AIA0001: 1,200+ Websites Targeted by Autonomous AI Agents Run Through Exposed Cairn Panels

A Chinese-speaking criminal operator used autonomous AI agents to attack more than 1,200 company websites and reach sites belonging to more than 100 companies, including Deere, SharkNinja and Cummins, in a campaign that ran largely without human intervention and was observed in real time because the operators left their AI control panels open on the public internet, according to reporting published October 19 and 20, 2026 by The Hacker News and security firm NorForge, with victim identification by Reuters.

What was the specific vulnerability?

The vulnerability was twofold: the attackers abused Cairn, an open-source AI tool built for authorized penetration testing, to run autonomous intrusion campaigns, and they simultaneously exposed the Cairn control panels themselves to the open internet, leaking their own operational data.

Cairn gives AI agents a starting point and a goal, then lets them work toward it step by step. Agents post findings to a shared blackboard, and the human operator can add hints along the way. According to NorForge, researcher Snorre Fagerland found about two dozen Cairn instances being used maliciously after beginning an internet-wide scan around October 2, 2026. NorForge grouped the exposed panels into three clusters and judged more than 20 likely malicious.

The busiest cluster, designated AIA0001, is Chinese-language, links 14 panels to more than 1,100 attack projects, targets organizations mostly in the United States, Japan and Australia, and aims at persistent access to e-commerce and payment infrastructure for later monetization. NorForge assesses the cluster as malicious with high confidence and notes it hosts its panels via AS56594, registered to Cgi Global Limited.

A typical task instructed agents to find a way to run code on a shop and plant a web shell uploader. One documented intrusion chain used unauthorized write access to a memcached session store, unsafe PHP object handling, and a weakness in old Zend Framework code. NorForge verified one claimed break-in at a large hardware-parts vendor with a live web shell, and independently confirmed the compromise of one very large US retailer, where the agents found the single cookie setting that selected a vulnerable backend server.

The exposure side cut both ways. The open panels leak victims' secrets: who is attacked, which weaknesses were found, and which credentials and keys were taken. NorForge ran the secrets scanner Trufflehog over panel data and found hundreds of secrets, 11 percent of which were verified as still valid. A second, English-language cluster exposed the operators' own SSH logins to their staging servers, though NorForge did not log in. Legitimate penetration-testing firms also left real client tests on unsecured panels.

Cairn's author, posting as "le1xia0," told Reuters the tool was not designed for hacking attacks and that harmful use was not their intention.

How was the incident detected?

The campaign was detected by Snorre Fagerland of NorForge through internet-wide scanning for exposed Cairn panels, beginning around October 2, 2026, with findings published Monday, October 19, 2026.

Fagerland scanned services such as Shodan and Censys for exposed copies of the tool, then correlated panel contents to reconstruct the attack projects. Reuters reviewed the attacker's own records to identify victims before publication, naming Deere, SharkNinja and Cummins among the more than 100 companies reached. The real-time visibility was a direct consequence of the operators' own misconfiguration: because the panels were public, researchers could watch tasks, hints and results as they accumulated.

What is the current impact?

The current impact is confirmed compromise at multiple named companies, an unknown volume of potentially stolen data, and continued exposure of hundreds of credentials and keys on the open panels.

According to The Hacker News, how much data, if any, was taken is not known. Deere said it took steps to fix the problem and had no sign sensitive information was accessed. SharkNinja said the attack hit a standalone product-support site and that it had contained the threat. Cummins said it was investigating a possible attack on a website run by one of its vendors. Two smaller businesses also told Reuters they were compromised. NorForge is withholding the panel addresses until they can be taken down, which means the exposed secrets remain a live risk until remediation.

What are the next steps?

The next steps are takedown of the exposed panels, rotation of the leaked credentials, and victim notification, with NorForge coordinating disclosure.

NorForge is withholding panel addresses until takedown. Organizations named or potentially affected should assume credentials found on panel data require rotation; the 11 percent of secrets verified still valid makes that urgent for the affected set. Companies reached by the campaign, including Cummins, are continuing investigations. The findings also follow a September 2026 report by Gambit Security on a criminal intrusion campaign against online marketplaces that recovered an attacker's staging server and found use of AI harnesses including Hermes, Strix and Cairn, indicating the tooling is in wider criminal circulation.

By the numbers

Source snapshot