How many sites did AI agents breach in this automated campaign?
A hacker used AI agents to access over 100 corporate sites by exploiting exposed Carin instances, targeting firms across multiple continents.
Key points
- The attacker accessed more than 100 websites belonging to well-known companies.
- Exploitation relied on inadvertently exposed instances of the Carin AI platform.
- Targets included businesses in the US, Canada, Australia and Japan.
The short version
- AI agents probed and breached corporate websites without constant human supervision.
- The campaign leveraged exposed Carin instances to execute malicious commands.
- Victims included major brands such as Deere and SharkNinja.
The details
A Chinese-speaking hacker utilised artificial intelligence agents to gain unauthorised access to more than 100 corporate websites, according to a Reuters report. The campaign targeted high-profile organisations including farm equipment manufacturer Deere and appliance maker SharkNinja. The attackers exploited exposed instances of Carin, an open-source AI problem-solving platform that has gained popularity among threat actors. Snorre Fagerland, principal threat researcher at NorForge, observed the activity while monitoring inadvertently exposed Carin instances. He noted that this specific hacker was the most prolific among several groups using similar tactics.
The operation targeted businesses based in the United States, Canada, Australia and Japanese e-commerce sites. As of the week ending 18 October 2026, the agents had attempted to breach more than 1,200 websites. The hacker issued commands using fewer than 100 Chinese characters, yet the automated agents executed complex exploitation sequences. Fagerland described the tactics as sophisticated, noting that the agents scoured digital records to locate infrastructure, identified public-facing control panels and leveraged weaknesses to force command execution.
The context
The use of autonomous AI agents allows attackers to issue instructions and then leave the systems to operate without supervision. This approach enables the operator to focus attention elsewhere while the agents continue their campaigns. While SharkNinja stated the attack impacted only a site used for product support information, other hackers monitored by Fagerland achieved greater success. One group stole credit card data, and another attempted to steal from a cryptocurrency exchange, although the outcome of that specific attempt remains unclear.
Next steps
Organisations should audit their public-facing infrastructure for inadvertently exposed AI platforms or development tools. Teams must verify that no internal problem-solving platforms are accessible without authentication. Security operations should review access logs for unusual command execution patterns originating from exposed services. Monitoring for automated probing behaviour can help identify early stages of such campaigns.
What defenders should look for
Teams usually detect this activity by reviewing web server logs for rapid, automated scanning patterns from single sources. Analysts should check whether public endpoints are receiving complex, multi-stage requests that resemble autonomous tool usage. Look for executions of system commands from web-facing applications that should not have shell access. Containment moves typically involve isolating the exposed service immediately and revoking any credentials generated during the session. Verify that no persistent backdoors were installed by the automated agents.
Background: Threat actors
Threat actors are individuals or groups who initiate cyber attacks. They range from lone hackers to state-sponsored organisations. Understanding their motives helps you predict behaviour. You must monitor for anomalies, not just known signatures, to detect their presence before data exfiltration occurs.
Read the full guide: What Is Threat Actors: Definitions, Tactics and Detection Strategies
What to do and how to stay safe: Carin
- Audit public DNS records and cloud configurations to identify any inadvertently exposed AI or development platforms.
- Implement strict network segmentation to prevent public-facing services from accessing internal infrastructure or sensitive data stores.
- Monitor web application firewalls for unusual command injection attempts or automated probing behaviour from single IP ranges.
- Review access logs for any instances where unauthenticated users triggered complex workflows or system commands.
Step-by-step guide: Password Manager Security Checklist: Hardening Your Vault
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which companies were confirmed as victims in this campaign?
Deere and SharkNinja were confirmed as victims, with SharkNinja noting only a product support site was impacted.
What tool did the hackers exploit to gain access?
The attackers exploited exposed instances of Carin, an open-source AI-powered problem-solving platform.
How many websites were targeted in total?
The agents attempted to break into more than 1,200 different websites as of the week ending 18 October 2026.
