A sophisticated attack campaign, driven by autonomous AI agents, has successfully breached the websites of over 100 companies. The operation, attributed to a Chinese-speaking criminal group, was inadvertently exposed when the operators left their control panels accessible on the internet. Security researcher **Snorre Fagerland** of **NorForge** stumbled upon the activity while scanning the internet for exposed instances of **Cairn**, an open-source AI tool favored by some threat actors. Starting around October 2, Fagerland identified approximately two dozen malicious **Cairn** instances, providing a unique real-time view into the attackers' methods and targets. **Reuters**, which reviewed the attacker's own records, confirmed the scale of the operation, noting attempts against over 1,200 sites. While the full extent of data compromise remains unknown, the targets included major entities like farm-equipment maker **Deere**, appliance company **SharkNinja**, and engine manufacturer **Cummins**. ### The AI Agents' Modus Operandi **Cairn** is designed to provide AI agents with a starting point and a specific goal, allowing them to progress autonomously. The agents log their findings to a shared board, where human operators can interject with hints or new directives. Although originally intended for authorized penetration testing, in this instance, it was weaponized against online shops without permission. **NorForge** categorized the exposed panels into three clusters, with over 20 deemed malicious. The most active cluster, dubbed AIA0001, operated in Chinese and linked 14 panels to over 1,100 attack projects. Its primary objective appeared to be gaining persistent access to e-commerce and payment systems for future exploitation, with targets spanning the United States, Japan, and Australia. Typical tasks for the agents involved finding methods to execute code on a shop's server and then deploying a web shell uploader. This initial foothold allows attackers to replace the benign uploader with more potent tools at any time. **NorForge** confirmed one such web shell was active at a large hardware-parts vendor, and independently verified the compromise of a major US retailer where agents exploited a single cookie setting to target a vulnerable backend server. ### Impact on Victims The named companies reported limited damage. **Deere** stated it took corrective actions and found no evidence of sensitive data access. **SharkNinja** confirmed the attack targeted a standalone product-support site and that the threat had been contained. **Cummins** is investigating a potential attack on a vendor-operated website. Two smaller businesses also confirmed compromises to **Reuters**. One documented intrusion involved unauthorized write access to a memcached session store, unsafe handling of saved PHP objects, and a vulnerability in older **Zend Framework** code. This highlights a varied approach, with different attack chains employed across victims. ### Efficiency and Cost-Effectiveness of AI-Driven Attacks The campaign demonstrated remarkable efficiency. Operators provided concise instructions, often fewer than 100 Chinese characters, allowing the AI agents to proceed with minimal human oversight. Successful breaches took an average of just under 23 hours, with an overall success rate of approximately 10% across the observed tools. The financial cost of the operation was also notably low. **NorForge** estimated the average cost per task at around $5, with the entire campaign utilizing approximately $5,000 worth of tokens, equating to roughly $50 per successful hack. The AI worker used in all AIA0001 tasks was identified as `claudecode_deepseek-v4.1-flash`, suggesting a **DeepSeek V4.1 Flash** model potentially driven by **Anthropic's Claude Code**. While neither **NorForge** nor **Reuters** definitively confirmed the models, the campaign clearly leveraged advanced AI capabilities. ### The Double-Edged Sword of Open Panels Beyond the direct breaches, the exposed **Cairn** panels presented a significant secondary risk. These panels revealed not only attack targets and discovered vulnerabilities but also exfiltrated credentials and keys. Being tested on an open instance meant a victim's secrets could be exposed regardless of the test's outcome. **NorForge** utilized the secrets scanner **Trufflehog** on the panel data, uncovering hundreds of secrets, 11% of which were still valid. Furthermore, the panels appeared to expose the full range of the tool's controls, including the ability to manage projects, input new data, and redirect agents to different targets. Alarmingly, **NorForge** also found legitimate penetration-testing firms that had left real client tests on unsecured panels, exposing their customers' data to similar risks. ### Defensive Measures and Precedents Organizations can take several proactive steps to mitigate such threats: * **Exposed Panels:** Regularly scan for agent control panels, which often operate on port 8000, and ensure they are not publicly accessible without strong authentication. * **Stray Upload Forms:** Hunt for unexpected file-upload forms in hidden directories, as these are common initial footholds for these agents. * **Magento Patching:** **NorForge** observed a proof-of-concept for the critical **Magento** flaw, **StyleSmuggler** (**CVE-2026-75650**), within a worker directory. Any shops running affected builds (Adobe Commerce 2.4.4 through 2.4.9, or Magento Open Source 2.4.6 through 2.4.9) should immediately apply Adobe's hotfix. This investigation by **NorForge** follows a September report by **Gambit Security**, which detailed a separate campaign where **Cairn** was used alongside other AI tools to steal credit cards. While both operations involved **Cairn**, no direct link between the two has been established. **NorForge** is currently collaborating with **Reuters** to notify victims and is working with hosting providers to take down the exposed panels, an effort whose success depends on the responsiveness of the hosts.