Attack SurfaceAgentic AIVulnerability Management
A single operator used autonomous AI agents to probe more than 1,200 websites and breach sites belonging to more than 100 companies. According to Reuters, as published by the Honolulu Star-Advertiser, the campaign began targeting sites on 25 September 2026 and reached e-commerce sites in the United States, Canada, Australia and Japan. Reuters named Deere & Co., SharkNinja and Cummins as victims. Deere said it had "no indication that sensitive information was accessed," and SharkNinja said the breach was limited to a standalone product support site. How much data was taken is not known.
The activity came to light through research by NorForge principal threat researcher Snorre Fagerland. While scanning the internet for exposed instances of Cairn, an open-source AI problem-solving engine, he found about two dozen being used for attacks from around 2 October. NorForge published its findings on 19 October. Because the operators' control panels were exposed, Fagerland could watch the agents work in close to real time. The tool's author told Reuters it was "not designed for hacking attacks."
The operator gave terse instructions, sketching an intrusion approach in fewer than 100 Chinese characters. The agents then ran on their own for hours. Cairn gives agents a goal and a shared workspace of findings, so they can reuse what one agent discovers and change their approach without a person directing each step. Reuters reports that successful intrusions typically took about 23 hours.
The priorities were familiar weaknesses:
In one verified case, a single cookie setting was enough to route traffic to a vulnerable backend server at a large US retailer. In another, agents that failed against a company's public application found related infrastructure, a control panel and a data-processing flaw, and used it to make the server run commands. The cost was roughly $5,000 in AI tokens, which Fagerland estimated at about $50 per successful compromise.
Nothing in this campaign needed a new exploit. The flaws were old, the web components were legacy, and the admin surfaces were reachable from the internet. What is new is the speed and cost. An attacker no longer has to script each step, and the work that once took a team can be run across thousands of targets at once.
Three steps reduce exposure now:
The agents in this campaign worked from the outside in, so the first question is what an outsider can see. Obiguard Scout maps your external attack surface, so you can see which hosts, applications and admin paths face the internet and what they run. That inventory is the starting point for finding the same kinds of weaknesses an autonomous agent would look for, before one does. For a related story on the governance side of agents, see how OpenAI's own agents weakened their safety monitoring.
If an AI agent started testing every website you run this afternoon, which of them would it find first?
See how Scout maps your exposed surface, or talk to us about what it would show for your estate.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →