Top Highlights
-
AI agents attacked at scale: Operators used Cairn agents to probe 1,200+ websites, reaching sites linked to more than 100 companies with little human guidance.
-
Some break-ins were confirmed: Researchers verified several compromises, but the extent of any data theft remains unknown; named companies reported limited or contained impact.
-
The exposed control panels created extra risk: They revealed targets, attack findings and hundreds of credentials or keys—11% of scanned secrets were still valid.
- Defenders should act now: Secure exposed AI panels, investigate unexpected upload forms and patch affected Magento systems.
Autonomous AI Agents Target More Than 1,200 Company Websites
AI agents turn targets into a campaign
Criminal operators used autonomous AI agents to probe more than 1,200 websites and reach sites linked to over 100 companies. The agents worked with little human guidance. They sought ways to run code on online shops and maintain access for later use.
A security researcher discovered the activity after finding exposed control panels online. Those panels revealed the agents’ tasks and results. Researchers confirmed some intrusions, but they do not know whether attackers took data. Several affected companies said they contained the threat or found no sign of sensitive information access.
The tool, called Cairn, lets users set a goal and allows AI agents to pursue it step by step. Its creator built it for authorized security testing, not criminal attacks. However, attackers can redirect tools like this toward websites without permission.
Low costs raise the stakes—and the need for oversight
The agents’ success rate across the observed tools stood near 10%, though researchers warned that different groups pursued different goals. Successful break-ins took just under 23 hours on average. One estimate put the campaign’s AI costs at about $5,000, but the figures remain uncertain.
That low cost could make automated attacks easier to repeat. At the same time, similar tools may help security teams find weaknesses faster when they use them with permission and close supervision. Human judgment still matters: people must set boundaries, protect customer data, and respond when tools uncover a flaw.
Companies can reduce risk by securing administrative panels, removing unexpected upload forms, and promptly applying software updates. Open panels can expose not only a target’s weaknesses, but also passwords and other sensitive information.
Expand Your Tech Knowledge
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Access comprehensive resources on technology by visiting Wikipedia.
DataProtection-V1
