Hackers Use AI Agents In More Than 1,200 Attempts Against Over 100 Companies

AI agents are increasingly being discussed as tools that can operate with less direct human supervision, but the same flexibility that makes them useful for legitimate work is also attracting cybercriminals. A recent report describes more than 1,200 AI-assisted intrusion attempts targeting over 100 organisations, showing how attackers are beginning to combine autonomous agents with traditional offensive techniques at scale.

Researchers identified three distinct clusters of activity, each believed to represent a separate individual or group. Rather than manually controlling every stage of an attack, the operators appear to provide relatively short instructions and then allow AI agents to continue working independently. The result is an early glimpse at how cyberattacks could become faster, cheaper and far more automated.

AI Agents Are Moving From Experiments Into Real Attacks

Until recently, most discussion around autonomous AI and cybersecurity focused on what models might eventually be able to do.

This latest activity suggests that attackers are already experimenting with practical deployments.

Instead of treating AI as a chatbot that provides advice, threat actors are using agents capable of carrying out multi-step tasks with relatively little supervision.

That changes the economics of cybercrime.

A human attacker can only work on a limited number of targets simultaneously. An AI-driven system can potentially investigate many organisations in parallel.

Researchers Identified Three Main Threat Clusters

Security researchers at Norforge reportedly tracked three separate clusters of AI-driven malicious activity.

Each cluster displayed different behaviour and prompting patterns, suggesting that they were probably controlled by different operators rather than one coordinated campaign.

One cluster stood out because its instructions were written primarily in Chinese.

Some reports highlighted the fact that many of its prompts contained fewer than 100 Chinese characters, implying that attackers could launch relatively complex operations with surprisingly short instructions.

That sounds dramatic, although language structure matters. A short Chinese prompt can carry considerably more information than the same character count in English, so the comparison is not necessarily straightforward.

Short Prompts Could Trigger Long AI Workflows

The more important point is what happened after the prompt was submitted.

Once given an objective, the AI agents could continue performing actions without the attacker manually guiding every individual step.

That is where agentic AI becomes especially relevant to cybersecurity.

Traditional automation usually follows predefined scripts. An AI agent can potentially interpret changing situations, choose between different options and continue working even when the environment does not exactly match what its operator expected.

This flexibility is what makes the technology potentially powerful for attackers.

Most Operations Lasted Less Than A Day

The tracked attack projects reportedly varied considerably in duration.

One particularly long operation remained active for more than five days, but the average campaign lasted less than 23 hours.

That suggests many of these AI-driven attacks were designed around relatively fast experimentation rather than extended stealth operations.

Attackers could launch an agent, allow it to operate for several hours and then assess whether anything useful happened.

Even if most attempts fail, automation changes the equation because launching another project requires far less human effort.

Average Success Rate Was Around 10%

The reported average success rate across the tracked projects was roughly 10%.

At first glance, that may not sound particularly impressive.

But scale changes the significance.

If an attacker manually attempted ten targets and succeeded once, the effort involved might make the campaign inefficient.

If an automated system can attempt hundreds or thousands of targets while requiring relatively little supervision, a 10% success rate becomes much more concerning.

Automation does not need to be perfect to become dangerous.

One Cluster Dominated The Activity

The Chinese-language cluster was by far the most active group identified.

Out of 1,269 tracked attack projects, approximately 1,139 were attributed to this single cluster.

That means the overwhelming majority of observed activity originated from one operator or closely related group.

The scale demonstrates how one individual or small team can potentially amplify its capabilities significantly through AI automation.

Instead of maintaining dozens of human operators, a threat actor could rely on autonomous agents to handle much of the repetitive work.

Major Companies Were Among The Targets

The reported targets included several well-known organisations across different industries.

Among the companies mentioned were:

These businesses operate in very different sectors, including agricultural equipment, consumer appliances and industrial engines.

That diversity suggests the activity was not necessarily focused on one specific industry.

Instead, the attackers may have been searching broadly for organisations with weaknesses that automated agents could exploit.

AI Makes Broad Targeting Much Easier

Traditional targeted attacks usually involve significant preparation.

Attackers research the organisation, identify technologies in use, investigate employees and manually develop an approach.

AI agents can potentially reduce some of that workload.

A system might automatically gather public information, evaluate exposed infrastructure and adapt its next actions according to what it discovers.

That does not mean AI can magically compromise any organisation.

It still needs vulnerabilities, stolen credentials or other weaknesses.

But it can make the discovery process substantially more scalable.

Automation Changes The Cost Of Failure

One of the most important changes brought by AI is how little failed attempts may cost the attacker.

Human operators naturally prioritise targets because their time is limited.

An AI agent can repeatedly attempt different organisations without becoming tired or distracted.

If 90% of attempts fail, the system can simply continue with another target.

That makes broad, opportunistic campaigns more attractive.

The attacker no longer needs every intrusion attempt to succeed.

