AI Agents Compromised More Than 100 Websites
Matthew Leo · Published October 23, 2026 · News
One person appears to have used AI coding agents to break into more than 100 websites, according to a new investigation that gives defenders a rare look at an agent-assisted intrusion campaign in the wild.
NorForge's researchers found exposed control panels for a system called Cairn and traced a Chinese-language cluster labelled AIA0001. The cluster contained 14 panels and more than 1,100 projects. Reuters independently identified more than 100 compromised companies, including sites connected to Deere, SharkNinja and Cummins.
The campaign is important because it moves the agent-security discussion beyond hypothetical misuse. It also needs careful framing: a human supplied goals and infrastructure, while AI agents carried out much of the repetitive reconnaissance, vulnerability testing and exploitation work.
What the investigation found
NorForge said the operator aimed the agents at more than 1,200 websites in the United States, Canada, Australia and Japan. The researchers estimated a success rate near 10 per cent and an average time of less than 23 hours from the start of a project to a successful compromise.
The researchers also estimated that the campaign cost about US$5,000, based on roughly US$5 per project and about US$50 for each successful intrusion. Those are research estimates, not audited billing records, and they should not be treated as a universal cost for agent-assisted attacks.
Individual company outcomes varied. Deere told Reuters it had found no indication that sensitive data was accessed. SharkNinja said it contained an incident involving a support website. Cummins said it was investigating a vendor-operated site. A compromise does not automatically mean that valuable data was stolen or that a company's core network was breached.
The weak points were not futuristic
The striking part of this campaign is how ordinary the defensive failures look. AI reduced the operator's labour, but the agents still relied on exposed applications, reusable credentials, vulnerable plugins and weak monitoring. The control panels themselves were also reachable from the public internet, which is how researchers discovered the operation.
That creates three separate places to defend:
- The application layer: patch internet-facing software, remove abandoned plugins and test authentication boundaries.
- The agent layer: do not expose orchestration panels publicly, and put strong authentication, network restrictions and detailed logs around any internal agent platform.
- The persistence layer: watch for new administrator accounts, web shells, unfamiliar scheduled jobs, outbound connections and unexpected changes to site files.
What Canadian organizations should do now
Canadian e-commerce sites were among the targets, according to the investigation. Smaller organizations should not assume they are too obscure to attract attention: automation makes broad, low-cost scanning more practical.
Start by inventorying every public website, staging host and vendor-managed portal. Confirm who owns patching for each one. Rotate credentials after any unexplained administrator change, and preserve logs before rebuilding a compromised server. If a service provider operates the affected site, require a written account of the affected system, the containment steps and the evidence supporting any claim that customer data was not accessed.
For teams deploying their own agents, Mapletechie's AI-agent approval-gate checklist explains where human authorization should interrupt risky actions. Our earlier report on agent-driven probes against Library and Archives Canada shows why public-sector and private systems need the same basic controls.
What this campaign does not prove
It does not show that agents can independently choose targets, fund infrastructure and run a complete criminal operation without a person. It does show that one operator can supervise far more parallel work than a manual campaign would allow.
That is enough to change the economics of routine intrusion attempts. Defenders do not need speculative counter-agents first. They need complete asset inventories, faster patching, locked-down agent consoles and logs that make automated persistence visible.
Sources: NorForge technical investigation; Reuters reporting; The Verge summary and company responses.
Tags: AI agents, cybersecurity, incident response, e-commerce