Autonomous Cairn Agents Targeted More Than 1,200 Websites
A Chinese-speaking criminal operation used autonomous AI agents to probe more than 1,200 websites and reach sites associated with more than 100 companies, Reuters reported after reviewing attacker records. Security researcher Snorre Fagerland of NorForge identified exposed control panels for Cairn, an open-source agent tool intended for authorised penetration testing, and observed the activity in real time.
NorForge found roughly two dozen Cairn instances it considered malicious from about 2 October and grouped the exposed panels into three clusters. Its largest cluster, AIA0001, used Chinese-language interfaces, connected 14 panels to more than 1,100 attack projects and appeared focused on obtaining persistent access to online shop and payment systems in the United States, Japan and Australia.
Agents were given objectives rather than detailed playbooks
Cairn lets an operator give an agent a starting point and a goal, after which the agent can work through steps and post discoveries to a shared board. The operator can add guidance during a task. In this campaign, Reuters reported that the instructions could be fewer than 100 Chinese characters, while the agents performed much of the reconnaissance and exploitation work.
A common objective was to obtain code execution on an online shop and install a web-shell uploader. Such an uploader stores files rather than executing commands directly, but it can be replaced with a more capable tool. NorForge verified one live web shell at a large hardware-parts vendor and independently confirmed a compromise at a very large US retailer, where agents identified a cookie setting that selected a vulnerable backend server.
Deere said it remediated the issue and had no indication that sensitive information was accessed. SharkNinja said a standalone product-support website was affected and the threat was contained. Cummins said it was investigating a report involving a website operated by one of its vendors. Reuters also reported that two smaller businesses said they had been compromised. The amount of data taken, if any, remains unknown.
Different technical paths, low reported operating cost
NorForge said the observed paths differed by victim, rather than representing one universal exploit chain. One documented intrusion combined unauthorised write access to a memcached session store, unsafe deserialisation of saved PHP objects and a weakness in older Zend Framework code. A worker directory also contained a proof of concept and test environment for StyleSmuggler, CVE-2026-75650, a critical Magento flaw, although there is no evidence it was used in these incidents.
The researcher estimated that successful break-ins took a little under 23 hours on average. Across the tools observed, the approximate success rate was 10%, though NorForge cautioned that the clusters had different objectives and could not be compared directly. It estimated an average cost of around $5 per task, including failed or incomplete attempts; Fagerland separately told Reuters that the campaign used approximately $5,000 in tokens, or about $50 for each successful intrusion.
Exposed panels create a second security incident
The publicly accessible Cairn panels exposed target details, discovered weaknesses and credentials or keys collected by the agents. NorForge ran Trufflehog against panel data and found hundreds of secrets, 11% of which it verified were still valid. The panels also appeared to reveal controls for starting and stopping projects, supplying data and assigning new targets, although NorForge did not test whether those controls could be used without authentication.
NorForge also identified apparently legitimate penetration-testing firms that had left client testing data on unsecured panels. For organisations, the practical response is to search for unauthenticated agent consoles, particularly services exposed on port 8000; investigate unexpected file-upload forms; rotate any potentially exposed secrets; and apply Adobe’s hotfix where affected Magento deployments remain in use. Adobe Commerce 2.4.4 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9 are listed as affected by the StyleSmuggler advisory.