and the governance failures behind them. Our configurable 8-gate validation model is how organizations keep a named human accountable for what their AI actually does.