AI Agents Assigned 1,100-Plus Website Attack Projects, Including Commerce Sites

Exposed Cairn dashboards show AI agents assigned more than 1,100 attack projects against organizations mostly in the U.S., Japan and Australia, including online stores and payment sites.

More than 20 exposed Cairn interfaces appeared likely to be malicious. A set of 14 panels was likely linked to one group and contained more than 1,100 projects.

The count reflects tasks assigned to agents, not confirmed breaches. At least one completed project contained a web shell, a tool that can give an intruder a way to upload files.

Cairn takes a target and an objective, then coordinates agents to record findings and choose next steps. Human operators can add instructions as the process unfolds, so the projects measure assigned work rather than fully independent activity. Across the observed campaigns, about 10% of projects were estimated to reach their goals. Completed projects in the largest group took just under 23 hours on average.

Model costs for tasks in the largest group were estimated at about $5 each, including failed attempts. The estimate is uncertain because actual token-use figures were unavailable.

A separate set of 10 Cairn panels was likely connected to a group assigning tasks involving credit cards and cryptocurrencies, although some panel links were less certain. Cairn was also assigned tasks involving transfers between crypto wallets; the available findings do not establish that transfers were completed or that an exchange suffered a theft.

Separately, infrastructure linked to attacks on South Korean financial organizations contained ARTEX configuration files and Claude Code session histories. At an Oct. 14 meeting, South Korea’s Financial Services Commission counted breaches at 16 financial companies involving an estimated 100,000 pieces of customer data. Authorities were examining whether the incidents were connected and whether AI was used in the breaches. South Korean financial authorities plan a broad inspection of companies’ cybersecurity systems and are pursuing a regulatory basis for requiring more frequent, regular vulnerability tests.