What a researcher watched happen in real time
Starting around October 2, Snorre Fagerland of the security firm NorForge began scanning the internet for exposed instances of Cairn, an open-source agentic framework built for authorized penetration testing. He found about two dozen instances being actively misused, and because the operators had left their control panels unprotected and unauthenticated, he could watch the attacks unfold as they happened rather than reconstruct them after the fact. Reuters reviewed Fagerland's findings before publication and independently traced victims from the exposed attack logs. The main cluster, which NorForge labeled AIA0001, used Chinese-language instructions, linked 14 control panels to more than 1,100 recorded attack projects, and targeted companies in the United States, Japan, and Australia.
The scale came from automation doing work that previously required a skilled human operator per target. Cairn gives an AI agent a goal and a starting point, then lets multiple agent instances share findings on a common board while a human operator occasionally adds hints. According to Reuters, the operator directing the main cluster used fewer than 100 Chinese characters of instruction to launch attacks against over 1,200 sites, reaching the websites of more than 100 companies. The agents succeeded roughly 10 percent of the time, took a little under 23 hours on average to get there, and NorForge estimates the operator spent roughly five dollars per attempted task and about fifty dollars for each successful one, a cost structure that makes mass, unsupervised probing of corporate websites economically trivial.
The exploit chain was not novel, the automation was
None of the individual weaknesses the agents exploited would surprise an experienced penetration tester. One documented intrusion chain combined unauthorized write access to a memcached session store, unsafe handling of serialized PHP objects, and a known weakness in old Zend Framework code, the kind of multi-step chain that normally takes a skilled human hours of manual probing to assemble against a specific target. The agents found a single cookie setting that selected a vulnerable backend server at a large US retailer and used it to gain code execution, then planted a web shell uploader designed to be swapped out for more dangerous tooling later. NorForge independently confirmed a live web shell at a large hardware-parts vendor and separately verified the retailer compromise.
That is the part that should change how CTOs think about patch prioritization. A vulnerability that stayed low priority because exploiting it required bespoke, time-intensive manual work loses that protection the moment an agent framework can chain it automatically at a cost of a few dollars per attempt. The attacker's own model identifier, logged in the panels as something resembling a DeepSeek model potentially run through Claude Code tooling, went unconfirmed by NorForge and Reuters, yet the underlying point holds regardless of which specific model was used: commodity agentic frameworks have collapsed the cost of combining known, patched-eventually weaknesses into working intrusions against production sites.
Real companies, real exposure, mixed outcomes
This was not a lab demonstration. Deere confirmed an intrusion attempt and fixed it, stating it found no sign that sensitive information was accessed. SharkNinja said the attack reached a standalone product-support site rather than core systems, and the threat was contained. Cummins is still investigating a possible attack that appears to have gone through a vendor's website rather than its own infrastructure directly, a reminder that third-party web properties carry the same AI-agent exposure as first-party ones. Two smaller businesses also reported compromises to Reuters. The pattern across these responses is that the companies with faster detection and narrower blast radius came out with contained incidents, while the ones relying on a vendor's security posture are still working out what happened.
NorForge also found that apparently legitimate penetration-testing firms had left real client test data sitting on unsecured Cairn panels, which is a separate and uncomfortable finding: some of the exposure in this story came from security vendors' own operational sloppiness, not just from criminal operators. The tool's author, who goes by le1xia0, told Reuters Cairn was not built for attacks and that no harm was intended, which is true of the software and irrelevant to how it got used. Open-source agent frameworks built for authorized red-teaming are now dual-use infrastructure in the same way exploit frameworks like Metasploit always were, except the entry cost and operator skill required have both dropped sharply.
Your exposed panel might not be an attacker's, it might be yours
NorForge's practical advice for defenders cuts two ways. First, look for exposed agent control panels on your own network, commonly running on port 8000 without a login screen, because internal teams experimenting with agentic pentesting or automation tools can leave the same kind of door open that let Fagerland watch this campaign unfold. Second, watch for unexpected file-upload forms appearing in hidden directories on public-facing applications, which is the specific artifact this campaign's web shell technique leaves behind. Both of these are detectable with existing tooling and do not require new AI-specific defenses, just the discipline to look for AI-agent-shaped artifacts that older monitoring playbooks were not written to flag.
A second Hacker News report from September, by the security firm Gambit, described a separate campaign in which an operator combined Cairn with two other AI tools specifically to steal credit card data, and no source has linked that operation to the one Fagerland found. Whether or not the two are connected, the pattern is now established rather than theoretical: AI agents are being pointed at production web infrastructure, across multiple independent operators, for both access and financial fraud. Treating this as a one-off incident understates what the researchers actually documented, which is a working, repeatable business model.
What this means for the application security budget
The specific technical lesson is unglamorous: patch the old frameworks, lock down memcached and session stores, and fix unsafe deserialization, the same advice application security teams have given for a decade. What changed is the economics of ignoring that advice. A known weakness that sat unpatched because it was deprioritized as low-likelihood now sits inside an attack surface that costs an adversary roughly five dollars and under a day to probe automatically, at a scale of over a thousand targets from a single operator. The AI agent did not discover anything new; it made exploiting what was already known cheap enough to try everywhere at once.
For the CTO roadmap, this argues for two concrete moves rather than a vague AI-threat line item. First, re-score your vulnerability backlog assuming that exploitation cost has dropped toward zero for any chainable, previously low-priority flaw, especially in legacy frameworks like old Zend or unpatched PHP deserialization paths. Second, audit your own and your vendors' use of agentic automation tooling for exposed control panels, because the same framework that let a criminal attack over a thousand sites is the one a well-meaning internal team or a contracted pentest firm might be running with the login screen turned off. This incident is a preview of what commodity offensive AI tooling does to the rest of the patch backlog, not an isolated curiosity.
