Chinese-speaking criminal deployed autonomous AI agents against 1,200 sites, report says

A Chinese-speaking criminal deployed autonomous AI agents against more than 1,200 company websites beginning around Oct. 2, 2026, breaching over 100 firms including Deere, SharkNinja and Cummins, The Hacker News reported. The campaign targeted e-commerce sites in the U.S., Canada, Australia and Japan, with attackers seeking lasting access to shop and payment systems.

Cairn is open-source software for running autonomous AI agents, programs that can plan and carry out intrusion steps with little human direction. Fagerland identified about two dozen malicious Cairn instances and watched the attacks unfold in real time.

The operator used Cairn to automate reconnaissance, exploitation and post-exploitation tasks, sending each attack fewer than 100 Chinese characters. Successful intrusions averaged 23 hours, and the success rate was around 10% across observed attacks. Fagerland estimated the campaign cost roughly $5,000 in AI model usage, about $50 per successful hack.

NorForge identified three clusters of exposed Cairn panels. The busiest cluster, labeled AIA0001, included more than 1,100 attack projects targeting U.S., Japanese and Australian sites. The agents adapted on the fly, shifting focus to associated infrastructure when initial attempts failed.

Deere said it took corrective action after the incident and saw no indication that sensitive information was accessed. SharkNinja said the attack hit a standalone product-support site holding no sensitive customer or corporate data, and that the threat was contained. Cummins said it is investigating a report of a possible cyber attack on a website operated by one of its third-party vendors.

The Hacker News reported that Reuters reviewed the attacker’s own records to identify the victim companies, putting the total at more than 100. Whether anyone took data remains unknown.

The creator of Cairn, known as le1xia0, said Cairn was not built for hacking attacks and denied any malicious intent, saying criminals had repurposed it. The tool was originally built for authorized penetration testing.

Exposed Cairn control panels leaked credentials, keys and attack tactics, and 11% of exposed secrets were still valid. The campaign used a worker named claudecode_deepseek-v4.1-flash, which researchers said suggested involvement of DeepSeek V4.1 Flash and Anthropic’s Claude Code models, though researchers did not confirm the link.

A typical assignment told agents to find a way to run code on a shop and plant a web shell uploader that could support further compromise. NorForge confirmed one breach at a large hardware-parts vendor after finding a live web shell, and independently verified a compromise at a major U.S. retailer through a single vulnerable cookie setting. One documented intrusion abused write permissions on a memcached session store, mishandled saved PHP objects and exploited a weakness in older Zend Framework code.

The danger was not limited to criminal operators. Legitimate penetration-testing firms also left real client tests exposed on unsecured Cairn panels, risking their clients’ data.

NorForge recommends checking whether agent control panels sit exposed on port 8000, looking for upload forms tucked away in hidden directories, and patching Magento for CVE-2026-75650, known as StyleSmuggler. The firm described them as immediate steps to mitigate similar risks.

Security experts warn that autonomous AI agents make it easier for attackers to launch faster and more sophisticated attacks with minimal human oversight. Yuval Itzchakov said, “This is another example of how AI is lowering the bar for threat actors, making attacks both faster and more sophisticated.”

Bitsight reported a surge in discussions about using autonomous AI agents for attacks across cybercriminal forums. The reporting indicates a broader trend of AI adoption in cybercrime.

A similar campaign in September 2026 demonstrated the scalability of AI-driven automation. A campaign reconstructed by Gambit Security used Cairn alongside tools called Strix and Hermes to steal more than 600,000 credit card records from over 100 e-commerce sites, spending roughly $25 per target. Strix handled reconnaissance, Cairn handled exploitation and Hermes handled orchestration, with one operator issuing fewer than 2,000 prompts across 260 sessions.

In September 2026, the operation struck a Fortune 500 hospitality firm, a leading U.S. airline, an industrial supplies distributor and an online fashion retailer, while 79% of exposed cards went to U.S. cardholders. The attack chain ran through 16 sequential stages, beginning with SQL injection and ending at AWS Secrets Manager access. At one victim, automated cleanup routines wiped out 180 database tables along with their backups.