This is the story security folks have been warning about. Reuters reported today that a Chinese-speaking attacker pointed autonomous AI agents at more than 1,200 websites and got into sites belonging to more than 100 companies, including Deere, SharkNinja and Cummins.
How it worked
- Researcher Snorre Fagerland of NorForge found about two dozen exposed panels of Cairn, an open-source agent tool built for authorized pen testing, being used maliciously. Because the panels were open, he could watch the attacks live.
- The operator wrote fewer than 100 Chinese characters of instructions. The agents did the rest, aiming to plant a web shell uploader on shops and payment systems.
- Successful break-ins took a little under 23 hours on average, with about a 10% success rate. The whole campaign burned roughly $5,000 in tokens, about $50 per successful hack.
- The worker name pointed at DeepSeek V4.1 Flash driven by Claude Code, but neither the researcher nor Reuters confirmed the models.
- Deere and SharkNinja said the impact was limited. Cummins is investigating a vendor-run site.
The open panels were a second disaster: NorForge found hundreds of stolen secrets in them, 11% still valid. Some legit pen-test firms had left client work exposed the same way.
The other side of the coin
Same day, Microsoft said companies should treat AI agents as insiders. New controls give agents little or no access by default, grant permissions per task, keep a running risk score, and can cut an agent to read-only, require human approval, or halt it. Discovery now covers 60 agent types, including Claude Code, Codex and GitHub Copilot.
What to do
- Hunt for unexpected file-upload forms in odd directories on your web servers.
- Patch your web stacks. A Magento proof of concept (CVE-2026-75650) was sitting in one worker directory.
- If you run agent tools yourself, never leave their web panels open to the internet. I’ve got a how-to coming on checking that.
My take
Fifty bucks a break-in. Attackers just got a team of tireless junior pen testers for the price of lunch. Defenders need the same speed, and least privilege for our own agents isn’t optional anymore.
Have a blessed day! And Happy Hacking!
References & Further Reading
- Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites (The Hacker News)
- A hacker broke into John Deere and SharkNinja with an army of AI agents (The Verge)
- Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring (SecurityWeek)
- Agents are your newest insiders. Security must move at their speed. (Microsoft Security Blog)
