Chinese Hacker Leverages AI Agents to Breach Over 100 Websites for Thousands
A single threat actor, reportedly Chinese-speaking, utilized AI agents on the Cairn platform to compromise more than 100 company websites, including those of major brands like Deere, SharkNinja, and Cummins, at an estimated cost of $5,000.
A Chinese-speaking hacker has successfully breached over 100 company websites using AI agents, a sophisticated operation that reportedly cost the individual approximately $5,000 in AI tokens. The investigation, revealed in October, highlights the growing capability of a single actor to orchestrate complex cyberattacks with minimal human oversight. The targets included websites linked to well-known companies such as Deere, SharkNinja, and Cummins, though the extent of the impact varied across these organizations.
The campaign, which commenced on September 25, saw the AI agents attempt to compromise more than 1,200 websites, predominantly online stores located in the United States, Canada, Australia, and Japan. Snorre Fagerland, a principal threat researcher at NorForge, discovered this malicious activity while investigating exposed installations of Cairn, an open-source platform designed to coordinate AI agents. By October 2, Fagerland had identified approximately two dozen Cairn installations that appeared to be actively used for illicit purposes.
Cairn functions as a general-purpose problem-solving engine, rather than a tool exclusively built for hacking. In this instance, operators provided the AI with target information and a specific goal. The agents then autonomously searched for vulnerabilities and worked towards gaining unauthorized access. The platform's design allows agents to share findings on a project board, enabling subsequent agents to leverage earlier discoveries to inform their next actions. This adaptive approach allows the agents to explore multiple attack vectors if an initial method fails, moving beyond the limitations of a single, fixed scanning process.
NorForge tracked the largest cluster of this Chinese-language activity, designated AIA0001, which was associated with 14 dashboards containing over 1,100 attack projects. The target pipeline employed Microsoft's Playwright browser automation tool to verify that shopping sites could process orders before passing them to Cairn for exploitation. The task instructions were specifically focused on identifying methods to execute code without requiring user authentication, including common vulnerabilities such as SQL injection, unsafe file uploads, login bypasses, and insecure handling of stored objects. The ultimate objective appeared to be establishing persistent access to shopping and payment systems for potential future monetization.
NorForge confirmed at least one claimed breach by examining a reported address on a hardware vendor's website, where they discovered a live uploader webshell. This server-side script provided a foothold, allowing attackers to upload files to the compromised site. The AI agent's own logs indicated that this particular attack chain combined unauthorized write access to a memcached session store with unsafe PHP object deserialization and older Zend Framework components, demonstrating a sophisticated exploitation of multiple weaknesses to achieve server access.
In another observed incident, after failing to find a direct vulnerability within a company's primary application, the AI agents expanded their search to related infrastructure. They identified an exposed control panel and spent considerable time testing its data handling capabilities before successfully reporting the ability to execute commands on the server. Successful AIA0001 projects averaged just under 23 hours to complete, with one campaign running for over five days. NorForge estimated the overall success rate for these campaigns at approximately 10%, though the specific goals and targets varied among the operators.
The estimated $5,000 cost for the main campaign translates to roughly $50 per successful intrusion, a remarkably low figure for such a sophisticated operation. While these figures are estimates, NorForge also noted that the average task cost was closer to $5 when including failed and prematurely terminated attempts, underscoring the efficiency of AI-driven attacks. Although the instructions were in Chinese, researchers found no direct evidence of state-backed involvement in the exposed panels.
Companies like Deere reported taking corrective actions and found no indication of sensitive data exfiltration. SharkNinja stated the affected system was a separate product support site and the threat was contained. Cummins was investigating a potential attack on a third-party-managed website. Reuters was unable to confirm the extent of any data stolen. NorForge also identified hundreds of exposed secrets within the unsecured AI panels, and is collaborating with victims to address these exposures. The incident also highlighted risks for legitimate security testers using poorly protected AI tools, as unsecured dashboards revealed customer information.