Autonomous AI Agents Attack Over 100 Online Retailers
A Chinese-speaking threat actor recently directed autonomous AI agents to conduct large-scale cyberattacks against online storefronts. Beginning on September 25, these autonomous systems targeted more than 1,200 commercial websites across four nations. According to cybersecurity researchers, the automated campaign successfully compromised systems belonging to over 100 enterprises. Prominent victims included agricultural manufacturer Deere and consumer brand SharkNinja.
NorForge security researcher Snorre Fagerland discovered the operation while investigating exposed control panels. Specifically, the attacker orchestrated the intrusions through Cairn, an extensible multi-agent automation platform. The framework distributes complex tasks across multiple autonomous entities. Furthermore, these agents evaluate targets, execute offensive utilities, and verify their outcomes independently. Through an illuminating investigation into the Cairn multi-agent platform, Fagerland identified twenty exposed dashboards linked to malicious activity.
Autonomous Execution with Minimal Human Guidance
The most extensive intrusion wave stemmed from fourteen interconnected Cairn management dashboards. These automated tools primarily probed e-commerce servers across the United States, Canada, Australia, and Japan. Remarkably, the operator initiated these complex workflows using prompt instructions containing fewer than 100 Chinese characters.
Once launched, the software agents audited target infrastructure for hours without human supervision. They systematically evaluated potential penetration vectors and adjusted tactics following failed attempts. Consequently, the threat actor achieved sustained offensive momentum without manual intervention.
Tactics, Techniques, and Remote Code Execution
The primary operational goal centered on achieving unauthenticated remote code execution on victim servers. To bypass defenses, the autonomous agents actively scanned for SQL injection bugs, authorization bypasses, and file upload flaws.
In one notable intrusion, the agents encountered an impenetrable primary web application. Rather than abandoning the target, the models analyzed archived infrastructure records. Through this reconnaissance, they located a forgotten secondary administration portal. Within hours of autonomous probing, the tool gained unauthorized command execution on the host.
Establishing Persistent Backdoors
Furthermore, NorForge independently validated several intrusive footholds outside the agent system logs. On the server of a major hardware supplier, analysts found an active webshell. This malicious script permitted external parties to upload arbitrary files at will.
Security specialists noted that the operator prioritized establishing durable persistence across victim networks. Consequently, attackers can easily re-enter compromised networks long after concluding initial scans.
The Alarming Economics of Agentic Hacking
Successful compromise workflows averaged slightly under 23 hours, though certain operations persisted for five days. Nevertheless, operational expenditures remained extraordinarily modest. As highlighted in Reuters reporting on the autonomous agent campaign, Fagerland estimated total API model costs at approximately $5,000. Therefore, each successful corporate breach cost the attacker roughly $50.
Workflow telemetry indicated that the threat actor paired the DeepSeek V4.1 Flash model with Claude Code. However, precise computational expenditures cannot be verified without direct billing records.
Corporate Disclosures and Response
Following notification, Deere stated that it implemented defensive remediations and found no evidence of compromised proprietary data. Similarly, SharkNinja confirmed an intrusion on a product information site, noting that teams swiftly contained the threat. Meanwhile, engine manufacturer Cummins continues to investigate potential compromises across third-party suppliers.
Operational Insecurity Among Threat Actors
Ironically, the attackers exhibited glaring security oversights within their own command infrastructure. Several Cairn control panels remained completely open to the public internet without password protection.
Consequently, exposed portals broadcasted sensitive campaign data, discovered flaws, and harvested credentials. NorForge cataloged hundreds of exposed passwords and API tokens. Automated testing confirmed that 11% of the exposed credentials remained fully valid.
Furthermore, platform developer le1xia0 asserted that Cairn was created as a general multi-agent framework rather than an attack utility. Meanwhile, NorForge cooperated with security journalists to notify affected entities and shutter vulnerable dashboards.
The Rise of Autonomous AI Cyberattacks
Automated intrusions orchestrated with minimal human oversight have rapidly evolved from theoretical concepts into common threats. Earlier this autumn, researchers from Gambit Security analyzed autonomous retail breaches powered by tools like Hermes, Strix, and Cairn. In that campaign, autonomous systems breached 27 firms within six days, stealing over 600,000 credit card records.
For defensive engineering teams, this evolution shifts the economics and velocity of corporate cyber defense. Autonomous agents investigate targets relentlessly, adapt immediately to errors, and escalate minor bugs into full intrusions. Ultimately, security teams must deploy automated defenses to counter attacks that operate at machine speed.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
