AI agents probed 1,200 sites—what should defenders change first?
Exposed Cairn dashboards showed agents moving from target lists to persistent access with little human direction. The report documents more than 100 apparent compromises, but the extent of data theft remains unknown.
The short version
- What happened
- NorForge found more than 20 exposed Cairn panels used in apparently malicious operations; one 14-panel cluster contained more than 1,100 attack projects aimed mainly at e-commerce and payment systems.
- Who it affects
- Security teams at retailers and suppliers may face many simultaneous, persistent probes from one operator, making cross-site detection and rapid credential rotation more important.
- What remains unproven
- The campaign totals originate with NorForge, which sells AI-agent security products; Reuters independently reviewed activity and identified victims but did not reproduce every count.
The dashboards exposed an end-to-end attack workflow
NorForge says it found more than 20 unsecured Cairn control panels apparently used for malicious activity. Cairn is a state-based agent framework: an operator gives it a target and goal, then workers record discoveries, choose next steps and share evidence through a common blackboard. The largest cluster linked 14 Chinese-language panels and more than 1,100 projects targeting shopping and payment infrastructure in the United States, Canada, Japan and Australia. Typical instructions sought unauthenticated code execution, file-upload shells, authentication bypass and account takeover.[1][2]
Who it affects
Security teams at retailers and suppliers may face many simultaneous, persistent probes from one operator, making cross-site detection and rapid credential rotation more important.[1][2]
Keep in mind
The campaign totals originate with NorForge, which sells AI-agent security products; Reuters independently reviewed activity and identified victims but did not reproduce every count.
A claimed compromise does not establish data theft. Reuters could not determine exfiltration across the affected sites, and named companies reported differing levels of impact.
Token cost and success-rate figures are estimates from exposed projects, not audited billing records or a controlled benchmark.
Multi-source analysis · 2 linked sources. Original source date: 19 October 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 4 min The evidence, methods, implications and limitations
The dashboards exposed an end-to-end attack workflow
NorForge says it found more than 20 unsecured Cairn control panels apparently used for malicious activity. Cairn is a state-based agent framework: an operator gives it a target and goal, then workers record discoveries, choose next steps and share evidence through a common blackboard. The largest cluster linked 14 Chinese-language panels and more than 1,100 projects targeting shopping and payment infrastructure in the United States, Canada, Japan and Australia. Typical instructions sought unauthenticated code execution, file-upload shells, authentication bypass and account takeover.
Reuters independently reviewed the exposed activity and reported attempted break-ins against more than 1,200 sites, with more than 100 apparent compromises. It identified sites linked to Deere, SharkNinja and Cummins among the targets. NorForge validated several intrusion chains, including live web shells and command execution. Successful projects in the most active cluster took a little under 23 hours on average, according to the report, showing how one operator could sustain many long-running probes without manually performing each step.[1][2]
The headline numbers do not establish the damage
The evidence is unusually direct because the attackers left their own panels open, but important limits remain. Reuters could not determine how much data was extracted. Deere said it found no indication that sensitive information was accessed; SharkNinja said a standalone support site was affected and the threat contained; Cummins was investigating a third-party vendor site. NorForge estimates roughly a 10% success rate and about $5 of model use per project, yet says it has no actual token records and that the estimate is highly uncertain.
For defenders, the practical lesson is not simply to buy another AI tool. Search for clusters of low-and-slow probing across web applications, watch for new files and outbound connections that follow apparently minor vulnerabilities, and include supplier-hosted sites in incident response. Teams deploying their own agents should also lock down control panels, rotate exposed credentials and preserve human-readable logs. The assessment would strengthen with victim forensics, confirmed exfiltration evidence, reproducible cost data and independent analysis of how often agents—not human operators—completed the decisive intrusion steps.[1][2]
The distinction that matters
How the observed campaign moved from target to access
The exposed panels revealed an iterative process rather than a single automated exploit.
Select
Automated lists ranked reachable commerce sites
Many targets entered the queue
Probe
Agents shared findings and tried attack paths
Projects could run for hours or days
Persist
Successful tasks installed shells or gained accounts
Later access became possible
Evidence check
The campaign totals originate with NorForge, which sells AI-agent security products; Reuters independently reviewed activity and identified victims but did not reproduce every count.
A claimed compromise does not establish data theft. Reuters could not determine exfiltration across the affected sites, and named companies reported differing levels of impact.
Token cost and success-rate figures are estimates from exposed projects, not audited billing records or a controlled benchmark.
Reporting basis: Multi-source analysis. Original source date: 19 October 2026.
Continue the story
Read next
Continue exploring ai agents: compare the finding and its evidence limits.
Who holds AI agents accountable when they reach government systems?
The UK privacy regulator has opened enquiries into recent AI-agent testing and launched a six-week evidence call, while Australia, Canada and California are pursuing different accountability routes. None has yet produced a final finding on the reported agent incidents.
Read the next reportExplore the full source and evidence record
What this means for people
- Security teams at retailers and suppliers may face many simultaneous, persistent probes from one operator, making cross-site detection and rapid credential rotation more important.
- Customers could be exposed if payment or account systems are compromised, but the sources do not establish customer-data loss across the reported campaign.
Global context
The investigation follows other reports of criminal groups using coding agents for intrusion work. What changes here is the observed scale and duration: inexpensive agents could keep testing sites while one operator supplied goals. That lowers the labour cost of broad campaigns even when most individual projects fail.
What the evidence does not yet show
- The campaign totals originate with NorForge, which sells AI-agent security products; Reuters independently reviewed activity and identified victims but did not reproduce every count.
- A claimed compromise does not establish data theft. Reuters could not determine exfiltration across the affected sites, and named companies reported differing levels of impact.
- Token cost and success-rate figures are estimates from exposed projects, not audited billing records or a controlled benchmark.
What to watch next
- Forensic reports from affected organisations that distinguish access, persistence and confirmed data exfiltration
- Whether hosting providers remove the exposed panels and whether related infrastructure reappears elsewhere
- Independent measurements of agent contribution, attack success and cost under controlled conditions
Living evidence record
Impact record IAI-0S3DH34
Evidence stage
Observed
Confidence
Supported
Reporting basis
Multi-source analysis
Independent or research support
Present
Record status
Monitoring
Last checked
20 October 2026
Source trail
2 direct sources across 2 source types.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Evidence trail
Sources used for this report
Links checked 20 October 2026
Research question, topics and regions
Topics: Cybersecurity · AI agents · Incident response · E-commerce · Autonomous systems
Regions: United States · Canada · Japan · Australia · Global
This report is labelled multi-source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.