The Verge reported on 19 October that a hacker broke into more than 100 websites using mostly self-running AI agents. It credits the count to findings from the security firm Norforge. Reuters reported that victims included John Deere, SharkNinja and Cummins, The Verge said. Norforge's own report states no breach count. It describes over 20 open control panels for Cairn, an open-source agent tool, that look criminal.
John Deere told Reuters it sees no sign sensitive information was accessed. SharkNinja said a standalone support site was hit and the threat is contained. Cummins said it is investigating a possible attack on a vendor's site. Cairn agents log every finding on a shared board, and operators add hints, including credentials gathered elsewhere. A secrets scanner found hundreds of secrets in that data; 11% were verified valid. In one claimed breach, the agent said it wrote to a memcached session store, a cache of login sessions. It then abused unsafe PHP deserialization, which rebuilds stored data into live objects, in old Zend Framework code.
Norforge says targets listed on the open panels, including some claimed breaches, had details and secrets exposed to anyone who found them. It does not link this to the named companies. Buyers can ask suppliers whether session stores are locked down and old framework parts retired.