Autonomous AI agents reached 10% success in website attacks
Autonomous AI agents, software that can plan and complete a sequence of tasks with limited human direction, attempted to break into more than 1,200 websites. Reuters identified sites belonging to more than 100 companies in the attackers' records, including Deere, SharkNinja and Cummins. The amount of data taken, if any, remains unknown.
Security company NorForge uncovered the activity while searching the internet for exposed installations of Cairn, an open-source system that gives AI agents an initial objective and lets them work through it step by step. Agents share their findings on a common board, where a human operator can provide additional instructions. Cairn was created for authorized penetration testing, meaning security checks performed with the system owner's permission, but these operators directed it at online shops without authorization. Cairn's author told Reuters that the software was not intended for attacks or other harmful use.
Starting around October 2, NorForge found about two dozen Cairn installations associated with malicious activity. Because their control panels were accessible over the public internet, the company could observe the attackers' projects in real time. NorForge divided the exposed systems into three clusters and assessed more than 20 panels as probably malicious. It published its findings on Monday, while Reuters separately examined the records to identify affected organisations.
The largest cluster, labelled AIA0001 by NorForge, used Chinese-language instructions and connected 14 control panels with more than 1,100 attack projects. NorForge said its apparent objective was to establish persistent access to shopping and payment systems for possible later use. Its targets were in the United States, Japan and Australia. The Chinese-speaking operator provided preferred tactics in fewer than 100 Chinese characters, according to Reuters, then largely allowed the agents to proceed on their own.
A common assignment asked an agent to find a way to execute code, meaning make the website's server run attacker-chosen software, and install a web shell uploader. In this case, the uploader was a hidden form that saved files rather than directly accepting commands. An attacker could nevertheless replace the uploaded file later with something more harmful. NorForge checked one claimed compromise involving a large hardware-parts supplier and found that the uploader was still present. It also independently confirmed a compromise at a very large US retailer, where agents discovered the single cookie setting that routed a visitor to a vulnerable backend server. A cookie is a small piece of information stored for a website, while a backend is the server-side system behind the site.
The routes into individual victims varied. In one documented intrusion, the agent reported combining unauthorized write access to a memcached session store, a system used to temporarily hold website session information, with unsafe processing of stored PHP objects and a weakness in older Zend Framework code. PHP is software widely used to run websites, and Zend Framework supplies reusable components for PHP applications. This was one attack chain rather than a universal method used against every target.
The three named companies told Reuters that the effects were limited. Deere said it had taken corrective action and found no indication that sensitive information was accessed. SharkNinja said the incident affected a separate product-support website and that the threat had been contained. Cummins was investigating a possible attack against a website operated by one of its vendors. Two smaller businesses also confirmed to Reuters that they had been compromised.
NorForge calculated that successful intrusions took slightly under 23 hours on average. Across the tools it observed, the overall success rate was about 10%, although the company cautioned that the clusters pursued different objectives and could not be compared directly. Its rough estimate put the average cost at about $5 for each task, including failed and abandoned attempts, with considerable uncertainty. NorForge separately told Reuters that the campaign consumed about $5,000 in AI tokens, the units used to measure AI model usage, equivalent to roughly $50 per successful compromise.
Every AIA0001 task used a worker named claudecode_deepseek-v4.1-flash. That name could indicate DeepSeek V4.1 Flash being operated through Anthropic's Claude Code, but neither NorForge nor Reuters confirmed the underlying models. Reuters said only that the activity appeared to involve DeepSeek and Claude Code.
The publicly accessible panels created an additional security failure. They displayed targeted sites, discovered weaknesses, and credentials and other access secrets obtained during the work. NorForge scanned the panel data with Trufflehog, a tool designed to locate exposed secrets, and found hundreds of them. It verified that 11% remained valid. The interfaces also appeared to expose controls for starting and stopping projects, supplying new information and directing agents toward different targets. NorForge did not test whether those functions could be used without signing in.
A second, English-language cluster exposed the operators' own SSH credentials for staging servers. SSH, or Secure Shell, is a method for remotely accessing a computer. NorForge said it did not use those credentials. The problem was not limited to criminals: the company also found apparently legitimate penetration-testing businesses exposing real client assessments through unsecured Cairn panels, placing customer information at risk.
Defenders can search for Cairn-style panels exposed through port 8000, a numbered network entry point commonly used by these installations, and ensure that any legitimate panel requires authentication. Website owners and hosting teams should also investigate unexpected upload forms in concealed directories. These were the footholds the agents sought to establish.
NorForge additionally found proof-of-concept code, which demonstrates how a weakness can be exploited, for the critical Magento vulnerability StyleSmuggler (CVE-2026-75650) in a worker directory, along with a test environment. There is no evidence that the flaw was used in these intrusions. Adobe's hotfix, an urgent corrective update, should be applied to affected Adobe Commerce 2.4.4 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9 installations.
NorForge began its search after Gambit Security reported a separate September campaign in which a criminal combined Cairn with two other AI tools to steal payment-card details. No evidence connects that operation with the activity described here. NorForge said it was working with Reuters to notify victims and asking hosting providers to remove the exposed panels, although progress depended on the providers' responses.