Your website might have been tested by something that never gets tired, never asks for permission, and costs about five dollars a run, because a Chinese-speaking criminal pointed autonomous AI agents at company websites and let them work, and a security researcher watched the whole thing happen in real time, since the operators left their control panels sitting open on the internet for anyone to find.

The agents tried more than 1,200 sites and reached websites belonging to more than 100 companies. Reuters reviewed the attacker's own records to identify them.

Whether data was taken isn't known.

What Makes This AI Agent Hacking Campaign Different

Automated scanning has been around for decades. This wasn't scanning.

The agents were given a goal, a starting point, and freedom to work toward it step by step. They posted findings to a shared board. A human operator added hints along the way.

That's a loop, and it ran mostly unsupervised.

The three companies Reuters named; Deere, SharkNinja, and Cummins, all said the damage was limited. That's their account, and it's worth taking seriously without treating it as the final word.

How the Campaign Was Discovered

Fagerland found it by scanning the internet for exposed copies of Cairn.

Cairn is an open-source AI tool that's popular with hackers, and when someone runs it without securing the control panel, the panel answers to anyone who finds it.

Starting around October 2, he found about two dozen Cairn instances being used maliciously. That let him read the attackers' work as it happened, not in retrospect.

He published his findings on Monday. Reuters, which saw the report before publication, named the victims from its own review of the attacker's activity.

What Cairn Actually Does

Cairn gives AI agents a starting point and a goal, then lets them work toward it incrementally. Agents post what they find to a shared board. The human operator can add hints along the way.

It was built for authorized penetration testing, and it does other jobs too. Here it was pointed at online shops without permission.

Cairn's author, who posts as le1xia0, told Reuters the tool wasn't designed for hacking attacks and that harmful use wasn't the intention.

What the Agents Were Told to Do

The instructions were remarkably short.

The Chinese-speaking operator sketched out preferred tactics in fewer than 100 Chinese characters, per Reuters. The agents took it from there.

A typical task told the agents to find a way to run code on a shop, then plant a web shell uploader.

That's a specific and modest ask. A web shell uploader is a form that saves uploaded files. It doesn't run commands.

It's also a foothold, and an attacker can swap it for something worse whenever they like.

The Three Clusters and Their Aims

NorForge grouped the exposed panels into three clusters and judged more than 20 of them likely malicious.

The busiest is AIA0001. It's Chinese-language, it links 14 panels, and it carries more than 1,100 attack projects.

Its apparent aim, per NorForge, is lasting access to shop and payment systems for later use. Targets sit in the United States, Japan, and Australia.

That's a different objective than smash-and-grab fraud. Lasting access is infrastructure, and infrastructure gets used later.

What NorForge Confirmed

The researchers didn't take the attacker's word for success. They checked.

At a large hardware-parts vendor, they examined a claimed break-in and found the web shell live on the server.

They also independently confirmed the compromise of one very large US retailer. In that case, the agents found the single cookie setting that selected a vulnerable backend server.

That's a small discovery with a large consequence. One parameter chose the vulnerable path, and the agents found it.

One Documented Intrusion Chain

A documented intrusion, by the agent's own account, worked through three things in sequence:

• Unauthorized write access to a memcached session store
• Unsafe handling of saved PHP objects
• A weakness in old Zend Framework code

NorForge was clear that paths differ from victim to victim. That's one chain, not a single method.

What the Named Companies Said

Deere said it took steps to fix the problem and had no sign that sensitive information was accessed.

SharkNinja said the attack hit a standalone product-support site and that it contained the threat.

Cummins said it was investigating a report of a possible attack on a website run by one of its vendors.

Two smaller businesses also told Reuters they were compromised.

Why the Cost Numbers Matter

This is the part that changes the threat model, even if the figures are rough.

NorForge put the average at about $5 a task, counting attempts that failed or ended early, and cautioned that the uncertainty is considerable.

Fagerland separately told Reuters the whole campaign used about $5,000 worth of tokens, or roughly $50 per successful hack.

Fifty dollars per compromise, on average, against websites belonging to equipment manufacturers and appliance brands.

The overall success rate across the tools NorForge saw was around 10%. NorForge noted that the clusters chase different goals and aren't directly comparable, so treat that figure as an aggregate rather than a per-target probability.

Successful break-ins took a little under 23 hours on average. That's slow by human standards and fast for something running unattended.

The Model Question

All AIA0001 tasks ran under a worker named claudecode_deepseek-v4.1-flash.

