In a significant cybersecurity incident, an individual speaking Chinese leveraged AI agents to infiltrate more than 100 corporate websites, spending approximately $5,000 on AI tokens. This operation, investigated by Reuters in October, illustrates the potential for single actors to orchestrate sophisticated attacks with minimal ongoing involvement.
Scope of the Cyber Attacks
The affected websites included those associated with companies like Deere, SharkNinja, and Cummins, though the extent of the impact varied among them. The cyber campaign initiated on September 25, targeting over 1,200 websites, primarily focusing on e-commerce platforms in the United States, Canada, Australia, and Japan.
Snorre Fagerland, a principal threat researcher at NorForge, identified the malicious activities while examining exposed installations of Cairn, an open-source platform for coordinating AI agents. By October 2, he discovered numerous installations apparently engaged in harmful activities.
How Cairn Facilitated the Attacks
Cairn, a general-purpose problem-solving engine, was used beyond its intended scope in these attacks. As detailed in NorForge’s technical report, attackers provided specific targets and objectives, enabling AI agents to identify vulnerabilities and gain unauthorized access.
The platform facilitated information sharing on a project board, allowing agents to adapt their strategies based on previous findings. This enabled them to explore multiple pathways to access, rather than relying on a singular method.
NorForge linked the most substantial Chinese-language activity cluster, designated AIA0001, to 14 dashboards with over 1,100 attack projects. Their methodology involved using Microsoft’s Playwright for browser automation to validate the functionality of e-commerce sites before engaging Cairn for further exploitation.
Low-Cost, High-Efficiency Attack Model
The attacks aimed at executing code without user authentication, employing techniques like SQL injection, unsafe file uploads, and login bypasses. These efforts sought persistent access to shopping and payment systems for potential financial gain.
NorForge verified a breach by confirming a webshell at a reported address on a hardware vendor’s site, which enabled file uploads and further infiltration. This breach utilized a combination of unauthorized memcached session store access and unsafe PHP object deserialization.
Other cases saw agents bypassing main applications, utilizing related infrastructure to find vulnerabilities, such as exposed control panels, to execute server commands.
Average successful projects under AIA0001 took less than 23 hours, with some lasting over five days. NorForge estimated a 10% success rate across observed campaigns, with a cost of $50 per successful breach, although these are approximations rather than confirmed records.
Entities such as Deere and SharkNinja have acknowledged and addressed these incidents, with no confirmed access to sensitive information. Cummins is still investigating potential breaches.
Preventative Measures and Future Outlook
As AI-driven cyber threats continue to evolve, organizations are urged to strengthen security protocols. This includes patching public-facing applications, limiting access to administrative panels, and monitoring for unusual files in web directories. Security teams should investigate suspicious activities thoroughly before restoring affected services.
While this incident highlights the efficiency and low cost of AI-driven cyberattacks, it also underscores the need for enhanced cybersecurity measures to protect against such evolving threats.
