Researchers at NorForge have found more than 20 unsecured control panels that criminal groups were using to point autonomous AI agents at online shops, payment services and retailers. Reports based on Reuters’ own investigation put the number of companies breached at more than 100, among them Deere, SharkNinja and Cummins.
What happened
On 19 October 2026 NorForge, which has offices in Norway and the US, published “Inside Cairn”. The report examines publicly reachable dashboards for Cairn, an open-source framework that works through a problem step by step until it reaches a set goal. In these hands, the goal was breaking into websites. NorForge principal threat researcher Snorre Fagerland began tracking the panels in early October. His lead came from a September report by Gambit Security, which had found Cairn alongside other AI harnesses on an attacker’s staging server.
Shodan and Censys scans found many Cairn front ends open with no authentication. After setting aside empty panels and apparent genuine red team work, NorForge judged more than 20 likely malicious. It grouped them into three clusters. AIA0001 is Chinese-language and by far the busiest: 14 panels, more than 1,100 attack projects, and targets mostly in the US, Japan and Australia. AIA0002 works in English and is openly after card data and cryptocurrency. AIA0003 is a single panel with 59 projects, which NorForge assesses as malicious only with low confidence.
According to Reuters’ reporting, as relayed by Tom’s Hardware, Quartz and others, the most prolific operator had gone after more than 1,200 websites by the week ending 18 October and got into more than 100. The victims Reuters named were Deere, SharkNinja and Cummins. Deere said it had remediated and saw no sign that sensitive data was accessed. SharkNinja said the affected site held product support information and the incident was contained. Cummins said it was looking into a possible attack on a website run by a third-party vendor. Reuters could not establish how much data, if any, was taken across the whole campaign.
The technical picture
Cairn treats each job as a project with an origin and a goal. Worker agents record what they discover as “facts” and their next planned move as “intents”, posting both to a shared blackboard that a human operator can also add hints to. AIA0001 fed targets in automatically, ranking shops by traffic and using Playwright to confirm checkout worked. A typical tasking asked the agents to find unauthenticated remote code execution and leave a simple file-upload shell, which the operators could swap for something worse later.
The models behind the agents were cheap. AIA0001’s workers were labelled to suggest a Claude Code harness driving DeepSeek 4.1 Flash. AIA0002 appeared to run the Pi coding-agent framework on DeepSeek through the OpenRouter gateway. A briefly exposed AIA0001 worker directory held a familiar toolkit (Nmap, ffuf, OWASP Amass, PHPGGC) plus a Docker lab for validating a Magento code execution chain. NorForge confirmed one claimed compromise of a hardware parts vendor by checking that the planted shell was live. The agent’s own notes blamed a writable memcached session store combined with unsafe deserialisation in legacy Zend Framework code.
NorForge’s numbers are estimates, and it says so. Average cost was about $5 per task, failures included, though long-running projects could pass $100. Overall success sat at roughly 10%, and successful AIA0001 projects took a little under 23 hours on average. Coverage citing the report works this out at around $5,000 for the campaign, or about $50 per compromised site.
The operators’ own security was poor. Trufflehog found hundreds of secrets in the exposed data, 11% of them verified as valid, and the panels appeared to expose full administrative controls, which NorForge deliberately did not test.
Why it matters for UK organisations
None of the named victims is British, and the UK is not among the countries named in NorForge’s published targeting data. That is no comfort. A country list takes seconds to edit, and UK online retail is built on the same Magento, PHP and hosted e-commerce stacks. Anyone handling card payments should treat this as a preview of the scanning that is coming.
The economics are the real change. For a few dollars a target, attackers can afford patient, adaptive testing of mid-sized retailers that would never have justified a skilled human’s time. A 10% hit rate sounds low until the attempt costs less than a sandwich. The long tail of neglected UK storefronts and plugins is exactly where this approach pays off.
There is also a lesson for the UK’s growing AI-assisted testing market. NorForge found legitimate red team panels exposed the same way, carrying client findings and secrets. Under UK GDPR, that is a potential reportable breach as well as a contractual failure.
Expert view
When we test e-commerce estates, the findings that cause the most damage are rarely exotic. They are an unpatched extension, a forgotten staging subdomain, a deserialisation bug in a framework nobody remembers installing. What stands out in NorForge’s case studies is that the agents chained those ordinary weaknesses together patiently and without tiring. Fagerland told Reuters it was “not script kiddie stuff”, and the memcached-to-deserialisation chain bears that out.
I would not overstate it, though. These agents are not finding anything a competent tester could not. What has changed is the price of persistence. The gap between a weakness appearing and an automated attacker finding it is shrinking, so attack surface management must be continuous, not annual.
The sloppy operational security cuts both ways: it gave defenders rare visibility, but it also left stolen data and working credentials open to anyone. In my experience, once a secret has appeared somewhere like that, assume more than one party has it.
What to do now
- Patch internet-facing commerce platforms first. Bring Magento, Adobe Commerce, WooCommerce and their extensions up to date and remove abandoned modules. This is the Cyber Essentials security update management control, and its 14-day window for high and critical fixes is the minimum.
- Inventory everything public. Run your own external discovery against your domains and suppliers’ hosted sites, including support portals, staging environments and admin panels. Cummins says it is investigating a possible attack on a vendor-run site.
- Lock down admin and session infrastructure. Memcached, Redis and admin interfaces should never be reachable from the internet. Put admin panels behind MFA and IP restrictions (the Cyber Essentials firewall and secure configuration controls).
- Hunt for web shells and odd uploads. Look for new PHP files in upload and media directories, unexpected changes to checkout pages, and outbound connections from web servers.
- Rotate secrets. If you have engaged an AI-assisted testing provider, ask how its tooling is secured. Rotate any credentials shared during the engagement.
- Prepare for volume. Ensure WAF and rate-limiting rules can absorb sustained probing, and that exploitation alerts reach someone who acts.
Bottom line
NorForge’s findings are a snapshot, and the cost figures are rough. The direction is clear all the same: autonomous agents running cheap models are already compromising real businesses at scale, and a target country list is trivial to change. UK retailers and payment-handling SMEs should assume they are on someone’s list and fix the basics before an agent finds the gap.
Sources
- NorForge: Inside Cairn: Open Windows into massive AI-Driven Cyber Operations
- Tom’s Hardware: A Chinese hacker used AI agents to break into more than 100 company websites
- Quartz: Hacker used AI agents to breach 100+ sites, including John Deere
- Open Data Science: Hacker uses AI agents to breach more than 100 websites for $5,000
- The420.in: One hacker used AI agents to breach more than 100 websites