That name could point to a DeepSeek V4.1 Flash model driven by Anthropic's Claude Code. Neither the researcher nor Reuters confirmed the models. Reuters said only that the campaign appeared to use DeepSeek and Claude Code.

The Open Panels Are Their Own Problem

Here's the part most coverage will skip, and it matters directly to defenders.

Leaving a Cairn panel open is a separate issue from the break-ins. The panels show who is being attacked, what weaknesses were found, and which credentials and keys were taken.

So if your site was tested on an open instance, your secrets may be exposed regardless of whether the test succeeded.

NorForge ran the secrets scanner Trufflehog over the panel data and found hundreds of secrets. Eleven percent of them verified as still valid.

Eleven percent doesn't sound like much until you remember what's in that pool. Live credentials, found by a scanner, sitting on an unauthenticated web panel.

What Else the Panels Exposed

The panels appear to expose the full set of the tool's controls, including the ability to start and stop projects, feed in new data, and point agents at different targets.

NorForge said it did not test whether those controls work without a login.

A second, English-language cluster went further and exposed the operators' own SSH logins to their staging servers. NorForge said it did not log in.

The Legitimate Firms Making the Same Mistake

This isn't only a criminal problem.

NorForge also found apparently legitimate penetration-testing firms that had left real client tests on unsecured panels. Their customers' data was exposed the same way.

If you hire a pentest firm, this is now a question worth asking them.

What Defenders Should Check

Four things, and the first two are quick.

Hunt for exposed panels on port 8000. Agent control panels of this kind often answer there. An exposed one without a login is a finding.

Look for stray upload forms. An unexpected file-upload form sitting in a hidden directory is the exact foothold these agents were told to create.

Patch Magento. A worker directory NorForge browsed held a proof of concept for a critical Magento flaw, StyleSmuggler (CVE-2026-75650), plus a test lab for it.

There's no evidence it was used in these break-ins. That's cold comfort if you're running an affected build.

Adobe's hotfix covers Adobe Commerce 2.4.4 through 2.4.9, and Magento Open Source 2.4.6 through 2.4.9.

Review session and object handling. The documented chain leaned on memcached session writes and unsafe PHP object deserialization. Both have configuration answers, and both are worth checking whether or not you're in this campaign's target set.

Where This Came From

NorForge's search followed a September report by Gambit Security.

That report described a separate campaign in which a criminal used Cairn alongside two other AI tools to steal credit cards. It's what first flagged Cairn on an attacker's server.

No source links the two operations.

NorForge said it's working with Reuters to warn victims and is asking hosting firms to take the panels down. That effort depends on how the hosts respond.

Why This Is the Shape of What Comes Next

Strip away the specifics and the economics are stark.

A skilled penetration tester bills by the day. This ran for about five dollars a task, unattended, against over a thousand sites, and it found real footholds in real companies.

The 10% success rate isn't the point. The point is what happens when someone runs ten thousand of them.

The researcher's own access is the other half of the story. A criminal left the control panel open, and a defender read the operation in real time. That's the same failure mode, mirrored. Nobody secured the management interface.

Attacks that scale this cheaply will keep happening, and defenses that assume human pacing won't keep up with them.

FAQ

What was the AI agent hacking campaign?

A Chinese-speaking criminal used autonomous AI agents running the open-source Cairn tool to attack websites without authorization. The agents tried more than 1,200 sites and reached sites belonging to more than 100 companies.

What is Cairn?

An open-source AI tool that gives agents a starting point and a goal, then lets them work toward it step by step. Agents post findings to a shared board and an operator can add hints. It was built for authorized penetration testing.

How was the campaign discovered?

Researcher Snorre Fagerland of NorForge scanned the internet for exposed Cairn control panels and found about two dozen instances being used maliciously, which let him observe the operations in real time.

Which companies were named?

Reuters named Deere, SharkNinja, and Cummins. All three said the damage was limited. Two smaller businesses also told Reuters they were compromised.

How much did the attacks cost?

NorForge estimated about $5 per task, and Fagerland told Reuters the campaign used roughly $5,000 in tokens, or about $50 per successful hack. NorForge cautioned that the uncertainty in these figures is considerable.

What are the risks of an exposed AI agent panel?

The panels display who is being attacked, what weaknesses were found, and which credentials were taken. NorForge found hundreds of secrets on exposed panels, and verified 11% as still valid.

What should defenders check first?

Look for exposed agent control panels answering on port 8000, hunt for unexpected file-upload forms in hidden directories, and patch Magento builds affected by StyleSmuggler (CVE-2026-75650).

Source: The Hacker News