Cairn Was Reportedly Used To Facilitate The Operations

The campaigns were reportedly orchestrated through a platform called Cairn.

The tool appears to provide an environment where AI agents can be launched and managed across different projects.

According to the report, attackers used the platform to create and run their operations.

However, the creator of Cairn has rejected the idea that the platform itself should be described as a hacking tool.

The developer, who uses the handle @le1xia0, stated that the software was not created specifically for malicious use and argued that what people choose to do with it is ultimately their responsibility.

General-Purpose AI Tools Can Be Used Both Ways

This raises a familiar issue surrounding dual-use technology.

Many tools useful for cybersecurity research can also be abused offensively.

Network scanners, automation platforms, scripting languages and penetration-testing frameworks all have legitimate purposes.

AI agents fall into the same category.

The technology itself may be neutral, but the intent of the operator determines whether it is used for security testing, software administration or unauthorised intrusion.

That makes platform governance increasingly complicated.

The Attackers Apparently Made A Major Security Mistake

Ironically, the attackers themselves reportedly demonstrated poor operational security.

Norforge researchers found that the Cairn panels associated with the attack projects were openly accessible and lacked proper protection.

This exposed substantial information about the campaigns.

According to the researchers, project controls that appeared capable of managing ongoing operations could be viewed publicly.

This included interfaces related to starting and stopping projects, restarting previous operations and managing data associated with the agents.

The Researchers Did Not Test Those Controls

An important distinction is that the researchers reportedly did not attempt to verify whether those visible controls could actually be used without authorisation.

That restraint matters.

Seeing an exposed interface is not the same thing as confirming that every control can be activated by an unauthenticated visitor.

Testing those functions could interfere with live operations or create legal and ethical problems.

Instead, Norforge documented the exposure and focused on getting the offending panels taken down.

Attackers Can Make The Same Security Mistakes As Everyone Else

There is some irony in cybercriminal infrastructure being exposed because of poor configuration.

Attackers frequently exploit basic mistakes made by organisations: weak credentials, public management interfaces, misconfigured servers and outdated software.

But criminals can make exactly the same mistakes.

In their rush to launch campaigns quickly, threat actors may leave dashboards, logs or control systems exposed.

That can provide defenders with valuable intelligence.

Operational security remains important regardless of which side of the attack is using the infrastructure.

AI Does Not Automatically Make Attackers Smarter

This incident also provides a useful reality check.

AI agents can make attackers more scalable, but they do not automatically make them more disciplined.

A sophisticated automated attack can still be undermined by something as simple as an improperly secured control panel.

The same principle applies to legitimate organisations.

Advanced AI security systems do not compensate for basic failures such as exposed administrative interfaces or weak access controls.

The fundamentals still matter.

The Bigger Concern Is The Number Of Parallel Attacks

The most concerning aspect of AI-driven cyber operations may ultimately be scale rather than sophistication.

A human attacker might manually investigate a few organisations at once.

An AI system could potentially investigate hundreds.

Even if the AI is less capable than an experienced penetration tester, sheer volume can compensate for that weakness.

A system that succeeds only occasionally can still create significant damage if it runs enough attempts.

That resembles how spam and automated credential attacks already work today.

AI simply makes the automation more adaptive.

Attackers Could Use AI To Handle Reconnaissance

One area where AI agents could be particularly useful is reconnaissance.

Before an intrusion, attackers often need to understand the environment they are targeting.

That can involve identifying public services, technologies, exposed applications and potential weaknesses.

Much of this work is repetitive and data-heavy.

AI systems are well suited to sorting through large amounts of information and deciding which findings deserve further attention.

That reduces the amount of manual effort required before an attacker decides whether a target is worth pursuing.

Agents Could Also Adapt When Something Changes

Traditional automation can fail when a target behaves differently from what the script expects.

AI agents may be better at dealing with those situations.

If an application returns an unfamiliar response, the agent can potentially interpret it and choose another approach.

This flexibility is one reason security researchers are paying close attention to agentic systems.

The danger is not necessarily that AI suddenly discovers completely new attack techniques.

It is that existing techniques become easier to combine and adapt automatically.

Defenders Will Need Automation Too

If attackers increasingly use AI to scale their operations, defenders will likely need similar capabilities.

Security operations teams already deal with enormous volumes of alerts, logs and network activity.

AI can help investigate suspicious behaviour, correlate events and prioritise incidents.

That could create an increasingly automated contest.

Attackers deploy agents to search for weaknesses.

Defenders deploy agents to identify and contain those attacks.

The speed of response may become just as important as the sophistication of the underlying security tools.

Attack Surfaces Need To Shrink

The best defence against automated attackers remains reducing what they can reach.

Every unnecessary internet-facing service provides another potential target.

Organisations should continually review:

AI makes this housekeeping even more important because automated agents can scan for these weaknesses continuously.

