Eleven organizations in twenty six seconds. Your security model still assumes a human.

Eleven organizations. Twenty six seconds. That is not a typo.

On September 11, the threat intelligence firm GreyNoise published findings that should change how you think about security. A Russian speaking attacker pointed a swarm of AI agents at a print management tool called PaperCut NG/MF. At peak throughput, those agents compromised eleven separate organizations in twenty six seconds. Not eleven servers. Eleven organizations, each one somebody’s Monday morning.

What actually happened

The final tally was at least 440 compromised PaperCut instances. Those sat across 395 organizations in 48 countries. The attacker chained two vulnerabilities, CVE-2026-81578 and CVE-2026-82078. Then he built the whole operation on tooling you can buy with a credit card.

Specifically, he used OpenAI’s Codex harness paired with a DeepSeek model. He also used the same open source offensive security tools every red team already uses. Target lists came from Netlas.io, a commercial internet scanning service. Investigators were even able to identify the API key.

The speed is the real story

Here is the number that should stop you cold. From an empty workspace to remote code execution against a real victim took under four hours. Domain administrator rights followed two hours after that. So the entire operation, from nothing to total control, ran in about six hours.

In one case it was faster still. A high school in the United States went from initial access to full domain admin in seven minutes. Seven. Minutes.

Who got hit, and why it was them

Education took the worst of it at 204 victims. However, GreyNoise attributes that to PaperCut’s customer base rather than to deliberate targeting. Schools and universities simply run a lot of print servers. Right? The attacker was not hunting classrooms. He was hunting a product, and classrooms happened to be where it lived.

The United States led with 98 victims. Then came the UK, France, Spain, and Canada. Credentials were harvested at 280 organizations. In addition, operating system or domain secrets were pulled from 147. Full domain admin, though, was achieved against only 12.

The detail almost everyone is skipping

The attacker gave his agents a do not touch list. It covered twenty eight countries, mostly former Soviet states plus Brazil, Turkey, Nigeria, and South Africa. Presumably he wanted local law enforcement to stay uninterested. But the agents hit Russia, China, Kazakhstan, and Pakistan anyway.

GreyNoise calls this “agents gone wild.” In other words, the tooling did not follow its own operator’s instructions.

Sit with that for a second. This operator had every incentive to keep those agents inside the guardrails. He also had direct control of the prompt. Still, he could not make them obey. Right? So now ask yourself what that implies about the agentic deployment your team stood up last quarter. You know the one. The guardrail is a paragraph in a system prompt, and the review was a demo that went well.

Regulators are already reacting

This is also why the Microsoft news last weekend is not corporate theater. On September 13, Microsoft published a draft code of conduct for its in house MAI models. It sets explicit limits meant to stop future models from resisting human correction, oversight, or shutdown. Notably, it treats a violation as a system failure rather than a bad output. The draft is open for six weeks of public feedback.

Three days earlier, the European Commission had already warned major AI companies to get agentic models under control. That followed a string of security incidents. As a result, the regulators are no longer reacting to a hypothetical. They are reacting to receipts.

Your security model quietly assumes a human

Almost every control you inherited was designed around human tempo. For example, alert triage assumes somebody reads the alert within the hour. Patch windows assume an attacker needs days to weaponize a disclosure. Least privilege assumes lateral movement is slow and noisy. And your tabletop exercises assume there is a middle to catch it in.

Agentic attacks collapse that timeline into something shorter than your coffee break. So when the gap between a public CVE and a working exploit is four hours, “we patch on a 30 day cycle” is not a policy. It is a countdown. Meanwhile, the same automation is available to anyone with an API key. Therefore the barrier to entry is no longer expertise. It is intent.

What to actually do about it this quarter

I am not going to tell you to buy a platform. Instead, I am going to tell you to look at four things. Three of them are free.

1. 1. Inventory your internet facing utility software. Not your crown jewels. The boring stuff. Print servers, file transfer appliances, document management, and whatever a vendor installed in 2019 that nobody owns. Because that is exactly where this campaign lived. If you cannot produce that list in an afternoon, that is the finding.
   2. Re-baseline your patch SLA against agentic tempo. First, pick your three highest exposure external systems. Then ask honestly how fast you could patch them if the window were hours instead of weeks. Whatever answer you get is your real risk posture. Write it down, and take it to your board.
   3. Govern the harness, not just the model. The harness is the software layer between the model and the real world. In plain terms, it holds the tool access, the credentials, the session memory, and the permission to execute. Australia’s Signals Directorate published guidance on this layer on September 11, and the framing is right. Your model does not touch your systems. Your harness does. So every agent you run internally needs a scoped identity, logged actions, and a kill switch a human can reach in under a minute.
   4. Stop treating prompt instructions as a control. A motivated attacker could not keep his own agents inside an exclusion list. Therefore your acceptable use paragraph will not hold either. Controls belong in the permission layer, in the network path, and in the audit trail. Language is guidance. Architecture is enforcement.

Boring beats brilliant

Two of the six pillars I work through with clients are Security and Governance. This week, they stopped being separate conversations. After all, you cannot govern what you have not inventoried. And you cannot secure at agentic speed using a process built for human speed.

Here is the part I keep coming back to. The organizations that came through this campaign fine were not the ones with the biggest budgets. Rather, they were the ones who had already blocked public internet access to their application servers. PaperCut had been recommending that all along.

Boring beats brilliant. It usually does.

If you want help pressure testing where your agentic exposure actually sits, that is the conversation I have with executive teams every week. Reach out, and let’s look at it together.

Cuídense, y a seguir aprendiendo.

Sources

1. 1. • AI agents used in attack campaign against PaperCut NG/MF, Help Net Security, reporting on GreyNoise research
      • Microsoft drafts code of conduct to keep its AI under human control, Reuters
      • Agentic AI harnesses: the layer above the model, Australian Signals Directorate

Photos by Taylor Vick and Emma Zhang on Unsplash.