Someone's AI agent may already have tested whether your checkout takes orders. On Oct 19, NorForge and Reuters showed what happens next: the agent goes looking for a way onto your server.
The attacker's agent checked that your checkout works before it went looking for a way in.
This is a defensive drill. It covers what was found and what to do about it this week.
What NorForge found
NorForge researcher Snorre Fagerland went looking for exposed control panels of Cairn, an open source AI problem-solving platform. In "Inside Cairn", NorForge says more than 20 exposed panels were likely tied to malicious activity, and all of them appeared to be after money.
The busiest group, which NorForge calls AIA0001, wrote in Chinese and ran over 1,100 attack projects across 14 panels. NorForge says it targeted organizations mostly in the US, Japan and Australia, aiming for persistent access to e-commerce and payment infrastructure.
One typical task, translated by NorForge, describes the targets as confirmed shopping sites with 200,000 to 1.5 million in traffic, where "Playwright has verified that orders can be placed." The goal was code execution on the server, and the payload was a file uploader planted on the site.
That's the part to sit with. The target list was a list of stores that work.
NorForge also listed the tools in one agent's work folder. It included a proof of concept for StyleSmuggler, CVE-2026-75650, the Magento flaw, plus a Magento lab for testing it.
The economics are the other part. NorForge estimates average success for the harnesses it saw at around 10%. For AIA0001 projects that reached their goal, the average time from start to goal was a little under 23 hours. NorForge guesses a typical task costs around $5 in tokens and says that number could be off by a clear margin.
What Reuters added
Reuters' Raphael Satter reported the same day that Fagerland watched a Chinese-speaking hacker break into websites of more than 100 companies. Reuters named Deere, SharkNinja and Cummins after reviewing the hacker's Cairn activity itself.
Per Reuters, the instructions were under 100 Chinese characters. The agents had tried more than 1,200 sites as of late last week. Fagerland estimated about $5,000 in tokens, or about $50 per successful hack, with what appeared to be a mix of DeepSeek and Claude Code.
The companies' answers are worth reading closely. Deere said it had "no indication that sensitive information was accessed." SharkNinja said the hit was a standalone product support site and was contained. Cummins said it was investigating a site run by one of its third-party vendors. Reuters says it couldn't confirm how much data was taken.
So the soft spots were side sites and vendor sites as often as the main store. Your support portal, your old promo microsite and your agency's staging server all count.
The drill
Plan on an afternoon. Do it before the holiday traffic, and before you add more agents of your own.
1. Patch StyleSmuggler if you run Magento or Adobe Commerce
Adobe released APSB26-146 on Sep 7. Adobe says the flaw lets an unauthenticated attacker run code on the store and "has been exploited in the wild targeting Adobe Commerce merchants."
Apply the VULN-39341 hotfix for your version. On Commerce Cloud, Adobe's page shows how to confirm it reads Applied.
Then rotate. Adobe is blunt that rotating the encryption key alone doesn't cancel credentials that may already have leaked. Its list covers admin passwords, integration tokens, OAuth secrets, payment gateway keys at the provider, database credentials, SSH and deploy keys, and shipping and tax API keys. Work through all of it.
Same week, same habit: PHP. On Oct 20, the PHP security team announced an emergency release for two critical flaws, both rated CVSS v4.0 9.2. Security firm watchTowr, quoted by BleepingComputer, tracks them as CVE-2026-109618 and CVE-2026-109619, calls them remote code execution flaws, and believes they affect PHP 5 through 8. WooCommerce, Magento and WordPress stores all run on PHP. php.net's Oct 21 advisory puts the fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no project updates; php.net posted minimal source backports for 7.4, 8.0 and 8.1 and says to check with your distro or LTS vendor. The interim settings php.net lists are stopgaps, and updating is the fix. Ask your host or agency for the date they'll apply it.
2. List every script that loads on checkout
Open your checkout and payment pages and write down every script that loads, who added it and why it's there. Remove what nobody can explain. Then set up an alert for when that list changes.
NorForge saw the goal was a planted uploader that could be swapped for something worse later. A new script or file on checkout that nobody approved is the thing to catch early.
3. Check the forgotten sites
List every site on your domains and every vendor site that carries your brand. Support portals, old campaign pages, staging copies. Patch them or take them down. The Reuters statements say this is where several hits landed.
4. Run a permission drill on your own Always On Agents
Attackers are using agents. You may be too. Make sure yours can't become the easy way in.
For each agent, write down four things: which accounts it signs in to, what it can spend, what it can publish or send, and how you shut it off. Give each agent its own seat so you can cut one off without locking yourself out. We covered that in give each Always On Agent its own seat.
Then check the stops. Any agent that can pay, publish, change a cart or message a buyer should wait for a person to approve the final step. That's the rule from your agent pressed submit. Rotate any key you gave an agent during step 1, too.
5. Write the one page you'll want later
One page per store: which sites you run, which agents have access to what, how you stop each one, what you log, and who you call. If a researcher or reporter emails you about a breach, you want that page already written.
What this doesn't tell you
It doesn't tell you whether your store is on anyone's list. NorForge redacted victims, and Reuters named only companies it could confirm. It also doesn't give you a rate for stores like yours. The 10% and $50 figures are NorForge's and Fagerland's estimates for what they saw.
What it does show is that checking whether your store takes orders and then looking for a way in is now cheap enough to run against a lot of stores at once.
This week
Patch and rotate if you run Magento. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. List your checkout scripts. Write down what each of your agents can reach and how you shut it off.
If you'd rather have this drill built into how your agents run, Start your build or write hello@mail.22atlas.com.
Linked sources
- NorForge (Snorre Fagerland): Inside Cairn: Open Windows into massive AI-Driven Cyber Operations (2026-10-19)
- Reuters via Yahoo (Raphael Satter): How one hacker used AI agents and a few thousand dollars to break into scores of sites (2026-10-19)
- Adobe Experience League: Critical Security Update Available for Adobe Commerce (APSB26-146)
- Adobe Security Bulletin APSB26-146
- PHP.net: PHP security advisory, fixed releases for CVE-2026-109618 and CVE-2026-109619 (2026-10-21)
- BleepingComputer (Lawrence Abrams): PHP warns admins of two critical flaws, emergency patches coming tomorrow (2026-10-20)
- Related article: Your agent pressed submit
- Related article: Give each Always On Agent its own seat, not your login
Get our Articles and posts by email.
Up to one email a day with new Articles and posts from 22atlas.com and sean-weldon.com, plus occasional news about 22Atlas services.
Also on the desk
Technique
Your agent pressed submit
Anthropic's test agents filled out real forms on real websites, including one they were told to stop before sending. Here is a submit gate and a 24-hour incident drill for Always On Agents, in seven steps.
Technique
Give each Always On Agent its own seat, not your login
Google's new Gemini coworker agent gets its own account, its own audit trail and a spend cap that pauses it. You can set up your agents the same way today on the tools you already pay for. Five moves.