Seven minutes. That's how long it took an attacker to go from a first connection to a school server to taking complete control of that school's network. Not seven hours, not seven days. Seven minutes, the time it takes to go get a coffee.

The report came out on September 10, it comes from GreyNoise, an American company that constantly monitors attack traffic on the Internet and spots campaigns as they happen. The tally: at least 440 compromised servers, 395 identified organizations, in 48 countries. The United States led with 98 victims, the United Kingdom followed with 59, and Belgium was on the list.

What makes the story interesting isn't the number, it's the method. The attacker didn't write his tools by hand. He unleashed hundreds of AI agents on the problem, and collected the result. An agent, for those who have never touched this stuff, is a program that is given an objective and the tools to achieve it: it runs commands, connects to machines, moves files, tries, gets it wrong, starts again, without a human validating every step.

The software nobody looks at

It all starts with PaperCut, a printing software. Concretely, it's the program installed on a server somewhere in the building, and it manages all the printers in a company, a school or a hospital: who is allowed to print, how many pages, on which machine, on which floor. It's also the one that asks you to swipe your badge before taking out your sheet of paper, to stop your registered letter to the health insurer from ending up in the shared tray.

Nobody looks at this software. There's nothing sexy about it, it counts photocopies. Except that it runs on a server, that it's reachable from the Internet in many installations, and that on Windows it runs by default with the highest privileges available on the machine. The little program that counts your print jobs is therefore sitting in the boss's chair.

204 schools out of 395 victims. This isn't targeting, it's just where the software is installed most often

The two exploited vulnerabilities aren't unknowns that appeared out of nowhere. One lets attackers in without a password, the other allows code to be executed by the server, and the two combine. PaperCut released emergency patches on August 28, then definitive versions on September 10. In between, the American agency that maintains the list of vulnerabilities actually being exploited added both of them to it, with a repair deadline of September 14. The message to administrators was therefore very clear. And despite that, 440 servers fell.

What the agents did in his place

The sequence of events is more ordinary than you might think, and that's exactly what makes it scary. The attacker first set up his laboratory: a vulnerable machine and an account server, at home, to work on his tool in peace. It was AI that helped him write the exploit, debug it and make it work. Then he unleashed the pack: hundreds of agents sent out to search the Internet for servers that responded, test each one with the same recipe, and install themselves on the ones that fell.

The laboratory before the attack. Two machines in a closet, and enough to repeat the same attempt a thousand times

Once inside, nothing magical there either: retrieve the Windows accounts, plant remote-control tools, go around the network to see what else is there. Blackpoint, a security company that analyzed the same campaign on its own, says it bluntly: the real contribution of AI here isn't a new technique, it's the human work that disappears. Searching, writing, correcting, sorting, tracking targets, trying again. Especially trying again: a human gets tired on the four-hundredth attempt, an agent couldn't care less.

There is some good news in this finding, and it's real. None of these agents invented a vulnerability. The hole had to exist, be open to the Internet and not have been patched, three conditions on which the whole affair depended. GreyNoise even notes that at least once, a company's firewall blocked the attacker outright, without anyone needing to understand what was happening.

The badge reader stuck onto the printer. It's the visible part of a program that, for its part, has the network keys

The agents who didn't obey

The most interesting detail in the report came about by accident. The operator had given his agents a list of 28 countries not to touch, with Russia, China, Hong Kong, Iran and Venezuela at the top. Clearly, he didn't want anyone coming to look for traces at his place. Except that some agents hit those countries anyway.

GreyNoise says it doesn't know why they deviated, and calls it a good example of agents running wild. That shouldn't come as a surprise: the same phenomenon has been repeating everywhere for months. An instruction written in a starting prompt isn't a wall, it's a sentence. The model reads it, applies it most of the time, and occasionally misses it without anyone noticing, because nothing in the system checks that the order was followed.

A word of honesty before closing this report: it comes from a single source. GreyNoise has the network traces, it saw the IP controlling the campaign, it reconstructed the rest, but PaperCut has not confirmed the part concerning the agents, and the final count has not been settled. Another thing to keep in mind: out of 395 organizations affected, there was a complete takeover of the network in only 12 cases. That's twelve too many, it's not the end of the world either.

So what does this actually change for you?

Today, nothing. You don't have a print server at home, and the computer that manages your router doesn't run PaperCut. The subject concerns you through your work, your children's school, your doctor's waiting room: three places where there are networked printers, meaning a machine that nobody wants to update on Saturday morning.

What has really changed, though, is the timing. Ten years ago, a published vulnerability gave administrators weeks of breathing room, the time it took for someone to write the tool and sell it. Here, the emergency patches came out on August 28 and the campaign started on the 31st. Three days, weekend included. If you manage IT somewhere, the window between the release of the patch and the first attempt is now a matter of hours, and that's what the wave of agents has changed for good.

The other thing to remember is less reassuring, and it's not exactly new. Software that counts prints has no business being exposed on the Internet with full rights on the machine. It sounds obvious when written like that, but nobody asks the question as long as the photocopier works.

If you're a developer

If you administer a PaperCut NG or MF, these are the up-to-date versions, published on September 10, 2026 and replacing the emergency patches from August:

PaperCut NG / MF, versions de maintenance du 10 septembre 2026
  26.0.5    branche 26
  25.0.13   branche 25
  24.1.10   branche 24

Three checks that take five minutes and would have saved half of the 440: does my print server's administration interface respond from the Internet, or only from the internal network? Is the account running the service really a service account, and not the domain administrator account? And do the logs from the last few days show connections that nobody can explain?

It's not the photocopier that worries me. It's that we left it holding the keys to the house.