The AI hackers forgot to lock their own door

The scary half of this week's AI security story is that hacking agents now work alone. The embarrassing half is how we know: the people running them didn't put a password on the dashboard.

What NorForge found. In a report published Monday, NorForge principal threat researcher Snorre Fagerland describes scanning the web for control panels of Cairn, an open-source system that coordinates AI agents toward a goal. Most AI tools like it need a login. Many Cairn panels didn't. NorForge judged more than 20 exposed panels as likely malicious and grouped them into three clusters. The busiest, a Chinese-language group, ran more than 1,100 attack projects across 14 panels, aimed mostly at online shops in the US, Japan and Australia, with instructions to find a way to run code and plant an uploader web shell. Every task NorForge saw ran on a worker named claudecode_deepseek-v4.1-flash, which it says could mean a Claude Code harness driving DeepSeek's V4.1 Flash model.

The numbers. NorForge puts the average success rate across these tools at about 10%. Successful runs in the busiest cluster took a little under 23 hours on average. It estimates about $5 per task including failures, with "considerable" uncertainty. Reuters, which saw the report before publication, says that hacker's agents tried more than 1,200 sites since September 25 and got into more than 100 companies, including Deere, SharkNinja and Cummins, at roughly $5,000 in tokens, or about $50 per successful hack by Fagerland's estimate. NorForge checked one claimed break-in at a large hardware parts vendor and found the web shell live.

What the companies say. Deere told Reuters it took "necessary remediation actions" and has "no indication that sensitive information was accessed." SharkNinja said a standalone product support site was hit and the threat was contained. Cummins said it is investigating a report about a website run by one of its third-party vendors. Reuters could not establish how much data, if any, was taken.

The sloppy part. NorForge says the panels appear "completely unprotected," exposing what looks like full admin controls: start and stop projects, redirect agents to new targets. Running the secrets scanner Trufflehog over the panel data turned up "literally hundreds" of secrets from targets, 11% verified valid. One English-language cluster put SSH logins for its own staging servers in its tasks. A shared, buggy domain cleaner stripped one "w" too many ("wholesale" became "holesale"), which made related panels easy to link. NorForge also found apparently legitimate red teams running real client tests on open panels. Its conclusion: "In the rush to gain quick results, many have forgotten basic security precautions."

Our take

Everyone in this story moved fast and skipped the basics. The attackers left their dashboards open. Some red teams published their clients' secrets. And the one break-in NorForge explains in detail didn't need a new bug: per the agent's own notes, it chained writable session storage, unsafe PHP deserialization and old Zend Framework code. AI agents make old, unpatched code cheap to find, at a few dollars a try. If you ship AI tools, put a login on every dashboard and keep secrets out of prompts and task boards. If you run a store, patch what's old before an agent finds it.

What we did and didn't do: we read NorForge's report in full and Reuters' story via syndicated copies (Investing.com and NDTV). Victim names come from Reuters, not NorForge, which didn't name them. Costs and success rates are NorForge's estimates. We didn't verify any intrusion ourselves, and we didn't contact the companies.

MODEL Editors