# Autonomous AI Agents Exploit Over 1,200 Websites, Breach 100 Companies

*Published October 21, 2026*
*Source: [https://thehackernews.com/2026/10/hackers-use-autonomous-ai-agents-to.html](https://thehackernews.com/2026/10/hackers-use-autonomous-ai-agents-to.html)*

## Executive Summary

Autonomous AI agents have been used to breach over 100 companies by exploiting more than 1,200 websites, with minimal human oversight. This incident highlights the significant threat posed by automated attacks using open-source tools like Cairn.

## Article

A significant cybersecurity breach has been uncovered involving autonomous AI agents targeting over 1,200 websites, impacting more than 100 companies worldwide. A security researcher from NorForge, Snorre Fagerland, discovered this operation by identifying exposed control panels on the internet, allowing him to observe the attacks in real-time. The attackers used Cairn, an open-source AI tool, to infiltrate websites without permission, including those of well-known companies like Deere, SharkNinja, and Cummins. The extent of data theft remains unclear, but the attack demonstrates the minimal human intervention needed when using autonomous agents. 

NorForge identified three clusters of activity, with the most active, AIA0001, linked to Chinese-speaking operators and responsible for over 1,100 attack projects. These agents were primarily focused on gaining lasting access to shop and payment systems across the United States, Japan, and Australia. A typical attack involved gaining code execution capabilities on a website, followed by planting a web shell uploader. 

Some companies have responded to the breaches, stating limited impact. Deere reported no signs of sensitive data access, while SharkNinja and Cummins are investigating potential breaches. The attacks generally succeeded within 23 hours, with a success rate of about 10 percent. The cost per task was estimated at around five dollars, although overall costs were uncertain. 

The exposure of Cairn panels also highlighted vulnerabilities, potentially revealing weaknesses and sensitive information to unauthorized parties. NorForge verified that a significant portion of exposed secrets were still valid. Legitimate penetration-testing firms were also found to have left client data exposed on unsecured panels, indicating a broader issue beyond criminal activity. Efforts are underway to alert affected parties and address the exposed panels.