What used to be an obscure forgotten server may now be discovered much faster.

Identity Security Becomes Even More Important

AI-powered attack tools still benefit enormously from compromised credentials.

A valid user account can provide attackers with access that would otherwise require exploiting a technical vulnerability.

Organisations should therefore strengthen authentication around critical services.

Multi-factor authentication, privileged access management and tighter access controls can limit what compromised credentials allow an attacker to do.

Accounts should also be reviewed regularly so former employees, abandoned service identities and unnecessary administrative privileges do not remain active.

Monitoring Needs To Focus On Behaviour

Traditional security systems often look for known malware or previously identified attack signatures.

AI-driven attacks may be more variable.

An autonomous agent can potentially change its behaviour according to the environment.

That makes behavioural monitoring increasingly important.

Organisations should look for unusual authentication patterns, unexpected administrative activity, strange sequences of requests and other deviations from normal behaviour.

The goal is to identify what the attacker is doing rather than relying entirely on recognising one particular tool.

AI Makes Basic Cybersecurity More Urgent, Not Less Relevant

There is a tendency to assume that defending against AI-powered attacks requires equally futuristic technology.

That is only partly true.

Many attacks still depend on ordinary weaknesses.

Outdated software.

Poor passwords.

Misconfigured services.

Excessive permissions.

Exposed dashboards.

AI simply makes finding and exploiting those mistakes faster.

Fixing basic cybersecurity remains one of the most effective ways to reduce risk.

Companies Need To Assume Automated Reconnaissance Is Constant

The old assumption that an obscure internet-facing system might remain unnoticed for months is becoming increasingly unrealistic.

Automated scanners have already made that assumption dangerous.

Agentic AI could make it even more so.

Organisations should operate as though every public system is being continuously examined.

If something is accessible from the internet, there is a reasonable chance that automated systems will eventually discover it.

Security therefore needs to exist before exposure, not after the first suspicious connection appears.

Cairn Raises A Broader Platform Responsibility Question

The reported use of Cairn also raises another difficult question: how responsible should general-purpose AI platforms be for what their users do?

The platform creator argues that Cairn was not developed as a hacking tool.

That position is understandable.

A general automation platform can have many legitimate applications.

However, once tools become powerful enough to orchestrate autonomous activity at scale, platform operators may face increasing pressure to detect obvious abuse.

This debate is likely to become much larger as agentic AI systems become more accessible.

Restrictions Could Also Affect Legitimate Security Research

Any attempt to prevent malicious use needs to be balanced carefully.

Cybersecurity professionals use many of the same techniques as attackers when testing systems with permission.

Overly aggressive restrictions could therefore make legitimate penetration testing and defensive research more difficult.

The distinction comes down to authorisation.

Testing your own infrastructure or a customer's system with permission is fundamentally different from attacking unrelated companies.

Platforms need to find ways of addressing abuse without making legitimate security work impossible.

AI Lowers The Barrier To Entry

Perhaps the most significant long-term concern is that AI could make cyber operations accessible to people with less technical experience.

An attacker who previously needed substantial scripting and infrastructure knowledge may increasingly be able to describe what they want an agent to accomplish.

The AI handles more of the implementation.

That does not suddenly turn everyone into an expert hacker.

Complex environments and well-secured systems still require expertise.

But the minimum skill required for some attacks may gradually decline.

That could increase the number of people capable of launching meaningful cyber campaigns.

Scale Could Matter More Than Individual Skill

This is where the 1,269 tracked projects become particularly interesting.

The story is not simply that AI successfully compromised a certain number of companies.

The real shift is that a small number of operators could initiate over a thousand projects and allow automated agents to handle much of the workload.

Even relatively mediocre attackers become more dangerous when technology multiplies their output.

Cybersecurity teams need to plan for that change.

Final Thoughts

The discovery of more than 1,200 AI-assisted attack projects targeting over 100 organisations offers an early look at how agentic AI could reshape cybercrime. Researchers identified three main threat clusters, with one particularly active group responsible for 1,139 of the 1,269 projects they tracked.

The average operation reportedly lasted less than 23 hours and achieved roughly a 10% success rate. Those numbers may not sound extraordinary individually, but automation changes their significance. When attackers can launch large numbers of autonomous operations with limited manual involvement, even a modest success rate can become dangerous.

Perhaps the most ironic part is that the attackers themselves apparently made basic security mistakes, leaving Cairn control panels publicly exposed. That serves as a reminder that AI does not eliminate the importance of cybersecurity fundamentals for either attackers or defenders.

The broader concern is scale. AI agents do not need to become dramatically smarter than human attackers to change cybersecurity. They simply need to make reconnaissance, experimentation and repeated attack attempts cheap enough to run continuously.

And that may be the real warning here: the future of cyberattacks may not be one brilliant hacker breaking into one company. It may be one person launching hundreds of AI agents and waiting to see which one gets through.