Exposed AI Agent Panels Reveal Reported Breaches of More Than 100 Websites

NorForge researchers observed a Chinese-speaking hacker using AI agents to attempt intrusions into more than 1,200 websites and reportedly gain unauthorized access to more than 100, including sites belonging to Deere and SharkNinja. Principal threat researcher Snorre Fagerland monitored the activity through inadvertently exposed instances of an open-source AI platform, identified as Cairn in NorForge’s research. The exposed panels revealed target selection and autonomous reconnaissance and exploitation: agents identified target infrastructure, located a vulnerable public-facing control panel, and exploited it to execute malicious commands.

SharkNinja said the incident affected only a product-support information site; the supplied reporting does not establish the scope of access at Deere or other targets. NorForge also described operations exposing victims’ secrets, while separately monitored hackers stole credit card data and attempted theft from a cryptocurrency exchange, with the exchange outcome unclear. The findings highlight risks from both AI-assisted exploitation of internet-facing systems and unsecured AI administration panels that expose operational activity and sensitive data. Defenders should prioritize securing public-facing control panels, restricting access to agent-management interfaces, and monitoring for automated reconnaissance and command execution.