Autonomous AI agents breached over 1,200 sites using open control panels

A Chinese-speaking operator used autonomous AI agents to breach more than 1,200 websites, including those of major corporations like Deere, SharkNinja, and Cummins. Security researcher Snorre Fagerland from NorForge detected the campaign in early October 2026 after finding exposed control panels for an open-source AI tool called Cairn.

What happened

The attack campaign relied on the misuse of Cairn, a tool designed for authorized penetration testing that allows AI agents to pursue goals step-by-step. The operator left dozens of Cairn instances accessible on the public internet without authentication, allowing Fagerland to observe the attacks in real time. The busiest cluster, identified as AIA0001, linked fourteen panels to over 1,100 attack projects targeting e-commerce and payment systems in the United States, Japan, and Australia.

The agents attempted to gain persistent access by planting web shell uploaders, which are forms that save files to a server. While these forms do not execute commands directly, they provide a foothold for attackers to later swap in malicious code. NorForge verified one live web shell at a large hardware-parts vendor and confirmed a compromise at a major US retailer where the agent exploited a single cookie setting to reach a vulnerable backend server.

Victims reported varying levels of impact. Deere stated it fixed the issue and found no evidence of sensitive data access. SharkNinja contained the threat on a standalone support site, while Cummins investigated a potential attack on a vendor-run website. Two smaller businesses also confirmed compromises. The attacker’s own records detailed intrusion chains involving unauthorized write access to memcached session stores and weaknesses in legacy Zend Framework code.

How it works

Cairn operates by giving AI agents a starting point and a specific objective, such as finding a way to run code on a target shop. The agents then work autonomously, posting their findings to a shared board where a human operator can provide hints. In this campaign, the operator provided minimal guidance, sketching out tactics in fewer than 100 Chinese characters. The agents then executed the rest of the process, identifying vulnerabilities and deploying payloads with little supervision.

The infrastructure appeared to use a worker named claudecode_deepseek-v4.1-flash, suggesting a combination of DeepSeek V4.1 Flash models and Anthropic’s Claude Code. While neither the researcher nor Reuters could definitively confirm the exact models, the campaign clearly leveraged affordable, high-capability language models to automate the reconnaissance and exploitation phases. This setup allowed the attacker to scale efforts across hundreds of targets simultaneously.

Key details

• Scale: Agents targeted over 1,200 sites and reached more than 100 companies.
• Cost: The campaign cost approximately $5,000 in tokens, averaging $5 per task or $50 per successful hack.
• Speed: Successful break-ins took an average of just under 23 hours.
• Success Rate: The overall success rate was around 10%, though goals varied across clusters.
• Exposure: Exposed Cairn panels revealed hundreds of secrets, with 11% verified as still valid.
• Tool Origin: Cairn was built by "le1xia0" for authorized testing, not malicious hacking.

Why it matters

This incident demonstrates how autonomous agents can lower the barrier to entry for sophisticated cyberattacks. With an average cost of only $5 per task, attackers can afford a high volume of failed attempts while still achieving a profitable success rate. The ability to operate with minimal human input means these campaigns can run continuously, scanning for vulnerabilities like stray upload forms or unpatched frameworks without fatigue. For engineering teams, this shifts the threat landscape from manual, targeted attacks to automated, broad-spectrum probing.

Furthermore, the exposure of the Cairn panels highlights a secondary risk: operational security failures by both attackers and legitimate security firms. NorForge found that legitimate penetration-testing companies had also left client data on unsecured panels. This means that even if your organization is not directly targeted by the AI agents, your secrets could be exposed through the negligence of third-party security vendors. The presence of valid SSH logins and API keys in these open panels creates immediate risks for any associated infrastructure.

What you can do

• Scan for exposed panels: Check your network for agent control panels listening on port 8000 without authentication.
• Audit file uploads: Identify and secure any unexpected file-upload forms, especially those in hidden directories.
• Patch Magento instances: Apply Adobe’s hotfix for CVE-2026-75650 (StyleSmuggler) if you run Adobe Commerce 2.4.4–2.4.9 or Magento Open Source 2.4.6–2.4.9.
• Review third-party vendors: Ensure penetration-testing firms and other security partners secure their testing environments and do not leave sensitive data exposed.
• Monitor session stores: Check for unauthorized write access to memcached or similar session storage systems.
• Rotate credentials: If you suspect your data may have been part of an exposed panel, rotate all associated API keys and SSH logs immediately.