NorForge finds AI agents used in campaign targeting more than 1,200 websites
Researchers observed exposed Cairn panels used in attempted intrusions, while Reuters identified companies affected by one campaign. The extent of any data theft remains unclear.
NorForge researcher Snorre Fagerland says a Chinese-speaking hacker used AI agents to attempt intrusions against more than 1,200 websites in the US, Canada, Australia and Japan after a campaign began on September 25. The findings, reported by Reuters on October 20, show how one operator could direct sustained attacks across many e-commerce sites, although the number of successful breaches and the extent of any data theft remain unclear.
Fagerland said he discovered the activity while scanning for exposed instances of Cairn, an AI system used to direct agents toward a defined goal. Beginning around October 2, he found about two dozen instances being used for malicious activity. NorForge separately said it identified more than 20 exposed Cairn panels likely linked to malicious operations.
How the Cairn campaign worked
According to Reuters, the hacker gave agents brief instructions, in fewer than 100 Chinese characters, describing preferred intrusion tactics. As of late in the week before the report appeared, the agents had attempted to break into more than 1,200 sites. Fagerland said successful intrusions typically took about 23 hours of probing and estimated the campaign consumed roughly $5,000 in AI tokens, or about $50 per successful hack.
NorForge describes Cairn as a system that breaks a project into steps, shares findings among its agents and lets a human operator add hints. Its exposed panels gave researchers a view of target selection, searches for weaknesses and attempted intrusions. In one project aimed at a major US online retailer, NorForge said the recorded goal was met when a webshell was injected into the site. It did not identify that retailer.
The exposed panels also posed a risk of their own: NorForge said they could reveal discovered weaknesses, account secrets and API keys. The company said it redacted sensitive material and withheld panel addresses. It also found some exposed panels associated with apparently legitimate security testing, alongside those it assessed as likely malicious.
What the affected companies said
Fagerland's report did not name victims, but Reuters said it identified them by independently reviewing the hacker's Cairn activity. Deere told Reuters it had taken remediation actions and had no indication that sensitive information was accessed. SharkNinja said an incident affecting a standalone product-support site had been contained. Cummins said it was investigating a report of a potential attack on a website operated by a third-party vendor.
Reuters could not establish how much, if any, data was extracted without authorization in the breaches. That distinction matters because an attempted intrusion, a successful entry and the removal of sensitive information carry different consequences for the organizations and people involved. Fagerland said the activity demonstrated that commercially available AI agents could carry out complex intrusions with little direction from one operator.
Read in depth: AI
YouTube Music starts labeling songs made with generative AI
Listeners can tap a label on the player page to see how AI contributed to a track. YouTube says it will use partner disclosures and its own detection tools.
Six parents describe tighter rules for children’s social media and AI use
Guardian interviews show how six families are setting limits on social media and AI. A separate U.S. survey shows parents’ views vary sharply by how teens use chatbots.
Sources and context
- How one hacker used AI agents and a few thousand dollars to break into scores of sitesReuters, republished by Rappler
- Inside Cairn: Open Windows into massive AI-Driven Cyber OperationsNorForge
AI-assisted article checked against the listed sources. NewsJaws did not conduct interviews or attend the reported events.