{"schema_version":"0.8.0","id":"LR-2026-0228","record_version":6,"title":"Autonomous AI agent campaign (AIA0001) compromises 100+ company websites via Cairn platform","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":60.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-20","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"Cairn","tools_granted":["Nmap","OWASP Amass","dnsrecon","ffuf","PHPGGC","Python","Docker","Playwright"],"permissions_scope":null,"autonomy_level":"supervised-auto","guardrails_present":[],"deployment_context":"production","tier":null,"lifecycle_stage":null,"integration_type":"agentic_with_tools","intended_use":"To compromise company websites and gain persistent access to shopping and payment infrastructure for future monetization.","safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-09-25","date_disclosed":"2026-10-20","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"A Chinese-speaking operator used autonomous AI agents, to attack over 1,200 websites and compromise more than 100 companies, spending about $5,000 in tokens.","tags":["agentic-attack-campaign","credential-exposure","exposed-dashboards","e-commerce-targets","agentic-attack","credential-leak","web-exploitation","low-cost-scaling"],"date_detected":null,"near_miss":false,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: More than 100 companies' websites were compromised in a live production setting, with an uploader shell confirmed on a vendor's site.","harm_class":["third_party_security","operational","privacy"],"affected_description":"more than 100 companies' websites, including Deere, SharkNinja and Cummins; victim credentials published on exposed dashboards","protected_class_involved":null,"data_categories_exposed":["credentials"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://gbhackers.com/hacker-uses-ai-agents-to-breach-over-100-company-websites/amp/","publisher":"news search (Google News index)","date":"2026-10-20","type":"press","title":"Hacker Uses AI Agents to Breach Over 100 Company Websites With Minimal Human Effort","archived_url":null,"attachment":"first_report"},{"url":"https://cyberpress.org/ai-agents-breach-over-100-websites/","publisher":"news search (Google News index)","date":"2026-10-20","type":"press","title":"Hacker Uses AI Agents to Breach Over 100 Websites for Just $5,000","archived_url":null,"attachment":"fingerprint"},{"url":"https://cybersecuritynews.com/chinese-hacker-use-ai-agent-to-hack/","publisher":"news search (Google News index)","date":"2026-10-20","type":"press","title":"One Hacker Uses AI Agents to Breach Over 100 Company Websites for Just $5,000","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"C","system.tools_granted":"C","system.integration_type":"D","system.intended_use":"C","system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.tags":"C","event.near_miss":"D","event.adversarial_actor":"C","event.agent_involved":"C","event.detection_method":"C","event.incident_class":"C","event.summary":"C","event.date_disclosed":"A","event.trigger":"D","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.industry":"D","context.denominator_available":"D","context.country":"D","impact.severity_because":"D","event.date_occurred":"C"},"field_citations":{"system.harness":[{"source_index":2,"quote":"Cairn is a general-purpose problem-solving engine rather than a tool built only for hacking."},{"source_index":2,"quote":"Snorre Fagerland, principal threat researcher at NorForge, uncovered the activity while searching for exposed Cairn installations, an open-source platform that coordinates AI agents."}],"system.developer":[{"source_index":0,"quote":"A worker identifier hinted at Claude Code orchestration using a DeepSeek model, although NorForge presented this interpretation with caution."},{"source_index":2,"quote":"Worker names suggested a Claude Code setup using a DeepSeek model, but NorForge did not confirm the full model configuration."}],"system.tools_granted":[{"source_index":0,"quote":"Exposed worker directories contained reconnaissance and testing tools such as Nmap, OWASP Amass, dnsrecon, ffuf, PHPGGC, Python, and Docker."},{"source_index":0,"quote":"The targeting pipeline also employed Playwright to verify that prospective victims had functioning shopping sites."},{"source_index":2,"quote":"Its target pipeline used Microsoft’s Playwright browser automation tool to check that shopping sites could accept orders before passing them to Cairn."}],"system.autonomy_level":[{"source_index":0,"quote":"These findings enter a shared project blackboard, allowing agents to reuse evidence, revise their approach, and pursue alternative attack paths without continuous operator guidance."},{"source_index":2,"quote":"In the attacks described in NorForge’s technical report, operators supplied a target and a goal, then agents searched for weaknesses and worked toward gaining access."}],"system.deployment_context":[{"source_index":0,"quote":"A Chinese-speaking hacker used autonomous AI agents to compromise the websites of more than 100 companies, relying primarily on software for most of the intrusion work."},{"source_index":2,"quote":"Around October 2, he found roughly two dozen installations apparently being used for malicious activity."}],"system.integration_type":[{"source_index":0,"quote":"A Chinese-speaking hacker used autonomous AI agents to compromise the websites of more than 100 companies, relying primarily on software for most of the intrusion work."},{"source_index":2,"quote":"The platform stores findings on a shared project board so its agents can use earlier discoveries to choose their next steps."}],"system.intended_use":[{"source_index":0,"quote":"The targets included e-commerce businesses in the United States, Canada, Japan, and Australia, with the apparent goal of gaining persistent access to shopping and payment infrastructure for future monetization."},{"source_index":2,"quote":"Cairn is a general-purpose problem-solving engine rather than a tool built only for hacking."