Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites

Summary

Exposed control panels provided visibility into unauthorized website attacks conducted with autonomous Cairn agents. The supplied article reports attempts against more than 1,200 sites and activity reaching websites belonging to more than 100 companies, drawing on Reuters' review of attacker records. Those totals should not be read as more than 100 independently verified breaches. NorForge separately reported confirming a live web shell at a hardware-parts vendor and a compromise of a very large US retailer.^[0]

The clearest campaign grouping is AIA0001, NorForge's designation for a Chinese-language cluster linking 14 exposed panels to more than 1,100 attack projects. Its targets included sites in the United States, Japan and Australia. NorForge assessed the apparent objective as lasting access to shop and payment systems for later use. Operators supplied short instructions, while agents pursued target-specific exploitation and attempted to establish upload-based footholds. The evidence does not establish the operator's identity or nationality.^[0]

Reported victim impact varied. Deere said it had addressed the problem and found no indication that sensitive information was accessed. SharkNinja said the attack affected a standalone product-support site and had been contained. Cummins was investigating a possible attack on a vendor-operated website, while two smaller businesses acknowledged compromise to Reuters. The amount of data taken, if any, remained unknown.^[0]

The exposed panels created an additional disclosure channel by revealing targets, discovered weaknesses and secrets. NorForge found hundreds of secrets and verified 11% as still valid; apparently legitimate penetration-testing firms had also exposed client projects. Immediate defensive priorities are to restrict exposed agent panels, investigate unexpected upload forms and assess credentials visible in project records. A Magento exploit found in a worker directory warrants the separately reported patching action, but it is not evidence that Magento exploitation drove this campaign.^[0]

Attack chain

1. 1. Operator tasking: The operator supplied Cairn with a target and goal, sometimes using very short instructions. A typical task directed agents to find a way to execute code on a shop and then plant a web shell uploader. Cairn supported incremental agent work, a shared findings board and additional operator hints.^[0]
2. 2. Autonomous investigation and target-specific exploitation: Agents worked through website weaknesses rather than following one universal exploit path. In the independently confirmed US retailer compromise, agents identified a cookie setting that selected a vulnerable backend server. Separately, one agent's account described unauthorized writes to a memcached session store, unsafe processing of saved PHP objects and a weakness in old Zend Framework code. These examples must not be combined into a single chain affecting every victim.^[0]
3. 3. Upload-based foothold: The intended post-exploitation artifact was an upload form that saved files, rather than a form that directly executed commands. The article explains that attackers could subsequently replace it with something more capable. NorForge checked one claimed intrusion at a hardware-parts vendor and found the reported web shell live; the evidence does not establish later replacement or command execution through that form.^[0]

Disclosure timeline

Actor profile

AIA0001

A researcher-designated Chinese-language activity cluster, not an established real-world identity. NorForge linked 14 panels and more than 1,100 attack projects to this grouping and assessed its apparent purpose as retaining access to shop and payment systems for later use. Targets included the United States, Japan and Australia. Its tasks used the worker label claudecode_deepseek-v4.1-flash, but the underlying models were not confirmed. Language and tooling labels do not establish nationality or a connection to the separate September campaign described by Gambit Security.^[0]

How it works

Cairn supplied an autonomous workflow rather than one fixed exploit: agents received an initial objective, worked toward it step by step and posted findings to a shared board. Human operators could add hints. This explains how brief operator instructions could lead to different exploitation paths across websites without establishing that every task completed without intervention.^[0]

One intrusion was described by the agent as combining unauthorized write access to a memcached session store, unsafe handling of stored PHP objects and a weakness in older Zend Framework code. The article does not supply exact versions, payloads or a CVE mapping for this chain, and the account should remain distinguished from NorForge's independently verified compromises.^[0]

