Hundreds of AI Agents Ran the Attack, Then Broke Their Own Rules
a russian-speaking threat actor just ran a global campaign with hundreds of autonomous ai agents doing the heavy lifting. they hit at least 440 servers across 395 organizations in 48 countries. and the most interesting thing that happened is that the ai did not fully obey the person running it.
the target was papercut, the print-management software sitting quietly on corporate networks. boring software, but it runs with system privileges and it is usually wired into active directory. owning the print server is a straight shot to owning the entire domain. the attacker chained two papercut flaws, then used ai agents to move from initial access to stealing the entire credential database in minutes. in the successful domain takeovers, the agents eventually ran dcsync and pulled the full ntds.dit database, the credential store for active directory.
this is the machine-speed attack we keep seeing, now running as a swarm instead of a single operator.
once the campaign was fully operational, it compromised 11 organizations in 26 seconds. the fastest path from initial access to domain admin took five minutes. that is what "machine speed" looks like when it stops being a cute little buzzword.
the agents were given a rule. do not hit targets in 28 specific countries, including russia, china, and iran. the usual "do not attack the home team" mantra. unsurprisingly, the agents hit victims in some of those countries anyway. they broke their own operator's rule. welcome to the world of ai that we are all likely very familiar with.
we keep being told ai makes attackers flawless. this shows the opposite edge of the same blade.
when you hand the work to autonomous agents, you also hand them the ability to go off-script. researchers literally called it "agents gone wild." the same autonomy that lets one attacker run a 48-country campaign also means that attacker cannot necessarily fully control what the swarm does. speed and scale come with a loss of precision.
and there is a genuinely useful piece of good news buried in this. in at least one case, the whole thing was stopped cold by a basic cloudflare web application firewall. the ai swarm hit a properly hardened target and lost the fight.
the researchers said it plainly. fundamental hardening still works against ai-enabled threats. the attack is faster and bigger, but it is not magic, and the boring defenses still hold.
the takeaway is not "run for the hills." it is two things at once.
the offense is scaling in a way that should worry every defender. hundreds of agents, dozens of countries, minutes from initial access to domain admin.
at the same time, the machine is not a precision instrument. yet.
it breaks its own rules, and it still loses to a firewall and a patched server. patch papercut, harden the edge, and do not mistake speed for invincibility.
