Autonomous AI Agents Breached a Hundred Companies' Sites — and Blew Their Cover on Open Panels

Security researcher Snorre Fagerland of NorForge stumbled onto an unusual operation while scanning the internet for exposed copies of Cairn — an open-source tool that hands an AI agent a goal and lets it work toward it step by step, posting findings to a shared board and taking hints from a human operator. Cairn was built for authorized penetration testing, but here it was aimed at online shops without permission.

Starting around October 2, Fagerland found roughly two dozen Cairn instances being used maliciously, letting him read the attackers' work as it happened. According to Reuters, which reviewed the attackers' own records, the agents tried more than 1,200 sites and reached properties belonging to over 100 companies — among them farm-equipment maker Deere, appliance firm SharkNinja and engine maker Cummins. How much data, if any, was taken is unknown.

What the agents did

NorForge grouped the exposed panels into three clusters, judging more than twenty malicious. The busiest, the Chinese-language AIA0001, links 14 panels to over 1,100 attack projects. Its apparent aim is lasting access to shop and payment systems for later use, with targets in the US, Japan and Australia.

A typical task told the agent to find a way to run code and plant a web-shell uploader — a form that saves files and can be swapped for something worse at any moment. NorForge checked one claimed break-in at a large parts vendor and found the web shell live; it independently confirmed the compromise of one very large US retailer.

Cheap, fast and barely supervised

The instructions were terse: the operator sketched preferred tactics in fewer than 100 Chinese characters, and the agents took it from there. Successful break-ins averaged just under 23 hours, with an overall success rate around 10%. The average task cost about $5; the whole campaign ran on roughly $5,000 of tokens, or about $50 per successful hack. Every AIA0001 task ran under a worker named claudecode_deepseek-v4.1-flash, possibly pointing to a DeepSeek model driven by Anthropic's Claude Code — though neither the researcher nor Reuters confirmed the models.

The open panels leak the victims' secrets too

Leaving a Cairn panel open is a separate problem: it shows who is being attacked, what weaknesses were found, and which credentials and keys were taken. Running Trufflehog over the panel data, NorForge found hundreds of secrets, 11% still valid. One English-language cluster went further and exposed the operators' own SSH logins. Legitimate pentest firms were caught out too, leaving real client tests on unsecured panels.

NorForge advises defenders to hunt for exposed panels (often answering on port 8000) and stray upload forms in hidden directories, and to patch Magento: a worker directory held a proof-of-concept for the critical StyleSmuggler flaw (CVE-2026-75650). NorForge is working with Reuters to warn victims and asking hosts to take the panels down.

Source: The Hacker News