A cybersecurity researcher has uncovered what appears to be one of the clearest examples yet of criminals using autonomous artificial intelligence to break into company websites largely on their own, with a human doing little more than pointing the AI at a target and occasionally nudging it along.
Snorre Fagerland, a researcher at the security firm NorForge, found the activity by scanning the internet for exposed copies of Cairn, an open-source tool that gives AI agents a goal and lets them work toward it step by step, posting their progress to a shared dashboard that a human operator can monitor and occasionally steer. Cairn was built for authorized penetration testing. Its creator, who goes by the online handle “le1xia0,” told Reuters the tool was never intended to be used for attacks.
Starting around October 2, Fagerland identified roughly two dozen Cairn control panels that had been left exposed on the open internet, misconfigured in a way that let him watch the operators’ activity in something close to real time. NorForge published its findings this week, and Reuters, which reviewed the report in advance, separately confirmed several of the victims through its own reporting.
According to that reporting, the agents targeted more than 1,200 websites belonging to upwards of 100 companies. Confirmed targets include the farm equipment maker Deere, the appliance brand SharkNinja, and the engine manufacturer Cummins. Deere said it fixed the issue and saw no evidence that sensitive information was accessed. SharkNinja said the intrusion hit a standalone product support site, which it has since contained. Cummins said it is looking into a possible attack on a website run by one of its vendors. Two smaller businesses also confirmed to Reuters that they had been compromised. NorForge said it independently verified a working web shell, a tool that lets an attacker run commands on a hijacked server, planted at a large parts vendor, as well as a separate compromise at a very large US retailer.
The busiest operation NorForge tracked, which it labeled cluster AIA0001, communicated in Chinese and linked 14 separate control panels to more than 1,100 attack attempts. Its apparent goal was to gain lasting access to online stores and payment systems that could be exploited or resold later. According to Reuters, the human operator needed to type out fewer than 100 Chinese characters describing the preferred approach before the AI agents carried out the rest of the work themselves, chaining together footholds such as weaknesses in outdated web frameworks to gain code execution and plant backdoors for later use.
NorForge said successful break-ins took the agents a little under 23 hours on average, with an overall success rate across the tools it observed of roughly 10 percent, though it cautioned that different clusters had different goals and are not directly comparable. The firm estimated the operations cost roughly $5 per attempted task on average, including failures. Fagerland told Reuters the busiest campaign spent around $5,000 in AI computing credits in total, working out to roughly $50 for each successful hack, a small fraction of what a skilled human intrusion team would typically cost.
One detail is likely to draw particular attention in the security industry. Logs reviewed by NorForge showed the AIA0001 cluster’s tasks running under a worker labeled “claudecode_deepseek-v4.1-flash,” suggesting the operation may have paired a DeepSeek model with Anthropic’s Claude Code tool, though neither NorForge nor Reuters was able to independently confirm which underlying models were actually doing the work.
Beyond the direct intrusions, the exposed control panels created a second problem. They publicly revealed lists of targets, the weaknesses the agents had found, and credentials and access keys the agents had stolen along the way. NorForge ran the panel data through Trufflehog, an open-source tool for finding leaked secrets, and verified that roughly 11 percent of the hundreds of credentials it found were still active. A separate, English-language cluster exposed operators’ own SSH login details for staging servers, which NorForge said it did not attempt to use. The researcher also found panels apparently belonging to legitimate penetration testing firms that had left real client engagement data sitting unsecured in the same way.
NorForge is working with Reuters to notify the affected companies and is pressing hosting providers to take the exposed panels offline, though it noted that how quickly that happens depends on how those providers respond. The firm’s advice for defenders is straightforward: watch for agent control panels accidentally exposed on the internet, often reachable on port 8000, and check for file upload forms appearing in unexpected or hidden directories, since planting an upload point was the common first step the agents used to gain a lasting foothold.
