AI agents probed 1,200 sites—what should defenders change first?
Exposed Cairn dashboards showed agents moving from target lists to persistent access with little human direction. The report documents more than 100 apparent compromises, but the extent of data theft remains unknown.
The short version
- What happened
- NorForge found more than 20 exposed Cairn panels used in apparently malicious operations; one 14-panel cluster contained more than 1,100 attack projects aimed mainly at e-commerce and payment systems.
- Who it affects
- Security teams at retailers and suppliers may face many simultaneous, persistent probes from one operator, making cross-site detection and rapid credential rotation more important.
- What remains unproven
- The campaign totals originate with NorForge, which sells AI-agent security products; Reuters independently reviewed activity and identified victims but did not reproduce every count.
Keep in mind
The campaign totals originate with NorForge, which sells AI-agent security products; Reuters independently reviewed activity and identified victims but did not reproduce every count.
A claimed compromise does not establish data theft. Reuters could not determine exfiltration across the affected sites, and named companies reported differing levels of impact.
Token cost and success-rate figures are estimates from exposed projects, not audited billing records or a controlled benchmark.
Multi-source analysis · 2 linked sources. Primary analysed source date: 19 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
The dashboards exposed an end-to-end attack workflow
NorForge says it found more than 20 unsecured Cairn control panels apparently used for malicious activity. Cairn is a state-based agent framework: an operator gives it a target and goal, then workers record discoveries, choose next steps and share evidence through a common blackboard. The largest cluster linked 14 Chinese-language panels and more than 1,100 projects targeting shopping and payment infrastructure in the United States, Canada, Japan and Australia. Typical instructions sought unauthenticated code execution, file-upload shells, authentication bypass and account takeover.
Reuters independently reviewed the exposed activity and reported attempted break-ins against more than 1,200 sites, with more than 100 apparent compromises. It identified sites linked to Deere, SharkNinja and Cummins among the targets. NorForge validated several intrusion chains, including live web shells and command execution. Successful projects in the most active cluster took a little under 23 hours on average, according to the report, showing how one operator could sustain many long-running probes without manually performing each step.[1][2]
The headline numbers do not establish the damage
The evidence is unusually direct because the attackers left their own panels open, but important limits remain. Reuters could not determine how much data was extracted. Deere said it found no indication that sensitive information was accessed; SharkNinja said a standalone support site was affected and the threat contained; Cummins was investigating a third-party vendor site. NorForge estimates roughly a 10% success rate and about $5 of model use per project, yet says it has no actual token records and that the estimate is highly uncertain.
For defenders, the practical lesson is not simply to buy another AI tool. Search for clusters of low-and-slow probing across web applications, watch for new files and outbound connections that follow apparently minor vulnerabilities, and include supplier-hosted sites in incident response. Teams deploying their own agents should also lock down control panels, rotate exposed credentials and preserve human-readable logs. The assessment would strengthen with victim forensics, confirmed exfiltration evidence, reproducible cost data and independent analysis of how often agents—not human operators—completed the decisive intrusion steps.[1][2]
The distinction that matters
How the observed campaign moved from target to access
The exposed panels revealed an iterative process rather than a single automated exploit.
Select
Automated lists ranked reachable commerce sites
Many targets entered the queue
Probe
Agents shared findings and tried attack paths
Projects could run for hours or days
Persist
Successful tasks installed shells or gained accounts
Later access became possible