A task of fewer than 100 Chinese characters, and AI agents set off hunting online shops. According to Reuters (Raphael Satter, October 19, 2026), these AI hacking agents tried to break into more than 1,200 sites and got into more than 100, for a bill that researcher Snorre Fagerland puts at about $5,000 in tokens (the units of text that model providers charge for). He works at the security firm NorForge, and found the case in control panels (the tool’s admin pages) left open on the web.
Control panels left open on the web
The tool is called Cairn. It is an open-source platform (its code is public and anyone can download it) that takes a starting point and a goal, then moves AI agents forward step by step. Its author, who posts as le1xia0, wrote on X that it was not designed for hacking, Reuters reports. In its October 19 report, NorForge says it found the panels with Shodan and Censys, two search engines that index machines connected to the Internet. Many asked for a password. A notable number did not.
NorForge judges more than 20 of these panels likely malicious and sorts them into three groups. The most active writes in Chinese: 14 panels, more than 1,100 attack projects. It targets online shops in the United States, Canada, Japan and Australia, with traffic of 200,000 to 1.5 million. An automated pipeline sorts them before the attack, and the browser-automation tool Playwright checks that orders can be placed. The second group writes in English and tells its agents to steal credit cards and cryptocurrency.
How AI hacking agents find the way in
In Cairn, each attack is a project: a starting point, a goal. The agents post every discovery on a shared board that all of them can read, and the human operator can add hints. The typical task of the Chinese group, translated by NorForge, asks the agents to find unauthenticated remote code execution (running your own commands on the server without an account), then to drop an « uploader shell », a form that saves uploaded files, not a tool that runs commands. The listed flaws are the classics: SQL injection (a command slipped into a form to query the database), file upload, deserialization (rebuilding an object from data supplied by the attacker), authentication bypass.
NorForge checked one claimed intrusion at a large hardware parts vendor: the address of the dropped form did answer. By the agent’s own explanation, it had combined write access to the session store (memcached), PHP deserialization and a gadget chain from an old Zend component. Reuters describes another case: with no flaw in a large company’s public application, the agents hunted for a linked panel, then made its server run commands. « It’s not script kiddie stuff, » Fagerland told Reuters, according to Tom’s Hardware (Oliver Haslam, October 19).
About $5,000, and victims who push back
The cost of the AI hacking agents remains an estimate. Fagerland gave Reuters about $5,000 in tokens for the campaign, close to $50 per successful intrusion, notes The Next Web (Ana Maria Constantin, October 19). NorForge’s report counts about $5 per task on average, failures included, and speaks of « considerable » uncertainty. Some projects pass 1,000 steps and could cost more than $100. The average success rate is around 10%, with, in the Chinese group, a successful intrusion in a little under 23 hours, but the groups have different goals and cannot be compared directly.
Reuters names three victims: Deere, SharkNinja and Cummins. Deere says it took remediation steps and has no sign that sensitive information was accessed. SharkNinja says only a standalone product support site was hit, and that it contained the threat. Cummins is looking into a possible incident on a site run by one of its vendors. Reuters could not establish how much data, if any, was taken. TNW states it has not verified these intrusions itself.
A harness called Claude Code, a model probably DeepSeek
All the Chinese group’s tasks run on a worker (an executing agent) named « claudecode_deepseek-v4.1-flash ». NorForge assumes a Claude Code harness (the software that drives a model and gives it access to tools), paired with the Chinese model DeepSeek V4.1 Flash, released in September. That is a guess drawn from a name, not proof, and nothing in the report shows that an Anthropic model worked on these attacks. The projects of the second, English-speaking group cite a worker « pi_openrouter_deepseek », which suggests the Pi coding agent powered by DeepSeek models through the OpenRouter gateway.
The attackers protect their own equipment poorly. An analysis of the panel data found hundreds of secrets (access keys, passwords), 11% of them verified valid by the Trufflehog tool.
What Cairn changes since PaperCut
In September, we told the story of how AI agents hacked 395 organizations through PaperCut. The attacker had then built a lab around two specific flaws in a single piece of software, with a Codex harness and a DeepSeek model. With Cairn, there is no known flaw in advance: the goal is « get in somewhere » and the AI hacking agents search on their own, site by site. The tool is open source, the instruction fits on one line, and the cost, by Fagerland’s estimate, is around $50 per successful intrusion.
If you run a shop or an online account
The flaws described belong to well-documented families, and NorForge found in a Chinese-group agent’s working folder tools for a Magento chain (CVE-2026-75650), without proving it was used. Against these AI hacking agents, if you run a merchant site, our advice comes down to three steps: apply updates to the shop system and its modules quickly, limit what a file-upload form accepts, and look for recent PHP files in upload folders. One instruction seen in one of the groups asks to name the dropped file « confirm.php » so it goes unnoticed. If you shop online, Reuters did not establish which data was taken, but one of the hackers Fagerland tracked stole credit card data, and checking your statement from time to time costs little.
NorForge says it warned victims with Reuters and asked hosting providers to shut the panels down, which depends on their responsiveness: many were still online when the report was published.
0 Commentaires
Aucun commentaire pour le moment. Soyez le premier à commenter !