Fewer than 100 Chinese characters aimed AI at 1,200 shops

A Chinese-speaking operator wrote fewer than 100 Chinese characters of instructions, pointed a cluster of autonomous AI agents at online shops, and let them run. The agents tried more than 1,200 sites and reached websites belonging to over 100 companies, including farm-equipment maker Deere, appliance company SharkNinja and engine maker Cummins. Reuters named the victims from the attacker’s own records. How much data was taken, if any, is not known.

The campaign is visible at all because the operators left their control panels open on the internet. Snorre Fagerland of the security firm NorForge found the operations by scanning for exposed copies of Cairn, an open-source agent tool popular with hackers. Beginning around October 2 he found about two dozen Cairn instances being used maliciously, with their panels answering to anyone who found them, which let him read the attackers’ work in real time.

Cairn gives an AI agent a starting point and a goal, then lets it work toward that goal step by step. Agents post what they find to a shared board, and a human operator can drop in hints along the way. It was built for authorized penetration testing. Its author, who posts as “le1xia0,” told Reuters the tool was not designed for hacking and that harmful use was not their intention.

NorForge grouped the exposed panels into three clusters and judged more than 20 of them likely malicious. The busiest, which it calls AIA0001, is Chinese-language and links 14 panels to more than 1,100 attack projects. Its apparent aim is lasting access to shop and payment systems for later use, with targets in the United States, Japan and Australia.

What the agents actually did

A typical task told the agents to find a way to run code on a shop and then plant a web shell uploader. That is a form that saves uploaded files rather than one that runs commands, which makes it a placeholder: the operator can swap it for something that runs commands whenever they choose. NorForge checked one claimed break-in at a large hardware-parts vendor and found the web shell live. It independently confirmed the compromise of one very large US retailer, where the agents found the single cookie setting that selected a vulnerable backend server.

The chains differ from victim to victim. One documented intrusion, by the agent’s own account, worked through unauthorized write access to a memcached session store, unsafe handling of saved PHP objects, and a weakness in old Zend Framework code. That is one path, not a method you can fingerprint across the campaign.

The economics explain the breadth. Successful break-ins took a little under 23 hours on average, and NorForge put the success rate across the tools it saw at around 10%, while noting the clusters chase different goals and are not directly comparable. Cost ran to about $5 a task counting attempts that failed or stopped early, with considerable uncertainty in the figure. Fagerland told Reuters the whole campaign had burned about $5,000 worth of tokens, or roughly $50 per successful hack. At that price, pointing a process at 1,200 sites and keeping the 10% that give way is a reasonable trade.

The worker behind every AIA0001 task was named claudecode_deepseek-v4.1-flash, which could point to a DeepSeek V4.1 Flash model driven by Anthropic’s Claude Code. Neither NorForge nor Reuters confirmed the models; Reuters said only that the campaign appeared to use DeepSeek and Claude Code.

The open panels leak the victims too

An exposed panel is its own breach, separate from the ones the agents perform. The panels show who is being attacked, what weaknesses were found, and which credentials and keys were taken, so having your site tested on an open instance can expose your secrets whatever the test’s outcome. NorForge ran the secrets scanner Trufflehog over the panel data and found hundreds of secrets, 11% of which it verified as still valid. The panels also appear to expose the tool’s full controls, including the ability to start and stop projects, feed in new data, and point agents at different targets, though NorForge said it did not test whether those controls work without a login. A second, English-language cluster went further and exposed the operators’ own SSH logins to their staging servers.

The exposure is not only a criminal problem. NorForge also found apparently legitimate penetration-testing firms that had left real client tests on unsecured panels, putting their customers’ data at the same risk.

What to hunt for

Three things follow directly from the findings:

• Agent control panels of this kind often answer on port 8000. An instance reachable without a login is worth hunting for, whether it is an attacker’s or one of your own vendors’.
• The foothold these agents aimed for is a stray file-upload form sitting in a directory you did not create. An unexpected uploader is the shape of this compromise.
• A worker directory NorForge browsed held a proof-of-concept and test lab for StyleSmuggler, a critical Magento flaw (CVE-2026-75650). There is no evidence it was used in these break-ins, but any shop still on an affected build should apply Adobe’s hotfix: Adobe Commerce 2.4.4 through 2.4.9, or Magento Open Source 2.4.6 through 2.4.9.

NorForge’s work followed a September report from Gambit Security on a separate campaign that used Cairn alongside two other AI tools to steal credit cards; no source links the two operations. NorForge said it is working with Reuters to warn victims and asking hosting firms to take the panels down, an effort it said depends on how the hosts respond.

---

Contains a referral link.