Web Ecosystem — Autonomous AI Agents Automate Mass Intrusion Campaigns Targeting 1,200+ Websites (CVE-2026-75650)

Publication date: October 20, 2026
Category: Threat Intelligence / Offensive Artificial Intelligence

Introduction

An automated cyberattack campaign driven by autonomous artificial intelligence agents has exposed a significant evolution in cybercrime toward language model-orchestrated operations. A Chinese-speaking threat actor directed autonomous agents against more than 1,200 corporate websites, successfully breaching platforms across 100+ global enterprises, including farm-equipment manufacturer Deere, appliance maker SharkNinja, and engine producer Cummins. The operation was uncovered by researcher Snorre Fagerland from security firm NorForge after identifying exposed internet-facing control panels running Cairn, an open-source framework originally built for authorized penetration testing but repurposed for unauthorized offensive operations.

What is Cairn and the Risk of AI Agents in Cybersecurity? (General Analysis)

Cairn is an open-source framework powered by AI agents that allows defining initial targets and intermediate goals to operate step-by-step. Agents publish findings to a shared board where human operators can inject real-time hints and corrections.

When such frameworks lack access controls and are exposed directly to the internet—typically listening on unauthenticated ports like TCP 8000—they introduce a dual-risk vector:

  1. Offensive Automation: Lowering the technical barrier and financial cost for operators to execute complex, multi-stage attacks (estimated at roughly $5 per task and about $50 per successful intrusion).
  2. Secret Leaks: Open panels expose live operational data, credentials, API keys, session tokens, and attack strategies. Scanning panel data with tools like Trufflehog uncovered hundreds of secrets, with 11% verified as still active.

Within this context, the campaign also documented the presence of proof-of-concept exploits targeting critical web infrastructure vulnerabilities, such as CVE-2026-75650 (affecting Adobe Commerce and Magento Open Source), officially rated with a critical CVSS v3.1 score of 10.0 under CWE-1336.

Summary Table of Ecosystem Vulnerabilities

CVE Category (CWE) Impact CVSS v3.1 Official / Estimated Vector CISA KEV
CVE-2026-75650 CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) Arbitrary code execution without user interaction 10.0 (Critical) AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Yes

(Note: CVE-2026-75650 vector and severity are officially verified NVD data).

How Does It Work? (Technical Analysis)

The operations conducted by the malicious clusters identified by NorForge (specifically the AIA0001 cluster) are characterized by operational efficiency and minimal human oversight:

  • Initial Flow & Deployment: Human operators draft concise instructions (fewer than 100 characters in Chinese) defining strategic objectives. From there, agents—operating under workflows supported by models such as DeepSeek V4.1 Flash driven by Anthropic’s Claude Code—perform reconnaissance, directory enumeration, and exploit testing.
  • Persistence & Execution Mechanisms: Typical tasks instruct agents to locate execution pathways on e-commerce storefronts and deploy a web shell uploader. Intrusions leverage diverse vectors tailored to each victim, including:
    • Unauthorized write access to memcached session stores.
    • Unsafe handling of serialized PHP objects.
    • Logic flaws in legacy Zend Framework code.
    • Manipulation of cookie settings to route traffic to vulnerable backend servers.
  • Duration & Economic Cost: Successful intrusions took slightly under 23 hours on average, with an overall success rate around 10% and negligible marginal costs in token consumption.

Affected Systems / Environments

The attacks primarily targeted e-commerce platforms, online retailers, and industrial vendor support portals located predominantly in the United States, Japan, and Australia.

Specifically, software components identified within testing environments or agent infrastructure include:

  • Adobe Commerce and Magento Open Source: Versions running 2.4.4 through 2.4.9 (affected by the template vulnerability CVE-2026-75650 / StyleSmuggler).
  • Legacy PHP Environments: Applications utilizing insecure object deserialization or outdated frameworks (Zend Framework).
  • Session Management Stores: Exposed or loosely permissioned memcached instances.

Mitigation and Detection

Remediation

  • Patch Management: Immediately apply vendor hotfixes and updates issued by Adobe to resolve CVE-2026-75650 across Adobe Commerce (2.4.4 to 2.4.9) and Magento Open Source (2.4.6 to 2.4.9).
  • AI Control Panel Hardening: Ensure internal penetration testing tools or autonomous agent frameworks (such as Cairn) are never exposed directly to the public internet. Enforce strict authentication and restrict access via IP whitelisting or VPNs.
  • Data Store Permission Audits: Audit write privileges on caching services (memcached, Redis) and validate input sanitization for serialized PHP data.
  • Orphan Upload Form Removal: Inspect hidden directories on web servers to detect and remove unauthorized file upload forms or web shells.

Detection

  • Network Perimeter Scans: Monitor external network perimeters for services listening on non-standard or default AI framework ports (such as TCP port 8000) lacking authentication.
  • Web Log Analysis: Inspect HTTP request logs for anomalous patterns targeting e-commerce administration directories, template injection attempts, or suspicious cache modification operations.

Defensive Warning: Leaving autonomous agent control panels exposed not only facilitates immediate site compromise but leaks live corporate credentials and secrets. Proactive hunting for exposed Cairn instances and repository scanning with secret detectors (like Trufflehog) should become standard external attack surface management (EASM) practices.

Wrapping Up

The employment of autonomous AI agents in cybercrime marks a qualitative shift in the scale and accessibility of complex cyberattacks. The ability to orchestrate targeted campaigns against over 1,200 websites at minimal cost demonstrates that offensive automation is no longer exclusive to state-sponsored APTs, but accessible to individual actors leveraging misconfigured open-source tooling. Hardening web perimeters, patching critical vulnerabilities like CVE-2026-75650, and securing internal development infrastructure are mandatory steps to mitigate this emerging automated threat landscape.

References