Hackers have been using autonomous AI agents to compromise more than 1,200 websites, including those of major businesses, with minimal human direction. A Chinese-speaking operator allegedly left control panels exposed online, allowing security researcher Snorre Fagerland of NorForge to observe the campaign in real time. Fagerland discovered that over 100 companies were targeted, among them Deere, SharkNinja, and Cummins, though it remains unclear whether sensitive data was actually exfiltrated.
How the Autonomous AI Agents Operated
The breach campaign made use of an open-source AI tool called Cairn, which normally assists in authorized penetration testing. In this case, it was repurposed to attack: agents were given a goal, then sent to probe websites for vulnerabilities, deploy web shells, and gain lasting control. These agents then posted their findings to a shared board. From there, the operator could give rudimentary hints before the agents continued autonomously.
NorForge grouped the exposed control panels into three clusters, identifying over 20 likely malicious instances. The biggest cluster, dubbed AIA0001, is Chinese-language and managed more than 1,100 attack projects. Its strategy seems focused on penetrating e-commerce platforms and payment systems in the US, Australia, and Japan, with implants like web-shell uploaders set into place once vulnerabilities are found.
Extent, Methods, and Financial Costs
Among confirmed victims is a large hardware parts vendor where a web shell was installed, and a major US retailer whose backend was compromised via a cookie setting. Deere and SharkNinja said the impact was limited—Deere reported no indication that sensitive information was accessed, while SharkNinja said the breach affected only a product support site. Cummins is investigating similar exposure through a vendor. Additional small businesses were also compromised.
The agents were efficient: it took under 23 hours on average for a successful break-in. Overall success rate was around 10 percent. As for cost, each attempt averaged about $5, and the total campaign cost roughly $5,000 in compute tokens—equating to approximately $50 per successful hack.
Panel Exposure and Reused Flaws
Leaving Cairn panels exposed posed second-order risks: they revealed who was being targeted, what weaknesses were discovered, and which credentials had been exfiltrated. NorForge found hundreds of secrets in these open panels—11% still valid—and, in one cluster, even exposure of SSH credentials. Some panels belonged to legitimate firms doing security testing, but left client data vulnerable by being unsecured.
The breach chain varied per victim, but in one case involved weak handling of PHP object serialization, write access to a memcached session store, and vulnerabilities in deprecated Zend Framework code. NorForge also flagged a hotfix for the “StyleSmuggler” CVE-2026-75650 vulnerability affecting Magento/Adobe Commerce sites; customers running certain versions need to patch immediately.
NorForge is collaborating with hosting providers to take down exposed control panels and has alerted victims. The operation seems to have been largely unsupervised, with operators writing just brief instructions—in one case fewer than 100 Chinese characters—before AI agents took over.
This attack highlights how cheap, fast, and low-effort AI-assisted hacking has become. Customized agents now scale attacks across time zones, platforms, and languages with minimal human oversight. Expect to see more of these campaigns, unless organizations build defenses to reduce exposure—patching known flaws, monitoring unexpected file upload points, locking down AI agent control panels and access to critical servers.
