TL;DR
What happened: Autonomous AI agents targeted more than 1,200 websites, reportedly breaching over 100. The agents independently investigated targets, discovered vulnerabilities, tested exploitation paths, and pursued persistent access.
What are the implications? Evidence of goal-driven autonomous intrusions is mounting. The attacker defines the objective, but AI agents determine how to achieve it—adapting to failures, discovering alternative paths, and operating for hours with limited human intervention.
Lineaje's analysis reveals the larger security challenge: AI agents can autonomously discover exploitation paths faster than traditional vulnerability management processes can identify, prioritize, and eliminate the weaknesses they exploit.
What can you do about it: Defenders need to proactively leverage frontier-model driven discovery capabilities with autonomous remediation to secure their applications. Tools like Lineaje’s Frontier Defense™ usie specialized AI agents to discover code weaknesses, validate exploitability, and then generate verified fixes. Autonomous agents ability to link systems and vulnerabilities is showcasing that individually exploitable vulnerabilities are no longer the gold standard of measuring exploitability.
What Happened
A threat actor used autonomous AI agents operating through the Cairn framework to conduct a large-scale intrusion campaign targeting e-commerce websites and payment infrastructure. Instead of manually directing each attack step, the operator set objectives while AI agents independently investigated targets, discovered vulnerabilities, tested exploitation paths, and maintained persistent access.
Researchers at NorForge identified more than 20 publicly exposed Cairn panels associated with suspected malicious activity. The most active cluster, designated AIA0001, included 14 panels and more than 1,100 attack projects. NorForge assessed the cluster as malicious with high confidence and reported that it predominantly targeted organizations in the United States, Japan, and Australia.
The attack objectives were explicit. Agents were directed to identify unauthenticated remote code execution (RCE) opportunities across shopping and e-commerce websites in the United States, Canada, Japan, and Australia. Targeted weaknesses included command execution, code injection, deserialization, file upload vulnerabilities, SQL injection, server-side template injection (SSTI), and server-side request forgery (SSRF) that could lead to RCE. They also prioritized authentication bypass and account takeover, aiming to deploy an uploader shell to establish access.
While the findings demonstrate successful compromises, the available evidence does not establish widespread data theft associated with the AIA0001 campaign.
Lineaje Threat Labs Analysis
The Important Development Is Autonomous Path Discovery
The Cairn campaign's significance is not simply that attackers used AI to generate exploit code. Instead, AI agents independently discovered and pursued exploitation paths without an operator prescribing every intermediate action.
Cairn's goal-driven architecture let agents accumulate evidence, decide on next steps, test potential vulnerabilities, and adapt when initial approaches failed. Projects averaged approximately 140 discovered facts, while successful AIA0001 projects took just under 23 hours on average. At least one project continued operating for more than five days.
Reuters documented one example in which agents failed to identify a vulnerability in a company's primary public-facing application. Rather than stopping, they investigated related infrastructure, discovered another publicly accessible control panel, analyzed its behavior, and eventually identified a path that reportedly enabled malicious command execution.
Lineaje's analysis identifies a critical development: path autonomy.
Objective → Reconnaissance → Evidence → Decision → Experimentation → Failure → Alternate Path → Exploitation → Goal
The attacker defined the objective, but the agents determined how to achieve it. When one exploitation path failed, they could investigate alternatives, gather more evidence, and keep pursuing the same goal.
This fundamentally changes the defender's challenge. Security teams are no longer facing only individual exploitation attempts against known weaknesses. They now face autonomous systems that can discover, test, and connect multiple potential weaknesses into viable attack paths.
The implication: Every exploitable vulnerability or misconfiguration represents another potential route to an attacker's objective. As autonomous agents accelerate the discovery of those routes, defenders have less time to identify and eliminate exploitable weaknesses.
Why This Changes the Threat Model
Traditional automation excels when attackers already know what they are looking for: scan for a vulnerability, identify a matching version, execute an exploit. The Cairn activity demonstrates something different. The agents spent extended periods accumulating information and changing their actions based on what they discovered. Cairn progressed through cycles of facts and intents toward a predefined goal. This creates three important changes.
