Security researchers at Norforge identified a significant cyberattack campaign in which a single threat actor compromised more than 100 websites using autonomous AI agents. The affected organizations included major industrial and consumer goods companies, with victims spanning multiple countries including the United States, Canada, Australia, and Japan.
The attacks were orchestrated through Cairn, an open-source AI platform designed as a general-purpose problem-solving engine. The platform allows users to input initial and final objectives, with AI agents documenting their progress toward completing assigned tasks. Researchers determined that threat actors adapted this functionality for malicious purposes, using the agents to autonomously conduct reconnaissance and exploit vulnerabilities across numerous targets. The most prolific attacker in the discovered instances created instructions using fewer than 100 Chinese characters and achieved successful breaches within approximately 23 hours on average.
Norforge’s investigation uncovered more than 20 exposed Cairn instances showing signs of malicious activity. The exposed configurations revealed the attacker’s preferred intrusion methodologies and demonstrated how AI agents could be deployed at scale with minimal human oversight once initial parameters were established.
The targeted companies issued varying statements regarding the incidents. Cummins indicated it was investigating a potential attack on a vendor-operated website. John Deere stated there was no evidence that sensitive data had been accessed. SharkNinja confirmed that a standalone product support website was affected but said the threat had been contained.
Norforge stated it was working to remove the malicious Cairn instances from circulation. The platform’s developer disputed characterizations of Cairn as a hacking tool, contending that misuse reflects human intent rather than inherent features of the system.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI