In late September 2026, a Chinese speaking cybercriminal launched a large-scale campaign that attempted to break into more than 1,200 company websites across the United States, Canada, Australia, and Japan. The attacks succeeded against websites belonging to more than 100 companies. What made the operation notable was not the volume alone, but how little human effort was required: the hacker largely outsourced the work to autonomous AI agents
Cybersecurity researcher Snorre Fagerland of the Norwegian firm NorForge discovered the campaign after scanning the internet for exposed instances of Cairn, an open-source multi-agent AI platform. Starting around October 2, he identified roughly two dozen malicious control panels.
These exposed dashboards let him observe the attackers’ targets, progress, findings, and stolen credentials in near real time. The most active cluster, labeled AIA0001 by NorForge, used Chinese-language interfaces and linked 14 panels to more than 1,100 attack projects.
How the Campaign Worked
The hacker supplied extremely brief instructions typically fewer than 100 Chinese characters outlining preferred intrusion tactics. An automated pipeline then fed targets made up of primarily e-commerce sites with substantial traffic to the AI agents. The agents spent hours autonomously probing for vulnerabilities, adapting when initial approaches failed, and attempting to achieve remote code execution. Once successful, they planted uploader web shells to establish persistent access.
Successful intrusions averaged about 23 hours of probing. The overall success rate hovered around 10 percent. Fagerland estimated the campaign consumed roughly $5,000 in AI tokens a mix that appeared to include China’s DeepSeek and Anthropic’s Claude Code, or about $50 per successful breach. When failed attempts are included, the average cost per task drops lower.
Reuters independently reviewed the attacker’s activity logs and identified high-profile targets that included farm-equipment maker Deere, home-appliance company SharkNinja, and engine manufacturer Cummins.
The precise extent of data theft remains unclear, though the apparent goal was long-term access to shopping and payment systems for later monetization. Some companies have reported limited impact.
Traditional hacking campaigns often require teams of skilled operators, custom tooling, and significant time. Here, a single operator with modest financial outlay directed software that could explore, adapt, and exploit ordinary web weaknesses at scale.
The agents were not running novel zero-days; they methodically tested common vulnerabilities and, when blocked on a public-facing application, sometimes pivoted by searching public records for related infrastructure.
Cairn itself is a general-purpose open-source platform designed to coordinate multiple AI agents that share findings on a common board. Its legitimate uses include complex problem-solving. In this case, the same architecture was turned toward unauthorized access. The fact that the control panels were left publicly exposed allowed researchers to document the activity before many of the instances were taken down.
Broader Implications for Cybersecurity in The Era of Autonomous AI Agents
This campaign illustrates a shift in the economics of cybercrime. Commercially available or open-source AI agent frameworks can now handle multi-step intrusion workflows that previously demanded sustained human attention. Defenders face an environment in which reconnaissance, exploitation attempts, and persistence can run continuously with minimal supervision.
Security teams are already responding by hardening web applications, monitoring for anomalous automated probing, and scanning for exposed agent control panels. Some national agencies have begun drafting guidelines specifically for AI-agent security.
The episode also underscores the dual-use nature of advanced language models and agent frameworks: the same capabilities that accelerate legitimate research and automation can lower the barrier for opportunistic attackers.
The full scale of data exposure from the more than 100 compromised sites is still being assessed. What is already clear is that autonomous AI agents have moved from theoretical risk to demonstrated tool in real-world website takeovers executed at a cost that puts large campaigns within reach of individual operators. Organizations that treat web applications as low-priority assets now face a faster, cheaper, and more persistent threat landscape.
