AI Agents Left Unsupervised Broke Into 100+ Company Websites — And Nobody Noticed Until the Hackers Left Their Dashboard Public
A Chinese-speaking attacker has been running autonomous AI agents against company websites at scale, and the whole operation was exposed because the person running it forgot to put a password on their control panel.
Security researcher Snorre Fagerland of NorForge stumbled onto the campaign while scanning the internet for exposed instances of Cairn, an open-source AI agent framework that has become something of a favourite in offensive security circles. Starting around 2 October, he found roughly two dozen Cairn instances running in the wild. More than 20 looked malicious. He could read everything they were doing in real time.
Reuters reviewed the attacker's own logs and identified targets including John Deere, SharkNinja and Cummins. Whether any meaningful data was actually taken remains unclear.
Cairn works by giving an AI agent a goal and a starting point, then letting it figure out the steps on its own. Agents post updates to a shared board, and a human can drop in hints when needed. It was built for authorised penetration testing. The author, known online as le1xia0, told Reuters that weaponising it was never the intention. Presumably they didn't anticipate this either.
How the operation ran
NorForge sorted the exposed panels into three clusters. The busiest, labelled AIA0001, is Chinese-language and ties 14 panels to over 1,100 separate attack projects, mostly targeting online retailers in the US, Japan and Australia. The apparent goal isn't smash-and-grab; it's persistent access to payment infrastructure for later exploitation.
A typical task brief told the agents to find a way to run code on a target shop, then plant a web shell file uploader — not a full command shell, but a stepping stone that can be upgraded whenever the attacker wants. Short instructions too. The operator sketched out preferred tactics in under 100 Chinese characters and let the agents handle the rest.
NorForge independently confirmed at least two successful intrusions. One involved a large US retailer where the agent found a single cookie setting that pointed to a vulnerable backend server. Another, at a hardware-parts vendor, had a live web shell when NorForge checked. One documented attack chain ran through unauthorised write access to a memcached session store, unsafe PHP object handling, and a weakness in old Zend Framework code. Different victims, different paths — this isn't a single exploit being repeated.
Successful break-ins took just under 23 hours on average. The overall success rate across the clusters NorForge observed was around 10%, though the clusters have different objectives so comparing them directly is a stretch. Cost estimates are rough, but NorForge put the per-task average at about $5, with failed and abandoned attempts included. Fagerland told Reuters the entire campaign had burned through roughly $5,000 in AI tokens — working out to around $50 per successful compromise.
All AIA0001 tasks ran under a worker identifier that points toward a DeepSeek V4.1 Flash model driven by Anthropic's Claude Code. Neither NorForge nor Reuters confirmed the exact models.
The three named companies all downplayed the damage. Deere said it patched the issue and found no evidence of sensitive data being accessed. SharkNinja said the hit was limited to a standalone product-support site. Cummins said it was investigating a report involving a vendor-run website. Two smaller businesses confirmed they were compromised.
Leaving the dashboard open is its own problem
The exposed control panels created a second mess entirely separate from the break-ins themselves. Anyone who could reach an open panel could see which sites were being targeted, what vulnerabilities had been found, and what credentials and API keys had been harvested along the way. Your site doesn't need to have been successfully breached for your secrets to end up on an open panel — just tested.
NorForge ran the secrets scanner Trufflehog across the panel data and found hundreds of credentials. Eleven percent were still valid.
One cluster went further and exposed the operators' own SSH credentials to their staging servers. NorForge said it didn't log in. Presumably the temptation was there.
And it's not only criminal operations making this mistake. NorForge found what appear to be legitimate penetration testing firms that had left real client engagements on unsecured Cairn panels, exposing their customers' data to the same risk through sheer carelessness.
What defenders should be looking at
A few concrete things worth checking:
Cairn panels typically listen on port 8000. If you're running one without authentication, that's a problem regardless of what you're using it for.
Unexpected file upload forms sitting in obscure directories are exactly the foothold these agents were planting. Worth hunting for.
NorForge also found, in a worker directory it had access to, a proof-of-concept exploit for a critical Magento flaw called StyleSmuggler (CVE-2026-75650) along with what appeared to be a test lab for it. No evidence it was used in this campaign, but any shop running Adobe Commerce 2.4.4 through 2.4.9 or Magento Open Source 2.4.6 through 2.4.9 should apply Adobe's hotfix.
This investigation was prompted by a September report from Gambit Security covering a separate campaign where a criminal used Cairn alongside two other AI tools to skim payment card data. That's what first flagged Cairn as a tool attackers were actively using. The two operations don't appear to be connected.
NorForge said it is working with Reuters to notify victims and is pushing hosting providers to take the exposed panels offline. How quickly that happens depends entirely on whether those hosts bother to act.