Criminals use Cairn AI agents to breach over 100 companies

Cairn, a platform that coordinates artificial intelligence agents for automated penetration testing, has been used by at least three groups to attack e-commerce sites and payment infrastructure. The discovery was made by AI security company NorForge (researcher Snorre Fagerland), which found dozens of Cairn panels open on the internet, without authentication, exposing targets, vulnerabilities and stolen credentials. According to SecurityWeek and Insicurezza Digitale, which also draw on a Reuters investigation, the attackers breached more than 100 companies; The Hacker News and Insicurezza Digitale report over 1,200 sites targeted.

Unlike the OpenAI agents that escaped their test environments, covered by ARX News in early October, here AI agents are the tool chosen by criminals.

What happened

• The victims. NorForge has not named anyone. Reuters, cited by SecurityWeek, Dark Reading and Insicurezza Digitale, names John Deere (agricultural machinery) and SharkNinja (home appliances); Dark Reading and Insicurezza Digitale add Cummins (engines). According to Insicurezza Digitale, Deere found no access to confidential information, SharkNinja confirms the breach of a single site holding product information, and Cummins is looking into a possible attack that started at a supplier. How much data was stolen is unknown.
• Three clusters. NorForge grouped the malicious panels into three sets:
  • Chinese-speaking, 14 panels and over 1,100 projects: persistent access through web shells to e-commerce and payment platforms in the United States, Japan and Australia, probably to be monetised later;
  • English-speaking, 10 panels: theft of credit cards and cryptocurrency from merchant payment services, gray-market sites and pharmaceutical platforms, including African ones;
  • a single panel with 59 projects: e-commerce sites of every size, including large US platforms, seeking shells, admin panels and databases.
• The context. The discovery follows a Gambit Security report on similar campaigns against online stores; according to Insicurezza Digitale it documented 27 companies compromised in six days with Hermes, Strix and Cairn itself, and more than 600,000 stolen cards. The sources differ on how NorForge reached the panels: SecurityWeek says it looked for them after that report, Insicurezza Digitale says it found them by chance.

How Cairn works

Cairn presents itself as a general-purpose problem-solving engine; SecurityWeek calls it open source and, according to Insicurezza Digitale, the developer (pseudonym le1xia0) describes it as a penetration testing tool. Every task is a project with a target and a final goal: agents propose actions, execute them, check the result and post intents and findings to a shared blackboard that the operator can read and add to. Once a project starts, nobody steers the attack: the agents work on their own for hours or days. From the worker names NorForge infers the use of a Claude Code-compatible harness and DeepSeek models, also through OpenRouter, but stresses that these are clues, not proof.

The attack chain

According to SecurityWeek, the Chinese-speaking cluster ranked targets by traffic and checked them with Playwright, the browser automation framework, before feeding them to Cairn. The other details are reported only by Insicurezza Digitale, based on the NorForge report:

• tools on an exposed worker: headless Chromium, PHPGGC for PHP gadget chains, reconnaissance with Amass, dnsrecon, ffuf and Nmap;
• a proof of concept for CVE-2026-75650, a chain from report poisoning to code execution on Magento, with a Magento 2.4.9 lab to test it before use;
• techniques: SQL injection escalated to remote code execution, web shells uploaded through poorly protected upload forms, authentication bypass and account takeover;
• against a US hardware distributor, an unauthorised write to the Memcached session store combined with insecure PHP deserialisation in legacy Zend Framework components to execute commands.

Indicative MITRE ATT&CK mapping, derived from the reported facts: T1595 (Active Scanning), T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1059 (Command and Scripting Interpreter).

Campaign figures

According to NorForge, attacks succeeded in about 10% of attempts; the panel data contained hundreds of secrets (passwords, API keys, tokens), about 11% of them still valid. Only Insicurezza Digitale reports time and cost figures: about 23 hours per successful intrusion, about 5 dollars per project and about 5,000 dollars for the whole campaign, active since 25 September 2026. The researcher points to a wide margin of error.

Impact for European and Italian companies

The sources mention no European victims, but the model has no borders: low cost, no skills needed during the attack, targets picked automatically among the busiest sites. Magento, PHP and legacy Zend components are also widespread in Italian and European e-commerce.

• GDPR: theft of customer or payment data must be notified to the supervisory authority within 72 hours.
• NIS2: for online marketplaces, machinery manufacturers and other entities in scope, a web shell on a corporate site may be a significant incident, with an early warning to the national CSIRT (CSIRT Italia in Italy) within 24 hours.
• Healthcare: the second cluster hit pharmaceutical platforms, which also process health data.
• Suppliers: the Cummins case is a reminder that an attack can come through whoever runs the site on the company’s behalf.

What to do now

1. Update Magento or Adobe Commerce, PHP, extensions and libraries; list the legacy components still in production, such as Zend Framework, and plan to replace or isolate them.
2. Hunt for web shells: new or modified PHP files in upload, media and cache folders. Block script execution in upload folders and monitor file integrity.
3. Protect session stores and caches: Memcached and similar services never reachable from the internet; review deserialisation of untrusted data.
4. Search the logs for headless browsers, bursts of requests with payload variants against forms and APIs, admin panel logins from unusual addresses, and activity lasting hours from the same address. Apply rate limits.
5. Rotate secrets if the site was exposed (API keys, payment tokens, admin and database passwords) and make MFA mandatory on admin panels.
6. If you use AI pentest tools, never expose their panels.

How ARXDOME helps

ARX Expose shows the attack surface as seen from outside: names, open ports, recognised products and known vulnerabilities on public services. ARX Sentry, with the agent on servers, checks file integrity in the chosen folders, useful for spotting a freshly written web shell. ARX Shield lists open vulnerabilities by machine and by package, highlighting those already exploited.

Last updated: 20 October 2026