Persistent Exploration
A human attacker has limited time. An autonomous agent can continue exploring a target for hours or days. The observed successful projects averaged nearly 23 hours from start to goal.
Economically Scalable Attacks
An average task, including failed or prematurely terminated attempts, is estimated to cost approximately $5 in model usage, although it should be noted that the estimate has substantial uncertainty. Reuters separately reported Fagerland's estimate of roughly $5,000 across the campaign, or approximately $50 per successful intrusion.
This lets attackers economically apply sustained analysis to many targets.
Adaptive Exploitation
The agent does not necessarily need a predetermined exploit. The observed workflow allowed agents to collect information, formulate subsequent actions, and investigate alternative paths toward the attacker's goal. The validated case studies include successful command execution and web shell deployment through different exploitation paths.
The result is closer to an autonomous penetration tester pursuing malicious objectives than to a conventional vulnerability scanner.
Attack Analysis
The observed campaign can be represented as a goal-driven autonomous attack loop:
Target Selection → Agent Task Definition → Attack Surface Reconnaissance → Vulnerability Hypothesis → Tool-Based Validation → Exploit Attempt → Failure → New Facts → Alternate Path → Successful Exploitation → Persistent Access
Reconnaissance and exploitation tooling were found in an exposed worker environment, including OWASP Amass, dnsrecon, ffuf, Nmap, Playwright, PHPGGC, Python, Node.js, and custom utilities. The important distinction is that these tools are not themselves new. The agent provides the reasoning and orchestration layer connecting them to an attacker-defined goal.
The Defensive Problem: Machines Can Now Search for the Path
This campaign highlights an important shift in how organizations should think about exposure.
A vulnerability doesn't need to be obvious enough for a commodity scanner to find immediately. An agent can repeatedly investigate the environment, gather more context, test hypotheses, and search for another route to its objective.
That makes seemingly disconnected weaknesses more important.
An exposed administrative interface, unsafe deserialization path, improperly protected session store, authentication weakness, or forgotten associated system may become useful when an autonomous system can spend hours attempting to connect them.
The attacker therefore gains something that conventional automation historically lacked: cheap persistence in problem solving.
AI Kill Chain
The stages supported by the observed evidence are:
- Reconnaissance — Active. Through tool-based surface discovery, agents enumerated targets and associated infrastructure using reconnaissance tools such as OWASP Amass, dnsrecon, ffuf, and Nmap. In one reported case, when the primary application did not yield a weakness, the agents identified associated infrastructure and another public-facing control panel.
- Trust Manipulation — Bypassed entirely. The currently published evidence does not establish this stage strongly enough to attribute it to this campaign.
- Input / Instruction Weaponization — Bypassed entirely. The currently published evidence does not establish this stage strongly enough to attribute it to this campaign.
- Reasoning-Time Execution — Active. Through adaptive path discovery, Cairn agents accumulated facts, generated subsequent intents, and iteratively selected actions toward the predefined attack goal. Failed paths therefore led to additional investigation rather than terminating the operation, with projects averaging about 140 discovered facts before reaching their goals.
- Tool Invocation — Active. Through autonomous tool invocation, agent workers accessed reconnaissance, browser automation, fuzzing, network scanning, payload-generation, and scripting tools that supported investigation and exploitation. The tools themselves were not new. The agent provided the reasoning and orchestration layer connecting them to an attacker-defined goal.
- Privilege Escalation — Bypassed entirely. The currently published evidence does not establish this stage strongly enough to attribute it to this campaign.
- Lateral Movement — Bypassed entirely. The currently published evidence does not establish this stage strongly enough to attribute it to this campaign.
- Persistence — Active. Through durable state modification, AIA0001 tasking explicitly required deployment of an uploader shell. NorForge independently checked one completed task and confirmed that the reported shell URL was serving the uploader web shell.
- AI-Native C2 — Bypassed entirely. The currently published evidence does not establish this stage strongly enough to attribute it to this campaign.
