Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites

Summary

The supplied article describes malicious use of Cairn, an open-source agent tool built for authorized penetration testing, to attack company websites with little human intervention. It reports attempts against more than 1,200 sites and access to websites belonging to more than 100 companies, based on attacker records reviewed by Reuters. These figures are not equivalent to independently confirmed breaches of every organization, and the extent of data theft remains unknown.^[0]

The principal cluster, designated AIA0001 by NorForge, linked 14 Chinese-language panels to more than 1,100 attack projects. NorForge assessed its objective as maintaining access to shop and payment systems for later use, with targets in the United States, Japan, and Australia. Typical agent assignments sought code execution followed by an upload foothold. Reported exploitation routes varied, including selection of a vulnerable backend through a cookie and, in one agent account, a chain involving memcached sessions, saved PHP objects, and legacy Zend Framework code.^[0]

Victim statements constrain the impact assessment. Deere said it addressed the problem and had no indication that sensitive information was accessed. SharkNinja said the attack affected a standalone product-support site and was contained. Cummins was investigating a possible attack on a vendor-operated website. NorForge directly checked selected compromises, including a live uploader, but the article does not establish widespread payment-data theft by this activity set.^[0]

Exposed Cairn panels created a separate disclosure risk by revealing targets, findings, credentials, and keys. NorForge verified 11% of hundreds of discovered secrets as still valid and also found apparently legitimate testing firms exposing client projects. The immediate defensive priorities are to investigate unauthorized upload footholds and assess exposed agent panels and their contents. All substantive findings here derive from one supplied news article recounting NorForge and Reuters reporting; the underlying research and attacker records were not supplied as independent sources.^[0]

Attack chain

1. 1. Operator tasking and autonomous execution: The operator supplied Cairn agents with a starting point and goal, with preferred tactics reportedly expressed in fewer than 100 Chinese characters. Agents worked step by step, posted findings to a shared board, and could receive additional human hints. A typical malicious assignment explicitly sought code execution on a shop before planting an uploader.^[0]
2. 2. Victim-specific discovery and exploitation: The article describes different intrusion routes rather than a universal exploit sequence. In one independently confirmed retailer compromise, agents found the cookie setting that selected a vulnerable backend. Separately, an agent's account described unauthorized memcached session-store writes, unsafe handling of saved PHP objects, and a weakness in old Zend Framework code. These examples are not established as parts of the same victim's chain.^[0]
3. 3. Deployment of an upload foothold: The stated task placed uploader deployment after the code-execution objective. NorForge checked one claimed intrusion at a large hardware-parts vendor and found the uploader live. Although described as a web-shell uploader, the form saved uploaded files rather than directly executing commands. The article identifies later replacement with more capable tooling as a possibility, not an observed subsequent phase.^[0]

Disclosure timeline

Actor profile

AIA0001

NorForge's designation for the busiest observed activity cluster, not an identified individual or organization. The article associates it with 14 Chinese-language panels, more than 1,100 attack projects, and an assessed objective of durable access to shop and payment systems. The language evidence does not establish nationality or state sponsorship. All tasks reportedly used the worker name claudecode_deepseek-v4.1-flash, suggesting a possible model/tool combination, but the underlying models were not confirmed.^[0]

How it works

In one independently confirmed retailer intrusion, backend selection mattered: agents identified the cookie setting that directed requests to a vulnerable server. The supplied article does not identify the cookie, its value, the backend vulnerability, or a reproducible exploit sequence.^[0]

A separate intrusion was documented through the agent's own account as involving unauthorized write access to a memcached session store, unsafe handling of saved PHP objects, and a weakness in old Zend Framework code. This establishes a reported victim-specific chain, not a particular CVE or a common mechanism across all affected websites.^[0]

The intended upload foothold was a form that saved uploaded files. The article explicitly distinguishes it from a command-executing shell, despite using the term web-shell uploader. NorForge verified a live example at one vendor; replacement with a more capable implant was described as a potential next step rather than an observed event.^[0]

Cairn's exposed panels disclosed operational and victim information independently of an intrusion's outcome, including targets, discovered weaknesses, credentials, and keys. They also appeared to expose controls for starting or stopping projects, supplying data, and redirecting agents. NorForge did not test unauthenticated operation of those controls, so the evidence supports information exposure but not a demonstrated control-plane takeover.^[0]

Affected versions and patch status

Key takeaways

• This is an agent-enabled intrusion campaign with multiple reported exploitation paths, not an established single-CVE outbreak. AIA0001 is an activity-cluster designation; the operator's identity and underlying AI models remain unconfirmed.^[0]
• Keep the scale measurements separate: more than 1,200 attempted websites, access to websites belonging to more than 100 companies, and more than 1,100 AIA0001 attack projects are not interchangeable counts of independently confirmed breaches.^[0]
• The reported economics suggest inexpensive automation but remain uncertain. Approximately $5 per task included failed or prematurely ended attempts; roughly $50 per successful intrusion came from a separate campaign-level estimate. Successful intrusions reportedly averaged slightly under 23 hours, while the approximately 10% success rate pooled clusters with different goals.^[0]
• Exposed agent panels constitute a separate data-disclosure problem, including during legitimate testing. The supplied evidence provides behavioral hunting leads but no actionable campaign-specific domains, IP addresses, hashes, or literal uploader paths for an IOC list.^[0]
• Do not merge this activity with the separate September Cairn-enabled credit-card theft campaign or treat StyleSmuggler as its proven entry point. The article explicitly reports no established link between the operations and no evidence that the discovered Magento proof of concept was used in these break-ins.^[0]

Defensive actions

• Inventory internet-exposed Cairn and similar agent panels, including services on port 8000, and remove unauthenticated public access.: Exposed panels enabled observation of attacks and disclosure of victim secrets. The article specifically identifies port 8000 as a common location to check. Information exposure was observed, while unauthenticated operation of the apparent project controls was not tested.^[0]
• Hunt web content for unexpected file-upload forms, particularly in hidden directories, and investigate unauthorized upload capability.: Uploader deployment was a stated agent objective, and NorForge verified one live example. A file-saving uploader can represent an attacker foothold even when it does not itself execute commands.^[0]
• Review exposed agent-panel contents for credentials and keys, and revoke or rotate secrets found to have been disclosed.: NorForge's Trufflehog analysis found hundreds of secrets and verified 11% as still valid. Panel disclosure therefore presents credential risk even where the original attack did not succeed.^[0]
• For potentially affected applications, investigate backend-routing cookie behavior, unauthorized session-store writes, and handling of saved PHP objects in legacy Zend Framework components.: These are the concrete victim-specific exploitation details described in the article. They are investigation leads, not a universal signature or an established explanation for every reported compromise.^[0]
• Ask penetration-testing providers whether client projects or results were hosted on publicly accessible Cairn panels, and assess any resulting data exposure.: NorForge found apparently legitimate firms exposing real client tests. Sensitive testing information could therefore be disclosed outside malicious deployments and regardless of a test's outcome.^[0]
• Apply Adobe's StyleSmuggler hotfix to deployments within the reported affected Adobe Commerce and Magento Open Source ranges, while keeping this remediation separate from campaign attribution.: A worker directory contained a CVE-2026-75650 proof of concept and test lab, and the article explicitly recommends patching affected builds. Possession of that material does not establish that the vulnerability caused any reported intrusion.^[0]