Attack with IA agents orchestrated by Chinese attacker exposes Cairn panels and credentials

A set of self-contained artificial intelligence agents was led by a Chinese-speaking attacker against corporate shops and websites, and a security investigator was able to observe the intrusions in real time because the control panels that coordinated those agents were exposed on the Internet. This campaign, discovered and analyzed by the Norwegian firm NorForge and later informed by Reuters, scanned more than 1,200 domains and reached sites belonging to more than 100 companies; among the names cited by Reuters are Deere, SharkNinja and Cummins.

As confirmed: The researcher Snorre Fagerland (NorForge) located exposed instances of Cairn, an open source tool to orchestrate AI agents, and observed active projects from October 2. NorForge grouped these panels into at least three clusters and qualified more than 20 instances as probably malicious; the most active cluster, identified as AIA0001, is in Chinese and linked 14 panels to more than 1,100 attack projects. Reuters reviewed the activity that the panels themselves showed and named several victims; in at least some cases NorForge verified the presence of web shells and a vulnerable configuration that allowed to choose an unsafe backend server. The companies reported that the impact was limited and that they took action.

What did the attacker do technically: Cairn allows agents to be given a starting point and a target, and then let them work step by step, publishing findings on a shared board where the operator can add tracks. In this campaign the tasks were short: instructions in Chinese of less than 100 characters indicated preferred tactics. The agents looked for file uploading forms in hidden directories, exploited different failures (NorForge documented a chain that included writing access to a memcached session store, unsafe handling of serialized PHP objects and a vulnerability in an old version of Zend Framework) and sometimes planted a web shell uploader - a form of shell that saves uploaded files and can be replaced by a more dangerous back door at any time.

NorForge noted that the projects under AIA0001 used a worker called a claudecode _ depseek-v4.1-flash, which suggests (but does not confirm) the use of a DeepSeek V4.1 Flash model and the Claude Code. Reuters and NorForge did not definitively confirm the supplier or version of the model; that point remains a technical estimate based on names present on the panels.

Estimated scope and cost: NorForge calculated a success rate of about 10% on the tools seen and a mean time of successful intrusion of just under 23 hours. The cost figures are approximate: NorForge estimated an average cost of about $5 per task (including failed attempts), and Fagerland told Reuters that the total spent on tokens was about $5,000 - which would amount to about $50 per successful intrusion, according to his accounts. These figures are estimates provided by the researcher and NorForge, not measurements audited by third parties.

What information could be exposed by open panels: leaving a Cairn panel without protection is a double failure: not only does it make it easier for malicious agents to test and attack targets, but open panels show clear objectives, findings, credentials and keys that operators have collected. NorForge performed a secret scan with Trufflehog on the panel information and found hundreds of secrets; 11% of those secrets were verified as still valid. In addition, some panels exposed complete controls (start / stop projects, add data, redirect agents) and one of the English clusters even showed SSH session starts to staging servers. NorForge avoided authentication in those systems.

Practical implications and real risks: the presence of valid web shells and credentials allows attackers to persist in e-commerce systems, insert card skimmers, alter payment processes or extract customer data and operations. The campaign focused on shops and product support systems, and NorForge believes that the strategic objective was to maintain durable access to payment systems and stores for later exploitation. It is also relevant that some legitimate penetration test firms had left public panels with real customer data and evidence, which increases the risk of the leakage of sensitive third party information.

Which is still uncertain: There is no public and verified account of all exfiltered information; Reuters and NorForge were unable to confirm how much and what type of data were stolen in each case. Nor is the exact model that pushed the agents independently confirmed (DeepSeek / Claude Code is inferred by names on the panels but was not verified with the model provider).

What should be done now by site managers and technical readers: the campaign identifies concrete vectors and bad practices; there are priority actions and practices that any e-commerce operator, supplier or system manager should run immediately. In order of urgency:

1) Find exposed panels. many agent control interfaces respond in predictable ports and routes (e.g. web services in port 8000). If you manage infrastructure, scan your public address to detect unexpected services and close access or protect with strong authentication and WAF.

2) Revocate and rotate secrets shown on panels. treat as compromised any secret that has appeared in a public service: API keys, tokens, SSH credentials and session cookies. NorForge found that a percentage of secrets remained valid; leave nothing to chance.

3) Search and remove web shells; review logs. scan store servers by web shells patterns and unauthorised upload forms in hidden directories. Check access and error log, especially at times consistent with the dates NorForge detected (early October) to identify possible file changes or charges.

4) Plot and update components. update Magento / Adobe Commerce and any e-commerce platform affected by published vulnerabilities; NorForge found a PoC associated with StyleSmuggler (CVE-2026-75650) in a test repository - if your installation enters the affected ranges, apply the supplier's hotfixes. See official updates to the supplier's security resources before applying changes: https: / / www.reuters.com / technology / and the very page of the Cairn project in GitHub ( https: / / github.com / le1xia0 / cairn) are starting points for more context.

(5) Close unnecessary services and harden memcached / PHP. block memcached and other session stores on public interfaces; disable the handling of unsafe PHP objects (unserialize) or use strict validation and update obsolete frameworks such as Zend Framework if they are still in use.

6) Implement detection and response. display rules in IDS / WAF for the detection of operating patterns and web shells, monitor unusual activity in payments and backend, and have a response plan that includes notification to customers and authorities if there is personal or financial data exposure. Tools like Trufflehog help find secrets in repositories and public data: https: / / github.com / trufflesecurity / trufflehog.

This operation illustrates two clear lessons: self-employed agents can automate the recognition and operation phase with low costs and speed, and the exposure of control panels or test data is equivalent to leaving the keys to the house at the door. Organizations that manage safety tests and experimental deployments should apply access controls, regular withdrawals of temporary resources and strict policies on where results and secrets are stored.