Hacker Used Autonomous AI Agents to Breach Over 100 Websites, Security Firm Says

A hacker compromised more than 100 websites using an army of AI agents that largely operated on their own, according to findings from the AI security firm Norforge. While Norforge did not name the targets, Reuters reported that the victims included companies such as John Deere, SharkNinja, and Cummins. The AI agents carried out the attacks with little involvement from the human hacker.

Attacks orchestrated through an open source AI platform

Researchers at Norforge uncovered the attacks through exposed work on Cairn, an open source AI platform that describes itself as a "general-purpose problem-solving engine." With Cairn, users set a start and end point for the AI agents, which document their progress as they move forward with the task. However, as Norforge noted, hackers can also use the tool to orchestrate cyberattacks using AI agents.

Breaches completed in about 23 hours

The hacker who broke into more than 100 sites was the "most active" among the exposed Cairn instances discovered by Norforge, waging attacks on companies based in the US, Canada, Australia, and Japan, as reported by Reuters. This attacker laid out "preferred intrusion tactics" using fewer than 100 Chinese characters, with successful breaches taking about 23 hours. Overall, Norforge found more than 20 exposed Cairn instances that are "likely malicious."

Company responses

In a statement to Reuters, a John Deere spokesperson said there is "no indication that sensitive information was accessed" as a result of the attack. Cummins said it is "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." SharkNinja said the breach impacted a standalone site with product support information, and that it has contained the threat.

Norforge says it is working to get the malicious Cairn instances taken down. Cairn's creator, who goes by @le1xia0, said earlier this month that the platform "was never a 'hacking tool,'" adding that "misuse is a human decision, not a feature of the engine."

Sources: The Verge