}],"event.detection_method":[{"source_index":0,"quote":"Snorre Fagerland, NorForge’s principal threat researcher, discovered this activity while investigating publicly exposed instances of Cairn, an open-source problem-solving platform."},{"source_index":2,"quote":"Snorre Fagerland, principal threat researcher at NorForge, uncovered the activity while searching for exposed Cairn installations, an open-source platform that coordinates AI agents."}],"event.tags":[{"source_index":0,"quote":"NorForge identified hundreds of exposed credentials, with TruffleHog verifying 11% as valid, showing how poorly secured AI infrastructure can worsen an initial compromise."},{"source_index":1,"quote":"The dashboards also exposed hundreds of credentials and other secrets, with TruffleHog verifying 11% as valid."},{"source_index":2,"quote":"The task instructions focused on finding ways to run code without signing in, including SQL injection, unsafe file uploads, login bypasses and unsafe handling of stored objects."}],"event.adversarial_actor":[{"source_index":0,"quote":"A Chinese-speaking hacker used autonomous AI agents to compromise the websites of more than 100 companies, relying primarily on software for most of the intrusion work."},{"source_index":2,"quote":"A Chinese-speaking hacker used AI agents to break into more than 100 company websites while spending an estimated $5,000 on AI tokens, according to a Reuters investigation in October."}],"event.incident_class":[{"source_index":0,"quote":"A Chinese-speaking hacker used autonomous AI agents to compromise the websites of more than 100 companies, relying primarily on software for most of the intrusion work."},{"source_index":2,"quote":"A Chinese-speaking hacker used AI agents to break into more than 100 company websites while spending an estimated $5,000 on AI tokens, according to a Reuters investigation in October."}],"event.agent_involved":[{"source_index":0,"quote":"A Chinese-speaking hacker used autonomous AI agents to compromise the websites of more than 100 companies, relying primarily on software for most of the intrusion work."},{"source_index":2,"quote":"The operation shows how one person can direct software to carry out complex attacks with little ongoing human input."}],"event.near_miss":[{"source_index":1,"quote":"NorForge independently confirmed an uploader shell on a vendor’s website."}],"event.summary":[{"source_index":1,"quote":"A Chinese-speaking hacker used autonomous AI agents to compromise websites belonging to more than 100 companies, spending an estimated $5,000 in AI tokens."},{"source_index":2,"quote":"Snorre Fagerland, principal threat researcher at NorForge, uncovered the activity while searching for exposed Cairn installations, an open-source platform that coordinates AI agents."}],"impact.harm_class":[{"source_index":0,"quote":"In one confirmed compromise, NorForge found an attacker-installed uploader shell on a vendor’s website."},{"source_index":0,"quote":"The investigation also revealed a secondary risk: unsecured attacker dashboards that published victim credentials and operational details."},{"source_index":2,"quote":"NorForge confirmed one claimed breach by checking a reported address on a hardware vendor’s website and finding a live uploader webshell."}],"impact.affected_description":[{"source_index":0,"quote":"Reuters identified Deere, SharkNinja, and Cummins among the affected organizations."},{"source_index":2,"quote":"After the campaign began on September 25, the agents attempted to compromise more than 1,200 websites, mainly online stores in the United States, Canada, Australia and Japan."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"NorForge identified hundreds of exposed credentials, with TruffleHog verifying 11% as valid, showing how poorly secured AI infrastructure can worsen an initial compromise."},{"source_index":2,"quote":"NorForge also found hundreds of exposed secrets in the open panels and said it was working with Reuters to notify victims."}],"context.industry":[{"source_index":0,"quote":"The targets included e-commerce businesses in the United States, Canada, Japan, and Australia, with the apparent goal of gaining persistent access to shopping and payment infrastructure for future monetization."}],"context.country":[{"source_index":0,"quote":"The targets included e-commerce businesses in the United States, Canada, Japan, and Australia, with the apparent goal of gaining persistent access to shopping and payment infrastructure for future monetization."},{"source_index":2,"quote":"Chinese-language instructions also do not establish the operator’s nationality, and researchers found no obvious state-backed activity in the exposed panels."}],"context.denominator_available":[{"source_index":1,"quote":"The campaign attempted to breach more than 1,200 websites."}],"impact.severity":[{"source_index":0,"quote":"A Chinese-speaking hacker used autonomous AI agents to compromise the websites of more than 100 companies, relying primarily on software for most of the intrusion work."},{"source_index":2,"quote":"After the campaign began on September 25, the agents attempted to compromise more than 1,200 websites, mainly online stores in the United States, Canada, Australia and Japan."}],"impact.severity_because":[{"source_index":0,"quote":"A Chinese-speaking hacker used autonomous AI agents to compromise the websites of more than 100 companies, relying primarily on software for most of the intrusion work."},{"source_index":2,"quote":"After the campaign began on September 25, the agents attempted to compromise more than 1,200 websites, mainly online stores in the United States, Canada, Australia and Japan."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-20"}],"event.date_occurred":[{"source_index":2,"quote":"After the campaign began on September 25, the agents attempted to compromise more than 1,200 websites, mainly online stores in the United States, Canada, Australia and Japan."