A Chinese-speaking attacker has instructed AI agents to massively hack online stores. Since September 25, autonomous systems have attacked more than 1,200 sites in four countries and, according to researchers, have penetrated the resources of more than 100 companies. Among the victims were Deere and SharkNinja.
The campaign was discovered by NorForge researcher Snorre Fagerland, who studied the open control panels of the Cairn platform. The system distributes tasks among multiple AI agents who choose the following actions themselves, run tools, and verify the results. Fagerland found more than 20 panels related to suspicious activity, and restored operations on saved tasks and results.
The largest series of attacks was associated with 14 Cairn panels. The targets were mainly trading sites of the USA, Canada, Australia and Japan. The attacker's instruction consisted of less than 100 Chinese characters. After the launch, the agents spent hours checking the sites, going through the ways of penetration and independently deciding where to move after each unsuccessful attempt. Permanent participation of a person was not required.
The main goal was to remotely run commands on other people’s servers without authorization. To infiltrate, the agents searched for SQL injections, ways to bypass access rights checks, and errors when downloading files. In one episode, AI found no vulnerabilities in a large company’s main application, studied archival information about its infrastructure, and found another control panel. After several hours of sampling, the system reported the successful execution of extraneous commands on the server.
Part of the results of NorForge was confirmed regardless of the reports of the agents themselves. On the site of a large supplier of components, researchers discovered a functioning web shell through which a stranger could upload files to the server. According to experts, the most active operator sought first of all to gain a foothold in foreign infrastructure and to keep the opportunity to return later. Such access potentially allows the attack to continue even after the initial hacking is completed.
Successful operations in the studied group took an average of just under 23 hours, although individual tasks were performed for more than five days. According to Fagerland's estimate, the work of the models for the entire campaign could cost about $500, or $ 50 in terms of successful hacking. Judging by the names of the work processes, the attacker used the DeepSeek V4.1 Flash model in conjunction with Claude Code. It is impossible to establish exact costs, since there are no confirmed accounts for the work of AI by researchers.
Deere said it took action after the incident and found no signs of access to sensitive information. SharkNinja confirmed the hacking of a separate site with background information about the products and reported that the threat was localized. Cummins is still verifying information about a possible attack on the resource of a third-party contractor. The scale of possible data theft in the campaign remains unknown.
The unexpected weakness was also found in the attackers themselves. Some of the Cairn panels remained available from the Internet without authorization and disclosed information about the targets found by vulnerabilities and credentials. NorForge found hundreds of passwords, keys and other secrets in the records, with an automatic check confirmed the validity of 11% of them. On the external grounds, the panels also allowed to interfere with the work of agents, but researchers did not check this possibility in practice.
The developer of Cairn under the pseudonym le1xia0 stated that he created the platform as a universal multi-agent system, not a means for criminal attacks. NorForge cooperates with journalists when notifying the affected companies and tries to achieve the closure of dangerous panels. The problem was also the legitimate security specialists. Some commands that conducted the allowed checks also left the interfaces available from the outside, risking to disclose information about clients and vulnerabilities found.
Mass hacks with minimal human participation have ceased to be isolated experiments. In September, Gambit Security described a similar campaign with self-contained Hermes, Strix and Cairn tools. In six days, the researchers recorded the compromise of at least 27 companies, and the total damage involved stealing more than 600,000 payment card records. In one case, automatic trace clearance resulted in the removal of 180 database tables, including backups.
For site owners, the main change is the speed and cost of attacks. Autonomous agents are able to consistently explore a lot of resources, change tactics after failures and independently develop the found vulnerability before full penetration. Even a relatively small budget allows an attacker to launch long-term operations against a large number of companies. In this case, the detected gap can turn into a working access channel before administrators have time to fix the problem.
The campaign was discovered by NorForge researcher Snorre Fagerland, who studied the open control panels of the Cairn platform. The system distributes tasks among multiple AI agents who choose the following actions themselves, run tools, and verify the results. Fagerland found more than 20 panels related to suspicious activity, and restored operations on saved tasks and results.
The largest series of attacks was associated with 14 Cairn panels. The targets were mainly trading sites of the USA, Canada, Australia and Japan. The attacker's instruction consisted of less than 100 Chinese characters. After the launch, the agents spent hours checking the sites, going through the ways of penetration and independently deciding where to move after each unsuccessful attempt. Permanent participation of a person was not required.
The main goal was to remotely run commands on other people’s servers without authorization. To infiltrate, the agents searched for SQL injections, ways to bypass access rights checks, and errors when downloading files. In one episode, AI found no vulnerabilities in a large company’s main application, studied archival information about its infrastructure, and found another control panel. After several hours of sampling, the system reported the successful execution of extraneous commands on the server.
Part of the results of NorForge was confirmed regardless of the reports of the agents themselves. On the site of a large supplier of components, researchers discovered a functioning web shell through which a stranger could upload files to the server. According to experts, the most active operator sought first of all to gain a foothold in foreign infrastructure and to keep the opportunity to return later. Such access potentially allows the attack to continue even after the initial hacking is completed.
Successful operations in the studied group took an average of just under 23 hours, although individual tasks were performed for more than five days. According to Fagerland's estimate, the work of the models for the entire campaign could cost about $500, or $ 50 in terms of successful hacking. Judging by the names of the work processes, the attacker used the DeepSeek V4.1 Flash model in conjunction with Claude Code. It is impossible to establish exact costs, since there are no confirmed accounts for the work of AI by researchers.
Deere said it took action after the incident and found no signs of access to sensitive information. SharkNinja confirmed the hacking of a separate site with background information about the products and reported that the threat was localized. Cummins is still verifying information about a possible attack on the resource of a third-party contractor. The scale of possible data theft in the campaign remains unknown.
The unexpected weakness was also found in the attackers themselves. Some of the Cairn panels remained available from the Internet without authorization and disclosed information about the targets found by vulnerabilities and credentials. NorForge found hundreds of passwords, keys and other secrets in the records, with an automatic check confirmed the validity of 11% of them. On the external grounds, the panels also allowed to interfere with the work of agents, but researchers did not check this possibility in practice.
The developer of Cairn under the pseudonym le1xia0 stated that he created the platform as a universal multi-agent system, not a means for criminal attacks. NorForge cooperates with journalists when notifying the affected companies and tries to achieve the closure of dangerous panels. The problem was also the legitimate security specialists. Some commands that conducted the allowed checks also left the interfaces available from the outside, risking to disclose information about clients and vulnerabilities found.
Mass hacks with minimal human participation have ceased to be isolated experiments. In September, Gambit Security described a similar campaign with self-contained Hermes, Strix and Cairn tools. In six days, the researchers recorded the compromise of at least 27 companies, and the total damage involved stealing more than 600,000 payment card records. In one case, automatic trace clearance resulted in the removal of 180 database tables, including backups.
For site owners, the main change is the speed and cost of attacks. Autonomous agents are able to consistently explore a lot of resources, change tactics after failures and independently develop the found vulnerability before full penetration. Even a relatively small budget allows an attacker to launch long-term operations against a large number of companies. In this case, the detected gap can turn into a working access channel before administrators have time to fix the problem.
