Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites

A security researcher at NorForge, Snorre Fagerland, discovered that a Chinese-speaking attacker was using autonomous AI agents built on the open-source tool Cairn to automatically probe and compromise company websites, after the attacker left their management dashboards exposed online. Reuters reviewed the attacker's own logs and identified over 1,200 targeted sites and more than 100 breached companies, including Deere, SharkNinja and Cummins, with web shells and stolen session cookies used to gain lasting footholds in e-commerce and payment systems. The attacks reportedly took under 23 hours on average, cost roughly $50 per successful intrusion, and relied on workers apparently driven by models resembling DeepSeek and Claude Code, though this was not formally confirmed. NorForge also warns that the same exposed panels leaked hundreds of valid credentials and keys, and separately flagged a proof-of-concept for a critical Magento flaw tracked as CVE-2026-75650, urging shops on vulnerable Adobe Commerce or Magento Open Source builds to apply the vendor's hotfix.