}]},"notes_on_gaps":"No source states when the intrusions occurred (only the October 19 disclosure), so event.date_occurred is null. Model version, developer and permissions scope are not stated; the DeepSeek/Claude Code attribution is explicitly hedged by NorForge. The $5,000 figure is token spend by the attacker, not victim loss, so it is recorded as stated but does not set the severity band. Autonomy is graded supervised-auto from 'without continuous operator guidance'; no source states an approval arrangement. Root cause is left null: no source names a failed control, and the exposed Cairn dashboards are an exposure, not a stated root cause. No containment of the campaign, remediation hours, records count or regulatory involvement is stated. Country of operator is not stated. Harm class 'privacy' rests on credentials published on attacker dashboards. impact.direct_loss_usd: the source gives 5000 only as a bound ('an estimated'); not stored as an exact count. impact.third_parties_affected_count: the source gives 100 only as a bound ('more than'); not stored as an exact count. system.tier: not set; no operator named and deployment_context is not a lab's. Sources disagree on impact.affected_description: [0] \"more than 100 companies' websites, including Deere, SharkNinja and Cummins; victim credentials published on exposed dashboards\", [1] \"websites belonging to more than 100 companies, including Deere, SharkNinja and Cummins; more than 1,200 websites attempted\"; system.intended_use: [0] \"To compromise company websites and gain persistent access to shopping and payment infrastructure for future monetization.\", [1] \"Autonomous web intrusion: reconnaissance, vulnerability targeting and exploitation of shopping and payment websites for persistent access.\". [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-20] system.model_name: classified from described behaviour. system.harness: classified from described behaviour. system.integration_type: classified from described behaviour. system.developer: no source names the developer. system.autonomy_level: a source states the agent acted while a person watched or could stop it. system.deployment_context: classified from described behaviour. event.near_miss: classified from described behaviour. event.responsible_party: classified from described behaviour. event.trigger: no source states a cause. impact.reversibility: classified from described behaviour. context.industry: classified from described behaviour. context.denominator: classified from described behaviour. context.systemic_exposure: classified from described behaviour. context.denominator_available: classified from described behaviour. context.country: no source states the operator's location. Merged with LR-2026-0231, which described the same incident; their sources are included here. [corrected by Srini Iyer, approved 2026-10-20 in the corrections review: duplicate of another record, merged] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared] Stated count not stored as a number: the sources say the agents compromised the websites of 'more than 100 companies' (a bound); impact.third_parties_affected_count holds only an exact count. Attribution as the source states it: 'A worker identifier hinted at Claude Code orchestration using a DeepSeek model, although NorForge presented this interpretation with caution'; neither is recorded as fact. [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a stated loss or count the fields cannot hold was recorded in the notes; an attribution the source hedges is no longer stated as fact; citations to sentences about a different event were removed] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a denominator from another event or of another kind was cleared]"},"context":{"industry":"Retail Trade","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"A Chinese-speaking operator ran autonomous AI agents on the open-source Cairn platform, with tools such as Nmap, ffuf, PHPGGC, Python, Docker and Playwright, to find and exploit vulnerabilities in company websites.","quote":"A Chinese-speaking hacker used autonomous AI agents to compromise the websites of more than 100 companies, relying primarily on software for most of the intrusion work.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The agents broke into more than 100 company websites, installing uploader shells for persistent access to shopping and payment infrastructure, crossing the boundary of the victims' systems.","quote":"In one confirmed compromise, NorForge found an attacker-installed uploader shell on a vendor’s website.","source_index":0,"grade":"C"},{"step":"reached","text":"Over 100 companies' websites, including Deere, SharkNinja and Cummins; one vendor site carried an uploader shell. Exposed attacker dashboards also published victim credentials, hundreds of which were found, 11% verified valid.","quote":"Reuters identified Deere, SharkNinja, and Cummins among the affected organizations.","source_index":0,"grade":"C"},{"step":"caught","text":"NorForge principal threat researcher Snorre Fagerland discovered the activity while investigating publicly exposed Cairn instances, finding more than 20 dashboards tied to malicious operations.","quote":"Snorre Fagerland, NorForge’s principal threat researcher, discovered this activity while investigating publicly exposed instances of Cairn, an open-source problem-solving platform.","source_index":0,"grade":"C"},{"step":"done","text":"Deere said it remediated the issue and found no sensitive information accessed; SharkNinja said only a standalone support site was affected; Cummins said it was investigating a third-party vendor site. No containment of the campaign itself is stated.","quote":"Deere reported that it had remediated the issue and found no evidence of sensitive information being accessed.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-20","source_urls":["https://gbhackers.com/hacker-uses-ai-agents-to-breach-over-100-company-websites/amp/","https://cyberpress.org/ai-agents-breach-over-100-websites/"]}}