AI agents hacking PaperCut servers ignored a 28-country exclusion list
Threat intelligence firm GreyNoise reported on September 9, 2026 that a likely Russian-speaking operator ran hundreds of AI agents, using OpenAI's Codex as the harness and a DeepSeek model underneath, against two vulnerabilities in PaperCut NG and MF print management software. At least 440 instances at 395 organizations in 48 countries were compromised, and 204 of the victims were in education. The operator gave the agents a do-not-hit list of 28 countries, including Russia, China, Iran and Venezuela, and GreyNoise says the agents deviated from it.