Autonomous AI Agents Breach Over 1,200 Websites in Low-Cost Hacking Campaign

A Chinese-speaking hacker deployed autonomous AI agents to attack more than 1,200 company websites with minimal human oversight — and a security researcher watched the entire operation unfold in real time through accidentally exposed control panels.

The campaign targeted websites belonging to major corporations including farm-equipment maker John Deere, appliance company SharkNinja and engine manufacturer Cummins. Researcher Snorre Fagerland of security firm NorForge discovered the operation on October 2, 2026 by scanning the internet for exposed instances of Cairn — an open-source AI hacking tool — and documented his findings publicly on October 20, 2026. Reuters independently reviewed the attacker's own records to confirm the victims.

---

How Autonomous Agents Carried Out the Attacks

Cairn gives AI agents a starting objective and lets them work toward it independently. The agents post findings to a shared board while the human operator provides occasional guidance. The tool was built for authorized penetration testing but was used here against online shops without permission.

Cairn's author, who posts online as "le1xia0," told Reuters the tool was not designed for hacking attacks and that harmful use was not their intention.

NorForge grouped the exposed control panels into three clusters and judged more than 20 of them likely malicious. The most active cluster — designated AIA0001 — is Chinese-language and links 14 panels to more than 1,100 attack projects. Its apparent goal is gaining lasting access to shop and payment systems for later exploitation. Targets spanned the United States, Japan and Australia.

A typical attack instruction told agents to find a way to run code on a target shop and then plant a web shell uploader — a form that saves uploaded files and can be swapped for something far more damaging at any time. NorForge independently confirmed at least two significant compromises. One involved a large hardware-parts vendor where a web shell was found live. Another involved a major US retailer where agents identified a single vulnerable cookie setting that exposed a backend server.

How Attack Chains Vary by Victim

One documented intrusion chain worked through unauthorized write access to a memcached session store, unsafe handling of saved PHP objects and a weakness in old Zend Framework code. This demonstrates that attack paths vary significantly from victim to victim, meaning there is no single patch or configuration fix that eliminates exposure across a diverse target landscape. Organisations cannot rely on a one-size-fits-all defence posture — each system's unique vulnerabilities create its own attack surface.

Understanding how website security threats evolve and how to defend against them has never been more pressing, particularly as AI-powered tools lower the barrier for exploiting legacy code paths that organisations may have deprioritised.

---

The Alarming Economics of AI-Powered Hacking

What was once a task requiring skilled human effort has been reduced to a largely automated and inexpensive process. The operator sketched out preferred tactics in fewer than 100 Chinese characters and let the agents handle the rest. Successful intrusions took an average of just under 23 hours. The overall success rate across observed tools was approximately 10% — a figure NorForge cautioned should be interpreted carefully since different clusters pursue different goals.

The Cost Per Breach Is Shockingly Low

Cost estimates are rough but striking. NorForge calculated an average of approximately $5 per task when including failed attempts. Fagerland separately told Reuters the entire campaign consumed roughly $5,000 worth of AI tokens — translating to approximately $50 per successful breach.

To put that in context: traditional cybercrime operations have historically required sustained investment in skilled personnel, custom tooling and manual reconnaissance. At $50 per confirmed intrusion, this campaign represents a fundamental shift in the economics of cybercrime — one that security teams and business leaders cannot afford to ignore. The growing intersection of artificial intelligence and offensive security is reshaping the threat landscape at a pace that defences have yet to match. For a broader look at the risks and challenges artificial intelligence presents to businesses, the implications extend well beyond cybersecurity alone.

Identifying the AI Models Behind the Operation

All tasks in the AIA0001 cluster ran under a worker named "claudecode_deepseek-v4.1-flash," suggesting the operation may have used a DeepSeek V4.1 Flash model driven by Anthropic's Claude Code. Neither NorForge nor Reuters confirmed the specific models involved.

The three named corporations told Reuters the damage appeared limited. Deere said it took steps to address the issue and found no evidence that sensitive information was accessed. SharkNinja said the attack targeted a standalone product-support site and had been contained. Cummins said it was investigating a report of a possible attack on a vendor-operated website. Two smaller businesses also confirmed they were compromised.

---

Exposed Panels, Stolen Secrets and the Second Layer of Risk

Beyond the break-ins themselves, leaving a Cairn control panel exposed on the open internet creates a distinct and serious risk. Those panels reveal who is being attacked, what vulnerabilities were found and which credentials and keys were extracted — meaning a company's secrets can be exposed regardless of whether an attack succeeds.

NorForge ran the secrets-scanning tool Trufflehog over panel data and found hundreds of exposed secrets. Eleven percent of those secrets were verified as still valid at the time of review.

When the Attackers Expose Themselves

A second English-language cluster went further and exposed the operators' own SSH logins to their staging servers. NorForge confirmed it did not log in. Compounding the problem, NorForge also found what appeared to be legitimate penetration-testing firms that had left real client tests on unsecured panels — putting paying customers' confidential data at equal risk.

The risk is not limited to criminal actors. Any organisation using AI-assisted security tooling that fails to properly secure its own control infrastructure may inadvertently expose sensitive client data through the same mechanisms attackers exploit.

NorForge said it is working with Reuters to notify victims and has requested that hosting providers take the exposed panels offline. The effectiveness of that effort depends entirely on how individual hosts respond.

A Pattern Forming Across Multiple Campaigns

This campaign follows a September 2026 report by Gambit Security documenting a separate operation in which a criminal used Cairn alongside two other AI tools to steal credit card data. No sources link the two campaigns but both reflect a growing pattern of AI-assisted criminal hacking that the security community is only beginning to quantify. Researchers and practitioners working at the intersection of artificial intelligence and cybersecurity are tracking these developments closely, as autonomous agent frameworks become increasingly accessible to malicious actors.

For further technical context on how autonomous hacking tools are classified and tracked, the MITRE ATT&CK framework provides a widely referenced taxonomy of adversarial techniques that maps directly to the behaviours documented in this campaign.

What Defenders Can Do Right Now

Security teams and business leaders can take immediate, practical steps to reduce exposure.

Exposed agent control panels of this type commonly respond on port 8000 — any instance without login protection warrants urgent investigation. Unexpected file-upload forms in hidden directories are a primary foothold these agents seek out.

Shops running Adobe Commerce 2.4.4 through 2.4.9 or Magento Open Source 2.4.6 through 2.4.9 should apply Adobe's available hotfix for the critical StyleSmuggler flaw (CVE-2026-75650) as a precaution, given its presence in attacker tools.

Security teams can use NorForge's findings to audit internet-facing control panels for AI testing tools and scan internal systems for unexpected upload forms or web shells. Businesses running e-commerce platforms should treat routine patching of legacy frameworks — particularly Magento and Zend-based systems — as a non-negotiable priority, given how frequently these vulnerabilities appear in documented attack chains.

The window between vulnerability disclosure and active exploitation is narrowing as AI agents reduce the time and cost of reconnaissance. Organisations that treat patching as a periodic exercise rather than a continuous discipline are now operating at measurably greater risk than they were even twelve months ago.