The autonomous agents tried more than 1,200 sites and reached websites belonging to more than 100 companies, according to Reuters’ review of the attackers’ own records.
How Cairn-powered agents were tasked and what they did
Researchers observed attackers using Cairn, an open-source AI orchestration tool, to give agents a starting point and a goal and then let them work step by step. A typical task instructed the agents to find a way to run code on an online shop and then plant a web shell uploader — a form that saves uploaded files and can be swapped later for a more dangerous payload. NorForge judged more than 20 exposed Cairn panels likely malicious; the busiest cluster, dubbed AIA0001, is Chinese-language and linked 14 panels to more than 1,100 attack projects.
The campaign’s apparent objective, NorForge said, was lasting access to shop and payment systems for later use. Successful break‑ins took a little under 23 hours on average, and the overall success rate across the observed tools was about 10%, NorForge found. NorForge estimated an average cost of roughly $5 per task (counting failed attempts); the researcher also said the campaign had consumed about $5,000 worth of tokens, or roughly $50 per successful hack.
All AIA0001 tasks ran under a worker named claudecode_deepseek-v4.1-flash, which could point to a DeepSeek V4.1 Flash model driven by Anthropic’s Claude Code — a possibility Reuters reported while noting neither the researcher nor Reuters confirmed the models.
Named victims and corporate responses
Reuters identified targets from the attacker panels and named victims that included Deere, SharkNinja and Cummins. Deere said it took steps to fix the problem and had no sign that sensitive information was accessed. SharkNinja said the attack hit a standalone product‑support site and that it had contained the threat. Cummins said it was investigating a report of a possible attack on a website run by one of its vendors. Two smaller businesses also told Reuters they were compromised. NorForge checked one claimed break‑in at a large hardware‑parts vendor and found a live web shell; it also independently confirmed the compromise of one very large U.S. retailer where agents identified a single cookie setting that routed traffic to a vulnerable backend server.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageHow the exposure was discovered and what the panels leaked
Security researcher Snorre Fagerland of NorForge found the operations by scanning for exposed copies of Cairn beginning around October 2. He found about two dozen instances being used maliciously and was able to read attacker activity in real time because the operators left control panels open on the internet. The panels not only showed which sites were being attacked and what weaknesses were found, they also displayed credentials, keys and the operators’ notes.
NorForge ran the secrets scanner Trufflehog over the panel data and found hundreds of secrets; it verified about 11% as still valid. The panels appeared to expose the tool’s full controls — start and stop projects, feed new data, and retarget agents — and one English‑language cluster additionally exposed the operators’ own SSH logins to staging servers. NorForge reported it did not log into exposed systems and is working with Reuters to warn victims and asking hosting firms to take the panels down.
Observed technical chains and a Magento artifact
The attack paths varied by victim. One documented intrusion, by the agent’s own account, proceeded through unauthorized write access to a memcached session store, unsafe handling of saved PHP objects, and a weakness in old Zend Framework code. NorForge stressed these are different paths across victims — a single chain observed, not the only chain.
NorForge also found a worker directory containing a proof‑of‑concept for a critical Magento flaw, StyleSmuggler (CVE‑2026‑75650), and a test lab for it. The directory provided no evidence the flaw was used in these break‑ins, but NorForge pointed defenders to Adobe’s hotfix guidance: apply the Adobe Commerce or Magento fixes for the indicated versions (Adobe Commerce 2.4.4 through 2.4.9, or Magento Open Source 2.4.6 through 2.4.9) if still on affected builds.
What this means for technologists, affected enterprises, and penetration‑test firms
- Technologists and security teams: Hunt for exposed agent control panels (often answering on port 8000), check for stray upload forms in hidden directories — the specific footholds these agents targeted — and verify any credentials found in third‑party scans have been rotated.
- Affected enterprises and procurement leaders: Confirm whether vendor or third‑party sites were tested on public panels and insist on secure handling of penetration‑test artifacts; Deere, SharkNinja and Cummins’ responses show containment is possible, but visibility and quick remediation matter.
- Penetration‑testing firms and legitimate researchers: Audit hosted test instances to ensure control panels are not publicly reachable. NorForge found apparently legitimate firms had left real client tests on unsecured panels, exposing those customers to the same risk as criminal operators.
The incident ties two problems together: autonomous AI agents that can run unsupervised at low cost, and human error in exposing the very control panels that reveal targets, tools and secrets. NorForge’s outreach to hosts and Reuters’ review of the panels have begun to map who was affected, but the hosts’ responses will determine whether exposed controls are taken down — and whether the same automation will be reused against other online shops. For now, the facts on the table are concrete: exposed panels, reusable agent workflows, and hundreds of leaked secrets that remain a live hazard unless removed or rotated.
https://thehackernews.com/2026/10/hackers-use-autonomous-ai-agents-to.html
