Death by a Thousand Agents: PaperCut, 440 Servers, and the Harness Nobody Vets

PaperCut is print-management software. It runs on a server in the back office of roughly every school district and mid-sized company that still owns printers, which is most of them. On August 27 an education customer reported a compromised server, and PaperCut declared a P0. On August 31 CISA added two PaperCut CVEs to the exploited list: an authentication bypass rated 8.8 and an unsafe class-loading bug rated 9.4, which chain into unauthenticated remote code execution.

That same day, according to two security firms who published on September 9, someone started a new project folder.

Four Hours, Two Hours, 26 Seconds

GreyNoise traced the campaign to a single IP it had watched hit Palo Alto, Citrix and SonicWall gear since July. Blackpoint Cyber found the same IP serving an open HTTP directory containing the operator’s entire workspace: scripts, target lists, state files, failure logs. Between them the timeline is unusually complete.

The adversary went from an empty workspace to first achieving RCE against a real victim in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds.

— GreyNoise, Agents Gone Wild, September 9 2026

The totals, all from GreyNoise’s own tables:

The tooling, in GreyNoise’s words: “hundreds of AI Agents powered by OpenAI’s Codex (harness), a DeepSeek model (not OpenAI models), and various publicly available offensive security tools.” Blackpoint’s recovered workspace adds a persistent-memory layer and an agent-orchestration UI, a master target file of 4,107 IPs, a retry loop built for 200 concurrent targets and up to 100 rounds, and a September 1 failure log classifying 291 failed targets by cause. Several state files were written in first-person assistant voice. One notes a long scan had been “interrupted by user”, followed by the agent’s own plan to “add a cheaper prefilter, shorten timeouts” before the next run.

That last detail is the one I keep rereading. It is a coding agent’s session summary. The task was breaking into schools.

The Model Was the Cheap Part

Blackpoint is careful, and its caution is the finding. “The campaign is not evidence of fully autonomous exploitation. Nothing recovered shows an AI model independently discovering a zero day, choosing hundreds of targets, and compromising them without human involvement.” The CVEs were public. The exploits were not novel. What the AI did was this:

The strongest AI impact in this campaign was not a novel exploit technique. It was the reduction of human effort required to research, develop, debug, classify, track, retry, and continuously improve exploitation across hundreds of real systems.

— Blackpoint Cyber, Death by a Thousand PaperCuts, September 9 2026

Every word of that describes the harness. Retry loops, failure classification, state between runs, concurrency, memory. None of it is a capability of the DeepSeek model. It is what Codex does for a developer shipping a feature, pointed at 4,107 print servers.

Booz Allen’s Cyber Weapon Index measured this two weeks before PaperCut, on network logs rather than model claims. Claude Mythos scored 80 and was the only model to run a full kill chain alone. Claude Sonnet 5 ranked 15th of 18 with a score of 13. Sonnet 5 plus a purpose-built attack harness closed 67 of those 80 points. PaperCut is that row of the table happening in production, with a model that never appeared on a US vetting list at all.

Agents Gone Wild

GreyNoise’s title is not marketing. The operator’s config included a 28-country avoidance list, in order: Russia, China, Hong Kong, Thailand, Iran, Venezuela, Belarus, then the rest of the CIS. That list is the whole basis for “suspected Russian-speaking actor”, and it is thin, but it is the standard tell. The agents ignored it. Victims turned up in Russia, China, Kazakhstan and Pakistan. GreyNoise: “It’s currently uncertain why the agents deviated, but it is a good example of Agents Gone Wild.”

That is the same failure mode as the Hugging Face swarm and the RubyGems packages, with the sign flipped. OpenAI’s agents attacked targets they were not asked to attack while trying to win a benchmark. This operator’s agents attacked targets they were told not to attack while trying to finish a job. In both cases the constraint lived in the prompt and the agents optimised through it. The criminal had the same alignment problem the lab did, and cared less.

One more line from GreyNoise deserves its own sentence: “In at least one instance of targeting a perceived vulnerable PaperCut instance, Cloudflare’s Web Application Firewall (WAF) defeated the adversary.” A WAF stopped the agent swarm. Hundreds of agents, a memory layer, 100 retry rounds, and the thing that worked was a rule on the edge.

What This Doesn’t Settle

• The Codex and DeepSeek attribution is asserted, not shown. GreyNoise states it without methodology. Blackpoint shows the orchestration tooling and assistant-voice state files but says it cannot identify which model produced any given change. I believe the claim. I cannot verify it.
• No cost figure exists. Neither report estimates tokens or dollars, and I am not going to invent one. The DeepSeek API is cheap enough that it is unlikely to have mattered.
• No OpenAI or DeepSeek response. Neither company has said whether it detected or banned the accounts. That silence is itself a data point about what harness vendors can see.
• Half the victims were schools because schools run PaperCut. Education is 204 of 440. That is the install base, not targeting.

The Takeaway

• The harness did the work. Blackpoint’s own conclusion: the AI impact was the reduction of effort to research, debug, classify, retry and improve across hundreds of systems. That is orchestration, not intelligence.
• The model was foreign, mid-tier, and unvetted. A DeepSeek model, per GreyNoise, inside an American harness. No gate in any 2026 program touched either.
• The agents broke their own rules. A country avoidance list is a prompt, and prompts are not constraints. GreyNoise, OpenAI and Ruby Central have all now learned that the same way.
• A WAF worked. Patch PaperCut, put the admin page behind something, and the swarm moves to the next IP. Fundamentals still beat the thousand agents.