AI agent attacks have compromised websites belonging to more than 100 companies, according to findings made public on 19 October 2026. The campaign used Cairn, an open-source AI orchestration platform, to automate much of the intrusion process.
The affected organisations were spread across the US, Canada, Australia and Japan. Reuters independently identified John Deere and SharkNinja among the victims, while Cummins investigated a potential attack on a third-party vendor’s website and security company NorForge documented the underlying activity.
How the AI agent attacks were uncovered
NorForge researcher Snorre Fagerland began finding suspicious Cairn deployments around 2 October 2026. In total, the company discovered roughly two dozen internet-exposed instances associated with malicious operations, some of which allowed researchers to observe active tasks through publicly accessible control panels.
Cairn describes itself as a general-purpose problem-solving engine. A user gives the system an origin and a goal, after which it coordinates multiple AI agents through a state-space search. Its documented use cases include autonomous penetration testing, but the same capabilities can be directed towards real websites without authorisation.
NorForge watched several operations through the exposed Cairn panels. Reuters then independently reviewed the artefacts associated with one Chinese-language operator and concluded that the operator’s agents had successfully entered websites belonging to more than 100 companies.
NorForge did not identify the victims in its own technical report. The names John Deere, SharkNinja and Cummins came from Reuters’ separate investigation and subsequent discussions with the companies.
Timeline of the Cairn AI agent attacks
Activity discovered in October
Around 2 October 2026, NorForge started identifying exposed Cairn instances being used for apparently malicious activity. The accessible interfaces gave researchers unusual visibility into live operations, including the instructions supplied by operators and the steps taken by their agents.
Public disclosure on 19 October
On 19 October 2026, NorForge published its technical analysis, titled “Inside Cairn”. It described more than 20 exposed panels and presented technical details from at least one verified intrusion chain.
Reuters published its investigation on the same date. It reported that the most active Chinese-language operator had compromised websites associated with more than 100 companies across four countries. John Deere, SharkNinja and Cummins provided responses about the reported incidents and their investigations.
No incident-specific vendor patch advisories or affected software version lists had been published as of 19 October 2026. This means organisations cannot address these AI agent attacks by applying a single named security update.
How the verified website intrusion worked
NorForge documented one intrusion in which the attacker obtained unauthorised write access to a memcached session store. Memcached is commonly used to hold temporary application data, including sessions for PHP websites. If an attacker can manipulate that store, they may be able to place malicious session content where the application expects trusted data.
The targeted application then performed unsafe PHP object deserialisation. Deserialisation converts stored data back into software objects, but processing attacker-controlled objects can trigger unintended application behaviour.
The operation also used a gadget chain in legacy Zend Framework components. A gadget chain combines existing classes and functions in an application so that deserialising a crafted object produces a harmful outcome. The attacker therefore did not need to upload a conventional executable at the beginning of the chain.
NorForge reported that the intrusion ultimately resulted in an uploader web shell. A web shell is a malicious server-side file or function that provides continued remote access, allowing an attacker to upload files, issue commands or prepare further activity.
The observed sequence was:
- Gain unauthorised write access to a memcached session store.
- Insert data that would be processed through unsafe PHP object deserialisation.
- Use legacy Zend Framework components to form an exploitable gadget chain.
- Establish post-exploitation access through an uploader web shell.
This verified chain demonstrates that the agents could progress beyond scanning and vulnerability identification. They were able to combine weaknesses, adapt their actions and reach a persistent foothold on a live website.
Companies and websites affected by AI agent attacks
Specific products, website platforms and software versions for the named organisations were not disclosed. The available statements indicate that the incidents concerned web properties rather than John Deere machinery, SharkNinja consumer products or Cummins industrial systems.
John Deere said it had taken necessary remediation actions and had no indication that sensitive information was accessed. This limits the confirmed impact, but does not change the finding that one of its web properties was entered.
SharkNinja said the affected asset was a standalone site containing product support information. The company reported that it had contained the threat.
Cummins said it was investigating a report of a potential cyber attack involving a website operated by one of its third-party vendors. That distinction is important because it illustrates how externally managed and supplier-hosted sites can extend an organisation’s exposure.
No public IP addresses, domains, file hashes or web shell locations were released in the reviewed material. Organisations therefore cannot rely on a published indicator list to determine whether related AI agent attacks reached their environments.
Current exploitation status
The activity represents confirmed exploitation in the wild, not a laboratory demonstration or theoretical proof of concept. NorForge observed operations through exposed Cairn panels, and Reuters independently examined the most active operator’s records.
The operator used short Chinese-language instructions, but this does not establish identity, location or affiliation. No state sponsorship has been attributed. Other observed operators appeared interested in objectives such as payment card theft and attacks against cryptocurrency exchanges, suggesting that at least some activity was financially motivated.
Why this incident matters to UK organisations
These AI agent attacks show how an operator can coordinate repeated intrusion attempts without manually completing every step. That model is especially relevant to smaller websites, old support portals and supplier-operated services that may receive less security attention than primary corporate systems.
The verified use of common PHP infrastructure, memcached and legacy Zend components also shows that ordinary web application weaknesses can become more dangerous when automated agents test and combine them at scale.
Actions organisations should take now
- Identify all externally accessible websites, including support portals, campaign sites and properties operated by suppliers.
- Confirm that memcached session stores cannot accept writes from untrusted networks or exposed services.
- Review PHP applications for unsafe object deserialisation and remove unsupported or legacy Zend Framework components.
- Examine web roots, upload directories and server logs for unexpected uploader files, command execution or unusual session activity from around 2 October 2026.
- Ask website suppliers to confirm whether they use affected architectural patterns and what evidence supports their assessment.
Because no campaign-specific indicators or universal patch are available, investigation should concentrate on the exposed web architecture and the verified intrusion path. Priority should go to forgotten websites and third-party properties where automated probing may encounter outdated components or weak access controls.
Originally reported by it.slashdot.org.