- Action on Objectives — Active. Observed goals included remote code execution and establishing persistent access, and NorForge validated successful command execution in its case studies. The research supports compromise, but the available evidence does not establish widespread data theft by the AIA0001 campaign.
We have not included Stages S2, S3, S6, S7, and S9 because the currently published evidence does not establish the corresponding Lineaje tactics and techniques strongly enough yet to attribute them to this campaign.
How Lineaje Addresses the Emerging Risk
This incident requires an important distinction between protecting enterprise AI agents and protecting infrastructure from externally operated malicious agents.
Lineaje's value is applied at two different boundaries:
Closing the Vulnerabilities Before Autonomous Agents Exploit Them
The Cairn campaign exposes a critical imbalance: attackers can now automate vulnerability discovery, test exploitation paths, and pursue alternative routes at scale. Defenders cannot rely on detection and manual remediation processes alone to keep pace.
Lineaje CVEF and Frontier Defense™ address the vulnerabilities these autonomous agents seek to exploit.
CVEF: Eliminate Known Exploitable Vulnerabilities
CVEF continuously identifies, prioritizes, and eliminates exploitable vulnerabilities across the software supply chain. By focusing on verified exploitability rather than vulnerability counts alone, CVEF helps organizations reduce the weaknesses attackers can use, with evidence that remediation has been successfully verified.
Frontier Defense™: Discover and Eliminate Novel Vulnerabilities
Frontier Defense extends this protection to novel vulnerabilities in first-party code that traditional scanners may not recognize. Its AI-native security intelligence engine orchestrates specialized agents through a continuous Discover → Validate → Generate → Create → Verify process to discover vulnerabilities, validate exploitability, generate exploit evidence, create compatible patches, and verify successful remediation, with human approval before changes are applied.
Together, CVEF and Frontier Defense help organizations move from reactive vulnerability management toward continuous, autonomous vulnerability elimination.
The security imperative is changing: When attackers automate vulnerability discovery and exploitation, defenders must automate fixing and verification.
Prevent Enterprise Agents from Becoming Autonomous Attack Platforms
The Cairn campaign exposes a critical imbalance: attackers can now automate vulnerability discovery, test exploitation paths, and pursue alternative routes at scale. Defenders must respond by eliminating exploitable vulnerabilities as quickly as possible—not simply detecting and managing them.
Lineaje UnifAI prevents enterprise-controlled agents from becoming autonomous attack platforms by enforcing runtime policies that restrict what agents can do, regardless of what they are instructed to do.
UnifAI helps organizations:
- Control tool access: Allow only approved tools and agent-to-tool interactions.
- Restrict destinations: Prevent connections to unauthorized networks and external endpoints.
- Limit execution: Block unauthorized operating system commands and high-risk actions.
- Protect credentials and data: Restrict credential use and sensitive data movement.
- Enforce authorization: Require human approval for consequential actions.
The principle is simple: An agent's ability to perform an action does not mean it is authorized to do so. UnifAI enforces those boundaries at runtime, helping prevent enterprise agents from being redirected into autonomous attack activity.
Autonomous Exploitation Changes the Rules of Defense
The significance of the Cairn campaign is not that AI discovered an entirely new category of vulnerability. It is that reasoning, tools, persistence, and inexpensive compute combined into an autonomous attack process capable of pursuing multiple exploitation paths at scale.
Lineaje's view: Autonomy converts persistence into scale. Attackers no longer need to direct every step of an intrusion. AI agents can independently investigate targets, adapt to failures, and pursue alternative paths until they achieve their objectives.
The next generation of security must address both sides of autonomous exploitation: eliminating the vulnerabilities attackers seek to exploit and governing the actions enterprise AI agents are authorized to perform.
While CVEF and Frontier Defense address exploitable vulnerabilities, UnifAI complements these capabilities by enforcing runtime policies that govern enterprise AI agent behavior, tool invocation, access, and execution.
The security imperative is clear: As attackers automate exploitation, defenders must automate vulnerability elimination while maintaining control over their own AI systems.
Autonomous attacks demand autonomous defense. Find it. Fix it. Verify it.