A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet.
The agents tried more than 1,200 sites and reached websites belonging to more than 100 companies, including farm-equipment maker Deere, appliance company SharkNinja and engine maker Cummins, according to Reuters, which reviewed the attacker’s own records to identify them. How much data, if any, was taken is not known.
The researcher, Snorre Fagerland of the security firm NorForge, found the operations by scanning the internet for exposed copies of Cairn, an open-source AI tool popular with hackers.
Beginning around October 2, he found about two dozen Cairn instances being used maliciously, which let him read the attackers’ work in real time. He set out the findings on Monday, and Reuters, which saw the report before publication, named the victims from its own review of the attacker’s activity.
Cairn gives AI agents a starting point and a goal, then lets them work toward it step by step. The agents post what they find to a shared board, and the human operator can add hints along the way. It was built for authorized penetration testing and does other jobs too, but here it was pointed at online shops without permission.
Cairn’s author, who posts as “le1xia0,” told Reuters the tool was not designed for hacking attacks and that harmful use was not their intention.
What the agents did, and who was hit
NorForge grouped the exposed panels into three clusters and judged more than 20 of them likely to be malicious. The busiest cluster, which NorForge calls AIA0001, is Chinese-language and links 14 panels to more than 1,100 attack projects.
Its aim seems to be lasting access to shop and payment systems for later use, NorForge said, with targets in the United States, Japan and Australia.
A typical task told the agents to find a way to run code on a shop and then plant a web shell uploader. That is a form that saves uploaded files, not one that runs commands, and attackers can swap it for something worse at any time.
NorForge checked one claimed break-in, at a large hardware-parts vendor, and found the web shell live. It independently confirmed the compromise of one very large US retailer, in which the agents found the single cookie setting that selected a vulnerable backend server.
The three named companies told Reuters the damage was limited. Deere said it took steps to fix the problem and had no sign that sensitive information was accessed. SharkNinja said the attack hit a standalone product-support site and that it had contained the threat.
Cummins said it was investigating a report of a possible attack on a website run by one of its vendors. Two smaller businesses also told Reuters they were compromised.
One documented intrusion, by the agent’s own account, worked through unauthorized write access to a memcached session store, unsafe handling of saved PHP objects, and a weakness in old Zend Framework code. The paths differ from victim to victim, so this is one chain, not a single method.
Cheap, fast, and largely unsupervised
The instructions were short. The Chinese-speaking operator sketched out preferred tactics in fewer than 100 Chinese characters, Reuters reported, and the agents went from there.
Successful break-ins took a little under 23 hours on average, NorForge found, and the overall success rate across the tools it saw was around 10%, though it cautioned the clusters chase different goals and are not directly comparable.
The cost was low, but the figures are rough. NorForge put the average at about $5 a task, counting attempts that failed or ended early, and said the uncertainty is considerable. Fagerland separately told Reuters the whole campaign had used about $5,000 worth of tokens, or roughly $50 per successful hack.
All the AIA0001 tasks ran under a worker named claudecode_deepseek-v4.1-flash, which could point to a DeepSeek V4.1 Flash model driven by Anthropic’s Claude Code. Neither the researcher nor Reuters confirmed the models, and Reuters said only that the campaign appeared to use DeepSeek and Claude Code.
The open panels leak the victims’ secrets too
Leaving a Cairn panel open is a separate problem from the break-ins. The panels show who is being attacked, what weaknesses were found, and which credentials and keys were taken, so having your site tested on an open instance can expose your secrets, whatever the test’s outcome.
NorForge ran the secrets scanner Trufflehog over the panel data and found hundreds of secrets, 11% of which it verified as still valid.
The panels also appear to expose the full set of the tool’s controls, including the ability to start and stop projects, feed in new data, and point agents to different targets.
NorForge said it did not test whether those controls work without a login. A second, English-language cluster went further and exposed the operators’ own SSH logins to their staging servers; NorForge said it did not log in.
The exposure is not only a criminal problem. NorForge also found apparently legitimate penetration-testing firms that had left real client tests on unsecured panels, putting their customers’ data at the same risk.
What to check, and where this came from
Defenders can act on a few points:
- Exposed panels. Agent control panels of this kind often answer on port 8000, so an exposed one without a login is worth hunting for.
- Stray upload forms. An unexpected file-upload form sitting in a hidden directory is the foothold these agents aimed for.
- Magento patching. A worker directory NorForge browsed held a proof-of-concept for a critical Magento flaw, StyleSmuggler (CVE-2026-75650), and a test lab for it. There is no evidence it was used in these break-ins, but any shop still on an affected build should apply Adobe’s hotfix for it: Adobe Commerce 2.4.4 through 2.4.9, or Magento Open Source 2.4.6 through 2.4.9.
NorForge’s search followed a September report by Gambit Security, a separate campaign in which a criminal used Cairn alongside two other AI tools to steal credit cards; that report is what first flagged Cairn on an attacker’s server. No source links the two operations.
NorForge said it is working with Reuters to warn victims and is asking hosting firms to take the panels down, an effort it said depends on how the hosts respond.
