When autonomous AI becomes a cyber weapon: Over 1,200 enterprise websites targeted
Cyberattacks are entering a new era where threat actors no longer need to manually execute every step. Instead, AI agents - autonomous programs capable of making independent decisions and taking actions - are being empowered to infiltrate corporate websites with virtually zero human supervision. A recently uncovered campaign illustrates the alarming scale of this technique: more than 1,200 websites were scanned, and over 100 companies were successfully breached.
How autonomous AI infiltrates enterprise systems?
The campaign was operated by a Chinese-speaking threat actor leveraging an open-source AI tool named Cairn. Originally, Cairn was developed for legitimate penetration testing (the practice of evaluating security by simulating controlled attacks to discover vulnerabilities). Cairn's author, operating under the handle "le1xia0," told Reuters that the tool was never designed for malicious attacks and that its misuse was entirely unintended.
Cairn operates with a high degree of autonomy: the operator merely provides a starting point and an objective, leaving the AI agents to chart their own path. During execution, the AI continuously updates its findings to a shared dashboard where the attacker can inject tactical hints if necessary. However, the tool was weaponized to launch unauthorized attacks against e-commerce storefronts.
According to Reuters, which reviewed the attacker’s own data, the agents attempted to breach more than 1,200 websites and successfully gained access to systems at over 100 companies. The victim list includes major enterprises such as agricultural equipment manufacturer Deere, home appliance brand SharkNinja, and engine manufacturer Cummins. It remains unconfirmed how much data was exfiltrated.
Responding to the incident, Deere stated that it had implemented remediation measures and found no evidence that sensitive data was accessed. SharkNinja confirmed the incident was confined to a standalone product support website and that the threat was contained. Meanwhile, Cummins is investigating a suspected attack targeting a site hosted by a third-party vendor. Additionally, two smaller enterprises confirmed their systems had been compromised.
Low cost, high speed, and a dangerous exploit chain
Notably, human intervention during these attacks was minimal. The operator only needed to provide concise tactical directives, often under 100 Chinese characters - leaving the AI agents to autonomously execute the rest.
Cybersecurity firm NorForge, which discovered the campaign, revealed that a successful breach took an average of under 23 hours. While the overall success rate hovered around 10%, the operational costs were strikingly low. On average, each task cost roughly $5 (factoring in failed attempts and early terminations). Snorre Fagerland, a researcher at NorForge, noted that the entire campaign consumed only about $5,000 worth of AI tokens - averaging a mere $50 per successful intrusion.
Tasks within this attack cluster operated under a process named claudecode_deepseek-v4.1-flash, suggesting the potential use of a DeepSeek V4.1 Flash model orchestrated via Anthropic's Claude Code tool. Although neither NorForge nor Reuters officially confirmed the underlying models, Reuters reported that the campaign appeared to leverage both platforms.
From a technical standpoint, the AI did not rely on a single technique, instead combining multiple attack vectors into an exploit chain:
Exploiting unauthorized write access to Memcached session storage.
Exploiting insecure deserialization of PHP objects.
Targeting vulnerabilities in legacy Zend Framework codebases.
Upon breaching a target, the agents deployed a web shell uploader. This utility stores uploaded files on the server without immediately executing commands, serving as a stealthy staging foothold that attackers can later swap for more aggressive payloads to maintain persistent access to payment gateways and store infrastructure.
NorForge confirmed that one major hardware component supplier still had this backdoor actively lurking. They also documented a large US retailer breached after an agent discovered a specific cookie configuration that routed requests to a vulnerable backend server.
The attacker's own blunder: Exposed dashboards leak operational secrets
The operation came to light due to the operators' own operational security lapses. NorForge researcher Snorre Fagerland discovered the campaign while scanning the internet for exposed Cairn instances. Starting around October 2, he identified approximately 20 Cairn dashboards actively used for malicious purposes, providing real-time visibility into the threat actors' activities.
NorForge categorized the exposed dashboards into three clusters. The most active cluster (designated AIA0001), operated in Chinese, linked 14 dashboards across more than 1,100 attack projects targeting entities in the United States, Japan, and Australia.
However, leaving these Cairn dashboards open to the public internet created severe repercussions:
Complete operational exposure: The dashboards laid bare victim identities, discovered vulnerabilities, and compromised credentials and cryptographic keys. Any website targeted within these public instances faced direct exposure.
Hundreds of leaked secrets: Running the secret-scanning tool TruffleHog against the instances, NorForge uncovered hundreds of confidential credentials, with 11% verified as still active and valid.
Loss of tool control: Anyone could interact with the open dashboards—pausing or starting projects, or redirecting attack targets entirely. Another English-speaking cluster even leaked SSH credentials to the operator's own staging server.
Collateral risk from security firms: Even more concerning, the issue extended beyond cybercriminals. NorForge discovered that several legitimate penetration testing firms had also left live client testing engagements exposed on unprotected dashboards, putting client data at critical risk.
Key vulnerabilities enterprises must proactively audit
In the face of autonomous AI threats, network administrators and security teams should immediately undertake actionable audits:
Inspect exposed service ports: Dashboards for these AI agents typically communicate over port 8000. Conduct regular scans to identify and immediately disable publicly accessible dashboards lacking password protection.
Detect suspicious file uploaders: Scan systems for hidden file upload forms nestled in unfamiliar directories - a common foothold established by AI agents to maintain persistent control.
Promptly apply Magento security patches: Within an agent's working directory, NorForge identified proof-of-concept exploit code for a critical Magento vulnerability dubbed StyleSmuggler (CVE-2026-75650). While there is currently no evidence confirming its active exploitation in these specific breaches, sites running the platform should immediately deploy Adobe's hotfix - applicable to Adobe Commerce versions 2.4.4 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9.
However, manual audits often address only the symptoms and struggle to defend against multi-stage, AI-driven exploit chains. To build robust defenses against automated threats, many organizations partner with independent cybersecurity specialists. Advanced cybersecurity assessment and penetration testing solutions from IPSIP Vietnam empower enterprises to proactively simulate real-world attack scenarios, identify misconfigurations early, and eliminate blind spots before adversarial AI can exploit them. Supported by a comprehensive service ecosystem - spanning the Flexsecure360 risk management platform, Penetration Testing (Pentest), and a 24/7 Security & Network Operations Center (NOC/SOC) - IPSIP provides an end-to-end security fabric to monitor and instantly respond to anomalous scanning activities.
The shift toward low-cost, high-speed autonomous AI agents introduces an unprecedented security paradigm for organizations. As technical barriers to large-scale attacks continue to drop, continuously auditing public-facing assets, restricting file upload permissions, and applying patches promptly represent fundamental yet decisive steps to safeguard infrastructure against this rising wave of automated attacks.
Reference: The Hacker News
