Exposed control panels show AI agents running 1,100+ break-in attempts on online shops

On October 19, 2026, the security firm NorForge published what it found on more than 20 internet-facing, unprotected control panels where criminals direct AI agents to break into websites. One cluster alone ran over 1,100 attack projects, mainly against online shops and payment systems in the US, Japan, Australia and Canada. If you run or host an e-commerce site, especially on Magento, check that it is patched and that your checkout pages load only the scripts you expect.

This is a follow-up to our September coverage of the Gambit Security campaign, where the same AI tool, Cairn, was found on an attacker's server. NorForge cites Gambit's report as its starting point but does not say the operators are the same.

What happened, in plain English

Cairn is a free, open-source program that coordinates several AI "agents". An agent is an AI model allowed to act, not just chat: it runs a tool, reads the result and decides what to do next. With Cairn, an operator types a target and a goal. The agents then explore the target, note what they learn on a shared "blackboard" and keep trying routes until they reach the goal or give up.

Its author has said, in a post on X cited by Reuters, that the platform "was not designed for hacking attacks". Criminals are using it that way anyway.

Cairn has a web dashboard. Many operators left theirs open on the internet without a password. NorForge found them with ordinary internet scanners such as Shodan and Censys and could read the projects inside: the targets, the instructions, the agents' notes and even some stolen secrets. It is like finding a burglary gang's planning board pinned to a shop window.

NorForge grouped the panels into three clusters. The largest, which it calls AIA0001, had Chinese-language panels and ran more than 1,100 projects. NorForge estimates about 10% fully succeeded, with an average of under 23 hours per successful project and about $5 in AI costs per attempt. It stresses these cost figures are rough estimates, not measured spending.

Reuters, which worked with NorForge on notifying victims, reported that the agents tried more than 1,200 websites and reached sites belonging to over 100 companies, naming Deere, SharkNinja and Cummins.

Are you affected? What to do now

You should care if your organisation runs its own online shop or checkout, a point-of-sale (POS) system with an internet-facing part, or any website that stores payment or customer data. If your payments are fully handled on a hosted page from your payment provider, your direct exposure is lower — but the website hygiene points still apply.

• Patch Adobe Commerce / Magento now. The agents' toolkit included a test lab for CVE-2026-75650 ("StyleSmuggler"), a flaw rated CVSS 10.0 (the maximum) that lets an attacker run code without logging in. Adobe's bulletin APSB26-146 (September 7, 2026) says it is exploited in the wild and covers Adobe Commerce 2.4.4–2.4.9 and Magento Open Source 2.4.6–2.4.9 ("2026-aug and earlier"). Install the hotfix.
• Look for web shells. In one case NorForge checked, the agent had left an "uploader" web shell — a small file that lets the attacker upload more files through the browser. Review recently added or changed files in upload, media and cache folders.
• Review file uploads. The operators' instructions preferred shells planted through upload forms. Make sure upload features accept only expected file types and that upload folders cannot execute code.
• Lock down session and cache stores. One intrusion started with write access to a memcached session store (a fast in-memory database) combined with unsafe handling of stored data in old Zend Framework code. Internal services like memcached should never be reachable from the internet.
• Watch your checkout pages. Compare the scripts loading on payment pages with what you expect.
• Expect speed. A successful project took under a day on average. Alerts that wait until the next morning are too slow.
• If you find a compromise, treat it as a payment incident: preserve logs, contact your payment provider and follow your PCI DSS (the card industry's security standard) obligations.

NorForge published a table of 27 panel and staging IP addresses, but most are partially redacted until takedown; verified researchers can request the full list. There are no ready-to-block indicators for most readers.

The expert view

The attack techniques here are not new. The task lists NorForge recovered name familiar web bug classes: SQL injection, insecure deserialization (rebuilding attacker-controlled data into live program objects), authentication bypass and server-side request forgery (SSRF, tricking a server into fetching internal resources). The agent's working directory held standard tools — Nmap, ffuf, Amass, dnsrecon, PHPGGC and Playwright. Any penetration tester would recognise the kit.

What is new is visibility into the workflow. Threat reports usually reconstruct AI-assisted attacks from a victim's logs or one seized server. Here researchers could read live project state across several unrelated groups: how targets were chosen, how agents recorded "facts" and planned "intents", and where humans stepped in with hints. AIA0001 used an automated pipeline that ranked shops by traffic and checked that orders could actually be placed before handing the site to an agent — a business process, not a hobby.

The models matter less than the harness. AIA0001's workers were labelled claudecode_deepseek-v4.1-flash, which NorForge reads as Anthropic's Claude Code agent software driving a DeepSeek model. A second cluster, AIA0002 (English-language panels, targeting payment services, pharmaceutical sites and a carding site), appeared to use the Pi coding-agent framework calling DeepSeek through OpenRouter. These are NorForge's interpretations of worker names. The point for defenders: the reasoning engine can be swapped for whichever model is cheapest and least restricted, so blocking one provider does not stop the workflow.

The economics continue the trend Gambit described in September. If NorForge's rough estimate holds — about $5 per attempt and about $50 per success — the cost of a breach attempt is now below the cost of the labour to triage one. Low-severity bugs that "nobody would bother to chain" are now chained by default, at scale.

There is an irony worth noting. These operators left their own dashboards open and their stolen secrets readable; NorForge says TruffleHog verified 11% of the "hundreds" of secrets found as valid. Their tools are capable, but they have not secured themselves.

What is still unknown:

• Attribution. NorForge assesses AIA0001 and AIA0002 as malicious with high confidence and AIA0003 with low confidence. It sees financial motivation and no obvious state sponsorship. It notes AIA0001's panels were Chinese-language and that some African commerce targets "hint" at an African base for AIA0002 — observations about language and targeting, not confirmed identity or nationality. Reuters describes a Chinese-speaking hacker.
• Damage. NorForge reports "indications" that some breaches succeeded but does not confirm specific thefts, and Reuters could not determine how much data was taken. Deere told Reuters it had no indication sensitive information was accessed; SharkNinja said a standalone support site was affected and contained; Cummins said it is investigating a third-party-run site.
• Provider response. No statement from Anthropic or DeepSeek appears in the reporting we read.
• Legitimate users exposed too. Some open panels belonged to apparently genuine red teams and held real client penetration-test data. If your organisation uses Cairn or a similar tool, put its dashboard behind authentication today.

Official sources

• NorForge — "Inside Cairn: Open Windows into massive AI-Driven Cyber Operations" (October 19, 2026)
• Adobe Security Bulletin APSB26-146 — CVE-2026-75650 (September 7, 2026)
• Gambit Security — "Autonomous AI Agents Hack Online Retailers for $25 a Company" (September 22, 2026)
• Akamai — CVE-2026-75650 "StyleSmuggler" analysis (September 14, 2026)
• Coverage: Reuters (October 19, 2026) · Gizmodo (October 19, 2026)
• Earlier on AI Cyber Brief: AI agents ran a card-skimming spree on online shops · The $25 intrusion: agentic attack economics