A Chinese-speaking threat actor has used autonomous AI agents to compromise more than 100 company websites in the United States, Canada, Japan and Australia, according to research from NorForge published on October 19. Deere, SharkNinja and Cummins are among the organizations named as affected. The campaign, tracked as AIA0001, is ongoing.
NorForge Traces AIA0001 to Exposed Cairn Instances
NorForge principal threat researcher Snorre Fagerland found the activity while investigating exposed instances of Cairn, an open-source problem-solving platform.
NorForge describes AIA0001 as the most active Chinese-language operation of its kind. The researchers counted more than 1,200 documented breach attempts and more than 100 compromised company sites. The attacker’s dashboards held more than 1,100 attack projects spread across 14 dashboards.
Reuters and NorForge both published the findings on October 19. The targets are e-commerce businesses. According to the research, the goal is access to “shopping and payment infrastructure for future monetization”.
How AIA0001 Chains Cairn, Playwright and AI Model Orchestration
The tooling combines Cairn with Playwright, which the operator uses to verify sites after an attempt. The AI model attribution is not confirmed: the orchestration likely relies on DeepSeek models driven through Claude Code, but the specific model use has not been verified.
The attack projects are tracked across the operator’s 14 dashboards.
Exploit Techniques Used Against E-Commerce Sites
NorForge lists a broad set of web attack methods in the campaign:
- Unauthenticated remote code execution
- SQL injection
- Unsafe deserialization, including PHP object deserialization with Zend Framework gadget chains
- Authentication bypass
- Vulnerable upload functions
After gaining access, the agents deploy uploader shells to maintain persistence on the compromised sites. The operator ran more than 1,200 documented attempts and kept what succeeded.
About $50 Per Successful Intrusion
The economics are a central finding. The operation spent about $5,000 in total on model tokens. With roughly a 10% success rate, that works out to about $50 per successful intrusion. The average attack project ran for just under 23 hours.
Those figures describe a campaign in which most attempts fail but the cost of each failure is small enough that the operator still profits from the successes.
Victim Responses From Deere, SharkNinja and Cummins
The three named companies described different situations. Deere said it remediated the issue and found no evidence that sensitive data was accessed. SharkNinja said the affected system was a standalone product-support site. Cummins said it is investigating a possibly compromised third-party vendor site.
The responses show that the named brands were not necessarily hit through their main storefronts. In the SharkNinja and Cummins cases, the affected assets sat outside the core corporate site, one as a separate support property and the other as a vendor-operated site.
Attacker Dashboards Exposed Victim Credentials
NorForge also found hundreds of unsecured dashboards that exposed victim credentials and operational details. This creates a secondary risk: the information the operator collected from compromised sites was itself accessible to anyone who found the dashboards, not only to the attacker.
No law-enforcement action has been reported in connection with AIA0001, and remediation so far has been handled by individual victims.
What the Campaign Shows About Automated Web Intrusion
AIA0001 is an example of low-cost, largely automated mass compromise of web shops. The documented cost per intrusion and the 10% success rate show that agent-driven attacks can run at scale without a large team. Because the targets are e-commerce operators, the compromised sites sit close to customer payment flows, which is the access the operator says it is seeking.
The attacker’s exposed Cairn instances and unsecured dashboards leaked victim data to third parties.
