Hackers now use AI agents to break into websites: how small businesses stay safe

AI agents · 1,200+ sites targeted

For years, small businesses told themselves the same thing: "Hackers go after big companies. Nobody's going to bother with my website." In October 2026 that excuse ran out. Researchers watched a single criminal point autonomous AI agents at online shops and let them break in with almost no human help. The agents tried more than 1,200 sites and reached websites belonging to more than 100 companies, including John Deere, SharkNinja and Cummins.

The campaign in numbers

1,200+websites the AI agents tried to break into

~$5estimated average AI cost per attack task

~23 hrsaverage time to a successful break-in

~10%overall success rate across the tools observed

What happened

Security researcher Snorre Fagerland of NorForge was scanning the internet for exposed copies of Cairn, an open-source AI tool built for legitimate, authorised penetration testing. From early October he found around two dozen Cairn control panels being used maliciously, left open on the internet. That let him watch the attacks happen in real time.

The busiest group, which NorForge calls AIA0001, ran 14 panels linked to more than 1,100 attack projects, targeting shops and payment systems in the US, Japan, Australia and Canada. Its goal appeared to be lasting access to e-commerce and payment infrastructure. NorForge confirmed at least one live web shell on a commercial website, and Reuters identified several victims from the attacker's own records.

The affected companies said the damage was limited: Deere fixed the problem and saw no sign sensitive data was accessed, SharkNinja said a standalone product-support site was hit and contained, and Cummins was investigating a vendor-run website. Two smaller businesses also confirmed they were compromised.

How the AI agents attacked

1Short instructionsThe operator wrote under 100 Chinese characters of tactics.

2Pick targetsRanked by traffic; browser automation checked if shops took orders.

3Hunt weak spotsSQL injection, unsafe uploads, auth bypass, old code.

4Plant a web shellA hidden upload form for lasting access.

!Steal laterPayment data, keys and customer records.

Why this changes things for small businesses

The attackers didn't use new magic. They used familiar weaknesses: SQL injection, unsafe file uploads, insecure deserialization, authentication bypasses and outdated framework code. What changed is the economics.

As Detectify's CEO put it, AI is changing the economics of cyberattacks more than the techniques. When one attempt costs around five dollars and an agent will keep trying for hours without getting bored, attackers can afford to go after sites that were never "worth the effort" before. That includes your shop, your clinic's booking site and your restaurant's ordering page.

The old attacker vs the AI-agent attacker

Before

A human tests sites one by one
Skips small sites: not worth the time
Gives up after a few failed tries
Works office hours

Now

Agents run hundreds of projects in parallel
Every site is worth ~$5 to try
Keeps going for ~23 hours on average
Works 24/7, with little supervision

The leak inside the leak

There was a second lesson. The exposed panels showed which sites were attacked, what weaknesses were found and which passwords and API keys were collected. NorForge ran a secrets scanner over the data and found hundreds of secrets, 11% still valid. It also found legitimate security firms that had left real client tests on unsecured panels. If you hire someone to test your site, ask how they protect the results.

How to protect your website: a practical checklist

Update everything. CMS, plugins, themes, PHP, Node.js and frameworks. Old code was the way in for many of these break-ins. If you run Magento, apply Adobe's hotfix for the critical StyleSmuggler flaw.
Lock down file uploads. Allow only the file types you need, store uploads outside the web root, and never let uploaded files execute. A stray upload form was the foothold these agents aimed for.
Put a firewall in front. A web application firewall such as Cloudflare blocks common attack patterns and bad bots before they reach your server.
Rotate leaked keys fast. Treat any exposed password, API key or token as compromised. Change it, don't just delete the file.
Turn on two-factor login for every admin account, hosting and email.
Know what you own. List every domain, subdomain and old landing page. Forgotten "test" and "support" sites, like SharkNinja's standalone support site, are easy targets.
Watch for changes. Get an alert when a new admin user, plugin or unknown file appears.
Keep tested backups off the server, so you can roll back in minutes, not days.

Layers that stop an AI agent

1FirewallBlocks bad bots and known attack patterns.

2Patched codeNo easy, known holes to find.

3Safe uploads + 2FANo foothold, no stolen logins.

✓Alerts + backupsCatch it early, recover fast.

The bottom line

AI hasn't made hackers smarter. It has made them tireless and cheap. The good news: the same basics still work. Sites that are patched, firewalled and monitored are far harder for an agent to crack, and most agents will move on to an easier target.

Want to know how your site would hold up? Run my free website audit, or send me the link and I'll check updates, uploads, logins and firewall settings and fix what's weak.

Sources: The Hacker News, Dark Reading, NorForge, Reuters.

Need this for your website?Tell me about your project and get a fixed quote, usually within 24 hours.

Start a project →WhatsApp