This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A Chinese-speaking hacker used the Cairn AI agent framework, powered by DeepSeek and Claude Code models, to autonomously breach over 100 company websites across the US, Canada, Australia, and Japan. The agents performed complex reconnaissance and exploitation tasks, including webshell injection, without human intervention. Researchers identified multiple exposed Cairn control panels, revealing that these autonomous agents are being used for large-scale cyber intrusions.
An operator using Chinese-language instructions reportedly directed Cairn, an AI agent framework, to breach more than 100 company websites. The campaign targeted sites in the U.S., Canada, Australia, and Japan. Researchers verified unauthorized access tools on victim servers. Reuters identified websites belonging to farm equipment maker Deere and appliance maker SharkNinja; the extent of data theft remained unclear.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to develop cyber weapons (e.g., by coding cheaper, more effective malware), develop new or enhance existing weapons (e.g., Lethal Autonomous Weapons or chemical, biological, radiological, nuclear, and high-yield explosives), or use weapons to cause mass harm.
Also classified as
The attacks resulted in the theft of credit card data and the public exposure of hundreds of corporate credentials and secrets.
The AI agents were also tasked with stealing credit card data and attempting to rob cryptocurrency exchanges for financial gain.
The incident involves the use of autonomous AI agents to conduct large-scale cyberattacks and intrusions against over 100 companies.
AI system
Due to a decision or action made by an AI system
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The cyberattacks were executed autonomously by AI agents deployed post-training, directed by a human actor with malicious intent.
This incident represents a significant milestone in cyber threat capabilities, showcasing the first successful, large-scale deployment of autonomous multi-agent AI systems to conduct cyber intrusions. Executed at an extremely low cost of $50 per successful breach, the campaign compromised over 100 Western corporate entities, demonstrating a highly scalable economic and technological threat to corporate networks.
The report describes Cairn as an innovative type of multi-agent architecture where multiple AI agents coordinate, share facts on a blackboard, and autonomously work toward a defined hacking goal.
High Risk: The AI system was used to autonomously compromise commercial infrastructure, posing significant implications for cybersecurity, public interest, and safety.
The AI system was used to autonomously generate code, scripts, and commands to exploit vulnerabilities and inject webshells into target websites.
The reports are highly detailed, coming from a reputable news source and a cybersecurity firm, providing specific technical details, indicators of compromise, and case studies.
Some might view this as a traditional cyberattack where AI is merely a tool, rather than an AI safety incident, but the autonomous decision-making of the agents points to a clear AI safety risk.
Technology
Autonomous Agentic Capabilities
Agents autonomously exploit vulnerabilities without human supervision.
Low-Cost Powerful LLMs
Cheap models like DeepSeek lower the financial barrier to scale attacks.
Dual-Use Problem Solving Tools
Problem-solving tools like Cairn are easily repurposed for hacking.
Data Inputs
Terse Operator Instructions
Brief prompts under 100 characters are enough to trigger complex hacks.
Automated Target Feeding
Pipelines feed pre-verified target lists directly into AI agents.
Exposed Credentials
Unsecured API keys on open panels are ingested by agent operations.
Human Factors
Negligent Panel Security
Operators leave Cairn control panels completely open to the public.
Malicious Intent of Operators
Hackers deliberately task AI agents to steal data and upload shells.
Red Team Operational Errors
Legitimate testers expose customer secrets on unsecured panels.
Process and Methods
Repurposed CTF Frameworks
Attackers reuse benign training/CTF agent skills for real intrusions.
Continuous Probing Cycles
Agents run multi-hour trial-and-error loops until they find weaknesses.
Buggy Domain Normalization
Flawed scripts strip characters from domains, showing automated feeding.
Management
Weak Vendor Patch Management
Target companies fail to patch known flaws like CVE-2026-75650.
Third-Party Risk Management
Victims suffer breaches through unsecured third-party vendor sites.
Insecure Operational Setup
Hacking groups fail to govern and secure their own infrastructure.
Regulatory Environment
Lack of Model Safeguards
Commercial APIs lack robust safety filters to block offensive tasks.
Open-Source Code Misuse
No regulations prevent hosting dual-use offensive agentic code.
Inadequate API Access Controls
Global API gateways allow anonymous access to powerful models.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
