Attackers abuse Cairn AI agent platform to breach more than 100 companies

Threat actors have used Cairn, an open-source platform that coordinates autonomous AI agents, to attack more than 1,200 websites and breach over 100 companies, according to research by AI security firm NorForge reported by The Hacker News and SecurityWeek. The findings, which Reuters investigated and used to name victims, offer one of the clearest looks yet at how attackers are operationalizing AI agents at scale against e-commerce and corporate sites.

What happened

SecurityWeek reported that NorForge began investigating after a Gambit Security report described hackers using AI harnesses to automate attacks on online retailers. Researcher Snorre Fagerland found the operations by scanning the internet for exposed Cairn instances, discovering that some threat actors had left their control panels open, The Hacker News said. Cairn gives agents a goal and a starting point, and the agents work toward it step by step while posting findings to a shared board. Its author said it was not designed for attacks.

According to SecurityWeek, NorForge identified at least three clusters. The largest, Chinese-language cluster ran more than 1,100 attack projects across 14 dashboards against e-commerce and payment infrastructure in the US, Japan and Australia, apparently seeking persistent web shell access. A second, English-language cluster focused on credit card and cryptocurrency theft, and a third ran 59 projects against e-commerce sites. Reuters reported that the largest group breached companies including John Deere and SharkNinja; NorForge itself did not name victims.

Technical details

The Hacker News said a typical task was gaining code execution on a shop and planting a web shell uploader. One documented intrusion chained unauthorized write access to a memcached session store, unsafe handling of serialized PHP objects and a weakness in old Zend Framework code. Activity was seen from around October 2, successful intrusions took a little under 23 hours on average, and the overall success rate was roughly 10%. Fagerland told Reuters the campaign used about $5,000 in tokens, or around $50 per successful hack. The report said a worker label pointed to DeepSeek and Claude Code, but neither NorForge nor Reuters confirmed which models were used.

Who is affected

Deere said it fixed the problem and saw no sign that sensitive information was accessed, while SharkNinja said the attack hit a standalone product support site and was contained, The Hacker News reported. Cummins was investigating a possible attack on a vendor's website. It is unknown how much data was taken. The exposed panels also leaked victims' secrets: NorForge verified 11% of hundreds of discovered secrets as still valid.

What to do

NorForge recommends scanning for exposed agent control panels, which often respond on port 8000 without a login, and looking for unexpected file upload forms in hidden directories. A proof of concept for the critical Magento flaw CVE-2026-75650 was found in a worker directory, though there is no evidence it was used, so affected stores should apply Adobe's hotfix for Adobe Commerce 2.4.4 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9. NorForge is working with Reuters to warn victims and asking hosting providers to take the panels offline.