Cairn is an open-source tool that steers AI agents toward a goal. A researcher scanning for it found attackers running it with their control panels open. NorForge published the findings on October 19. They show attackers’ agents working on online shops, from first probe to web shell.
Reuters reviewed one Chinese-speaking operator’s activity. That operator’s agents tried more than 1,200 sites and reached those of more than 100 companies. Snorre Fagerland of NorForge estimated to Reuters that the campaign used about $5,000 in tokens, roughly $50 per successful hack. NorForge says it has no actual usage numbers.
What is confirmed
Less than the headlines suggest. NorForge’s numbers come from panel records, which include the agents’ own claims. It says it checked at least two itself: a live uploader shell at a large hardware parts vendor, and a compromise chain at a large US retailer.
Reuters named three companies. Deere said it took steps to fix the problem and saw no sign of access to sensitive data. SharkNinja said the attack hit a standalone support site and it contained the threat. Cummins said it was looking into a possible attack on a vendor’s site. Two smaller businesses told Reuters they were compromised.
Reuters could not establish how much data left the sites in this campaign. The Next Web says it did not verify the intrusions. We found no analysis of the panel data beyond NorForge and Reuters. NorForge’s business is sandboxing AI agents, so it has a stake in this story.
What the agents did
NorForge calls the busiest cluster AIA0001: 14 panels and more than 1,100 projects. A typical task there named real shops and asked for code execution without a login. Top priorities were login SQL injection, open endpoints, file uploads and deserialization. Success meant planting an uploader shell, a form that saves files and leaves room for worse later.
Paths varied. One intrusion, by the agent’s own account, used write access to a memcached session store, unsafe PHP deserialization and old Zend Framework code.
Runs that reached the goal took a little under 23 hours on average, with about 140 findings each. NorForge published no request logs, so we cannot say how loud any single attack was. A run that lasts a day still gives a defender time that a one-shot exploit does not.
NorForge says Trufflehog found hundreds of secrets in the panels, 11% verified valid. Some firms that look like real penetration testers left client work on open panels too.
What to do
- Look for upload forms and PHP files you did not write, in hidden directories above all. If you find one, rotate what that server could reach.
- Keep memcached and other session stores off the internet. Retire old framework code.
- Apply Adobe’s hotfix for CVE-2026-75650 on Magento or Adobe Commerce. One agent’s folder held a proof of concept, though The Hacker News says nothing shows it was used here.
- Treat hours of path and parameter probing as an attack under way.
- Ask your penetration testing vendor where its agent panels run and who can reach them.