Technology
What a new investigation reveals about AI-assisted attacks on company websites
Exposed control panels offered researchers a view of automated intrusions. Company responses and gaps in the evidence matter as much as the headline numbers.
What to know
- NorForge says it identified more than 20 exposed Cairn control panels likely connected to malicious activity.
- Reuters independently reviewed activity associated with one operator and identified affected company websites.
- The extent of unauthorized data extraction was not established by Reuters; the companies described different scopes and responses.
- A language used by an operator does not establish nationality or government sponsorship.
A cybersecurity investigation published Monday describes attackers using artificial-intelligence agents to work through attempted website intrusions, sometimes for hours. The finding gives businesses a concrete example of how automation can expand an attacker's reach—while leaving important questions about the damage unanswered.
What the researcher could see
In its October 19 report, NorForge describes dashboards left accessible on the public internet. They exposed the instructions given to AI agents and the agents' recorded progress. Researcher Snorre Fagerland grouped activity into several clusters rather than treating everything as one campaign.
NorForge also found exposed panels associated with apparently legitimate security testing. That creates a separate concern: a testing service can expose sensitive client information if its own dashboard is unsecured. The report says the observed malicious clusters appeared financially motivated, without obvious state-sponsored activity in the evidence reviewed.
Which companies were identified—and what they said
Reuters correspondent Raphael Satter reported that one Chinese-speaking operator's activity involved websites belonging to more than 100 companies. Reuters identified victims through its own review; NorForge's public report redacted their identities.
Deere told Reuters it had taken remediation steps and had no indication sensitive information was accessed. SharkNinja said the affected standalone site contained product-support information and the threat was contained. Cummins said it was investigating a potential attack on a third-party vendor's website.
Those responses should travel with the allegation. A report of access to a website is not, by itself, proof that a company's entire network or every customer's information was compromised. Reuters said it could not establish how much unauthorized data extraction occurred.
What remains unproven about attack costs
NorForge's cost calculations are estimates, with considerable uncertainty. The researcher did not have complete token-usage records, and long-running tasks could cost much more than short attempts. A low estimated cost illustrates possible scale; it is not a verified invoice or a universal price for breaching a website.
The broader concern is repeated automated work: agents can keep testing weaknesses while an operator directs multiple tasks. That makes basic security maintenance consequential even when a business is not a prominent target.
A practical starting point for businesses
The U.S. Cybersecurity and Infrastructure Security Agency's business guidance points to familiar protections: software updates, strong passwords, multifactor authentication and phishing awareness. Its resources also cover vulnerability scanning and safer cloud configurations.
For a company, the immediate questions are whether its public applications are maintained, administrative access is protected, vendors can explain their controls and incident records are available. AI changes how quickly an attacker may work; it does not make those responsibilities disappear.
Sources and photo
Source-based explanation of NorForge's original investigation, Reuters' independently reviewed reporting and company responses, and CISA's general business-security guidance. Archive keyboard image by espensorvik, May 12, 2011, CC BY 2.0; illustrative, not an attacker or affected company.
Photograph and reuse notes
A computer keyboard photographed May 12, 2011. Illustrative archive image by espensorvik, CC BY 2.0; not an attacker or affected company. The website photograph is resized/compressed with responsive display cropping. Social adaptations add a crop, contrast gradient, NewsCubby branding and translated headline. No endorsement by the photographer, subject or organization is implied. Original photograph and rights record; license.