At a very large US retailer, a particular cookie setting selected a vulnerable backend server. NorForge independently confirmed that compromise. The evidence supports backend selection as an important exploitation condition, not a general claim that cookie manipulation alone bypassed authentication or compromised all servers.^[0]

The requested foothold was a file-upload form that saved uploaded files. Its immediate behavior differed from an interactive command-execution shell, although the article notes that attackers could replace it with something more harmful. The live artifact verified at a hardware-parts vendor supports a concrete foothold finding, not proof of every possible subsequent action.^[0]

Internet-exposed Cairn panels disclosed project data, including weaknesses, credentials and keys. They also appeared to expose controls for starting or stopping projects, supplying data and retargeting agents. NorForge did not test whether those controls could be operated without login, so unauthenticated project manipulation remains unverified even though data exposure was observed.^[0]

Affected versions and patch status

Key takeaways

• Separate attempted scale, attacker-record claims, independently verified compromise and vendor-confirmed impact. The more-than-1,200-site figure describes targeting, while the article supplies narrower verification and response details.^[0]
• Reported economics suggest inexpensive automation, but the estimates are not interchangeable: approximately $5 per task included failures and early endings, whereas approximately $50 per successful hack came from a separate campaign-level estimate. Successful intrusions averaged a little under 23 hours; the roughly 10% success rate carried a warning that cluster objectives differed.^[0]
• Do not infer a confirmed model stack from the worker name claudecode_deepseek-v4.1-flash. The article says neither NorForge nor Reuters verified the models, and a tooling label is not sufficient actor attribution.^[0]
• Agent-panel exposure is a distinct security problem from website compromise. It can disclose victim secrets and legitimate client testing data even when exploitation fails; apparent access to agent controls was not tested.^[0]
• No actionable attacker domains, IP addresses, hashes or concrete malicious file paths are supplied. The indicator list is therefore empty; a tool name, worker label, port number or unproven exploit association should not be promoted into a standalone compromise indicator.^[0]
• This dossier rests on one supplied news article. NorForge's telemetry, Reuters' record review and company responses are reported within that source, not supplied as independently citable documents. The earlier Gambit Security campaign remains separate because the article provides no link between the operations.^[0]

Defensive actions

• Find internet-accessible Cairn or comparable agent control panels, including services answering on port 8000, and remove unauthenticated public access.: The investigation depended on exposed panels that revealed live projects and secrets. The article specifically identifies port 8000 as a common location, but port exposure alone is not proof of malicious activity. Apparently legitimate penetration-testing firms also exposed client data this way.^[0]
• Inspect affected shop and support-site web roots for unexpected file-upload forms, especially in hidden directories.: Upload-based footholds were an explicit task objective, and NorForge verified a live web shell at a hardware-parts vendor. An artifact that only saves files still merits investigation; absence of a command interface does not make it benign.^[0]
• Identify credentials and keys present in exposed project records, and revoke or rotate those belonging to the organization or its clients.: NorForge found hundreds of secrets in panel data and verified 11% as still valid. Exposure can therefore remain consequential even when a website attack failed or when the project was an authorized test.^[0]
• For potentially affected PHP applications, review session-store write exposure, unsafe handling of saved PHP objects and legacy Zend Framework components.: These conditions appeared together in one agent-described intrusion. This is a targeted investigation lead, not a confirmed universal campaign signature or a substitute for establishing the actual exploitation path on each victim.^[0]
• Where backend selection depends on cookies, assess the security of every selectable backend rather than relying on the default route.: NorForge's confirmed retailer case involved agents finding a cookie setting that selected a vulnerable backend. Testing only the ordinary frontend route could miss the condition described in that compromise.^[0]
• Apply the reported Adobe hotfix to affected Adobe Commerce and Magento Open Source installations after checking the stated product ranges.: A worker directory held a StyleSmuggler proof of concept and test lab for CVE-2026-75650. The article recommends patching affected builds, while explicitly stating that use of this flaw in the reported break-ins was not demonstrated.^[0]