Block Exposed AI Control Panels to Stop Autonomous Site Breaches

Security researchers observed a campaign where criminals pointed autonomous artificial intelligence agents at company websites, allowing the software to break in with minimal human assistance. The attackers succeeded because operators left their AI control panels exposed on the public internet. This activity was documented by Snorre Fagerland of the security firm NorForge, who monitored the operations in real time. The campaign targeted online shops, aiming for lasting access to payment and store systems.

The risk

The attackers utilized Cairn, an open-source tool designed for authorized penetration testing, to automate intrusion attempts. Cairn provides AI agents with a starting point and a goal, allowing them to work step by step toward breaching a system. The agents post findings to a shared board, enabling a human operator to add hints or guidance during the process. Although the tool's author, known as le1xia0, stated it was not designed for hacking, the researchers found it being used maliciously against e-commerce platforms without permission.

Who is exposed

NorForge identified about two dozen Cairn instances being used maliciously, beginning around October 2. The firm grouped the exposed panels into three clusters, judging more than 20 of them likely to be malicious. The busiest cluster, labeled AIA0001, linked 14 panels to more than 1,100 attack projects. Targets included websites belonging to more than 100 companies across the United States, Japan, and Australia. Notable victims identified from attacker records include Deere, SharkNinja, and Cummins.

Cost and compliance

The exact amount of data taken during these breaches is not known. NorForge independently confirmed the compromise of one very large US retailer, where agents identified a specific cookie setting that selected a vulnerable backend server. The firm also found a live web shell at a large hardware-parts vendor. The three named companies stated that the damage from the incident was limited. How much information was exfiltrated remains unclear.

Our take on the response

Organizations must assume that any internet-facing administrative interface is a primary entry point for automated attacks. Leaving open-source security tools exposed without authentication provides attackers with a command center for autonomous breaches. Teams should prioritize scanning for exposed instances of tools like Cairn immediately and ensure all administrative endpoints are strictly behind authentication and network segmentation to prevent unauthorized remote access.

What defenders should look for

Teams usually detect this activity by monitoring for unusual outbound connections from internal systems to unknown external endpoints, which may indicate AI agents reporting back to a control panel. Security operations should check web server logs for repeated, automated scanning patterns that differ from typical user traffic. Look for the creation of new files in web directories, particularly those resembling web shells or uploaders. Containment moves typically involve isolating compromised servers from the network and rotating all credentials associated with the affected systems.

Background: Web shells

Prevent web shells by enforcing strict input validation, restricting write permissions on web directories, and monitoring for anomalous file creation. Use integrity monitoring to detect unauthorized changes. Remove unused scripts and enforce least privilege to limit the damage if an attacker uploads a backdoor.

Read the full guide: Web Shell Prevention Checklist: Stop Persistent Backdoors

What to do and how to stay safe: Cairn

• Scan your network for any exposed instances of the Cairn tool or similar AI orchestration platforms.
• Ensure all administrative control panels are protected by strong authentication and are not directly accessible from the public internet.
• Monitor web server access logs for automated scanning behavior and unusual file uploads that could indicate web shell deployment.
• Verify that backend servers are not accessible through predictable cookie settings or other hidden parameters that could bypass security controls.

Step-by-step guide: Multi-Factor Authentication Fatigue: Why Users Click Yes Too Fast

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What tool did the attackers use to automate the breaches?

The attackers used Cairn, an open-source AI tool designed for penetration testing, to automate the intrusion attempts.

How many sites were targeted in this campaign?

The agents tried more than 1,200 sites and successfully reached websites belonging to more than 100 companies.

Did any major companies confirm they were hacked?

Deere, SharkNinja, and Cummins were named as targets, and they told reporters that the damage was limited.