Cases › security breach › LR-2026-0228
Autonomous AI agent campaign (AIA0001) compromises 100+ company websites via Cairn platform
Severity major: More than 100 companies' websites were compromised in a live production setting, with an uploader shell confirmed on a vendor's site.
Happened 2026-09-25 · Earliest source we hold 2026-10-20, 25 days later
A Chinese-speaking operator used autonomous AI agents, to attack over 1,200 websites and compromise more than 100 companies, spending about $5,000 in tokens.
Risk grouping: AI used to exploit
| Who caused it | A person or organisation “In the attacks described in NorForge’s technical report, operators supplied a target and a goal, then agents searched for weaknesses and worked toward gaining access.” source |
|---|---|
| Intended or not | Intended “The targets included e-commerce businesses in the United States, Canada, Japan, and Australia, with the apparent goal of gaining persistent access to shopping and payment infrastructure for future monetization.” source |
| Before or after release | After release “After the campaign began on September 25, the agents attempted to compromise more than 1,200 websites, mainly online stores in the United States, Canada, Australia and Japan.” source |
| The AI's part | Used as a tool “A Chinese-speaking hacker used autonomous AI agents to compromise the websites of more than 100 companies, relying primarily on software for most of the intrusion work.” source |
The story
1 · What it was doingA Chinese-speaking operator ran autonomous AI agents on the open-source Cairn platform, with tools such as Nmap, ffuf, PHPGGC, Python, Docker and Playwright, to find and exploit vulnerabilities in company websites.
2 · What went wrongThe agents broke into more than 100 company websites, installing uploader shells for persistent access to shopping and payment infrastructure, crossing the boundary of the victims' systems.
3 · What it reached or didOver 100 companies' websites, including Deere, SharkNinja and Cummins; one vendor site carried an uploader shell. Exposed attacker dashboards also published victim credentials, hundreds of which were found, 11% verified valid.
4 · How it was caughtNorForge principal threat researcher Snorre Fagerland discovered the activity while investigating publicly exposed Cairn instances, finding more than 20 dashboards tied to malicious operations.
5 · What was doneDeere said it remediated the issue and found no sensitive information accessed; SharkNinja said only a standalone support site was affected; Cummins said it was investigating a third-party vendor site.
Others like this
Show every field, with its source and grade
The AI system
Software around the model
Cairn
C one secondary source states it
Tools it was given
Nmap, OWASP Amass, dnsrecon, ffuf, PHPGGC, Python, Docker, Playwright
C one secondary source states it
How much it acted alone
it acted alone, watched by a person
D inferred by us from the described behaviour, reason shown
Stage of use
in live use
D inferred by us from the described behaviour, reason shown
How it was connected
agentic with tools
D inferred by us from the described behaviour, reason shown
What it was for
To compromise company websites and gain persistent access to shopping and payment infrastructure for future monetization.
C one secondary source states it
What happened
When it happened
2026-09-25
C one secondary source states it
Earliest source we hold
2026-10-20
A the date the source itself carries
Who caught it
an independent researcher or journalist
C one secondary source states it
Themes
agentic attack campaign, credential exposure, exposed dashboards, e-commerce targets, agentic attack, credential leak, web exploitation, low cost scaling
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Kind of harm
others' security, operations, privacy
C one secondary source states it
Who was affected
more than 100 companies' websites, including Deere, SharkNinja and Cummins; victim credentials published on exposed dashboards
C one secondary source states it
Kinds of data exposed
credentials
C one secondary source states it
Why this severity
More than 100 companies' websites were compromised in a live production setting, with an uploader shell confirmed on a vendor's site.
D inferred by us from the described behaviour, reason shown
Context
Industry
Retail Trade
D inferred by us from the described behaviour, reason shown
LR-2026-0228 · version 6 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON