A single operator appears to have used coordinated AI agents to compromise more than 100 company websites at an estimated token cost of about $5,000. The campaign, documented through exposed management dashboards and reported in a Reuters investigation, illustrates how agentic systems can turn one person’s objectives into long-running, multi-step intrusion attempts.

The activity began on September 25 and touched more than 1,200 websites, primarily online stores in the United States, Canada, Australia and Japan. Targets included sites associated with Deere, SharkNinja and Cummins, although the effects differed and the amount of stolen data, if any, could not be determined.

Cairn coordinated the attack workflow

NorForge researcher Snorre Fagerland discovered the operation while looking for exposed installations of Cairn, an open-source platform designed to coordinate AI agents. Around October 2, he found roughly two dozen installations apparently supporting malicious work. Cairn is a general problem-solving engine, not a purpose-built hacking utility, but its ability to share findings and manage tasks made it useful for offensive automation.

Operators supplied a target and a desired outcome. Agents then searched for weaknesses, recorded discoveries on a common project board and selected new approaches when initial attempts failed. A preparatory pipeline used Microsoft’s Playwright browser automation to confirm that shopping sites could accept orders before sending them into the agent workflow.

Instructions emphasized routes to code execution without authentication: SQL injection, unsafe file uploads, login bypasses and insecure handling of stored objects. The apparent objective was durable access to commerce and payment environments that could later be monetized.

Evidence of adaptive exploitation

NorForge labeled the largest Chinese-language cluster AIA0001 and linked it to 14 dashboards containing more than 1,100 attack projects. Chinese instructions do not prove the operator’s nationality, and researchers saw no clear evidence of state sponsorship.

One claimed compromise was independently checked by visiting an address recorded by the agent. The hardware vendor’s site hosted a live uploader webshell capable of placing additional files on the server. According to the agent’s notes, the intrusion chained unauthorized writes to a memcached session store, unsafe PHP object deserialization and legacy Zend Framework components.

In another project, the agents failed against the main application, searched related infrastructure, discovered an exposed control panel and spent hours probing its data handling. They eventually reported command execution. This ability to preserve context and pivot distinguishes the workflow from a fixed vulnerability scanner that simply runs a predetermined checklist.

Low marginal cost changes the economics

Successful AIA0001 tasks ran for just under 23 hours on average, and one continued for more than five days. NorForge estimated an overall success rate near 10 percent, although targets and goals varied. Fagerland put the main campaign’s token bill near $5,000—approximately $50 for each successful intrusion. A separate estimate placed the average task near $5 once failures and early terminations were counted. These are research estimates, not verified provider invoices.

Worker labels suggested a Claude Code arrangement paired with a DeepSeek model, but the complete configuration was not confirmed. The important defensive signal is not a particular model brand. It is the combination of persistent automation, shared memory, browser control and cheap parallel experimentation.

Reported impact and defensive priorities

Deere said it took corrective action and found no evidence that sensitive information was accessed. SharkNinja described the affected asset as a separate product-support site and said the threat was contained. Cummins was investigating a possible incident involving a third-party-operated website.

The exposed dashboards also revealed hundreds of secrets and information belonging to legitimate penetration-testing customers, showing that poorly secured agent infrastructure can endanger both attackers and authorized teams. Organizations deploying such tools should protect consoles with strong authentication, restrict network access and avoid storing reusable credentials in project data.

Defenders should patch public applications, remove exposed administration panels, monitor for unexpected files in web roots and investigate suspicious requests across related subdomains. When a webshell is found, isolating the host and removing the file is only the beginning: responders must determine what credentials, data and neighboring systems were reached. AI has not eliminated familiar web flaws, but it has made patient exploitation and repeated pivots dramatically cheaper.