Chinese

Reuters reported that a Chinese-speaking hacker used exposed Carin AI agents to breach more than 100 company websites, including sites tied to Deere and SharkNinja. NorForge researcher Snorre Fagerland said fewer than 100 Chinese characters directed agents that attempted more than 1,200 targets, including one chain that moved from reconnaissance to command execution.

A short prompt, broad reach

A Chinese-speaking hacker used exposed instances of Carin , an open-source AI agent platform, to breach more than 100 company websites, Reuters reported, citing research by cybersecurity firm NorForge . The affected brands included Deere and SharkNinja. The target set spanned the U.S., Canada, Australia and Japan.

NorForge principal threat researcher Snorre Fagerland found the exposed Carin instances and monitored several hackers using them. The Chinese-speaking operator produced the largest number of attempts among the group, Reuters said. By the week ending Oct. 18, 2026, the operator's agents had attempted to breach more than 1,200 websites.

Fewer than 100 Chinese characters set the operator's goals. The agents searched digital records for infrastructure tied to the target. They found a public-facing control panel and identified a weakness in it. The agents used that weakness to force the panel to execute malicious commands.

Fagerland said the sequence required more work than a fixed script. He rejected the idea that the attack amounted to 'script kiddie stuff.' The operator assigned broad goals and left the agent to choose each action. An agent could inspect each result and choose a tool. It could test a response and continue when the first route failed. That loop turned one short instruction into a sequence of actions. The chain reached from reconnaissance to control-panel access and command execution.

Fagerland's observation shows a difference from script-based automation. Scripts follow code paths chosen in advance. An agent can select the action from tool output, which gives a hacker greater reach per command. An unsupervised agent can keep working while the operator focuses on another target. The Carin operator could direct several agents and issue fewer commands.

The observed attack chain ran from a short prompt to remote command execution. (Image credit: Getty)

Impact at victim sites

SharkNinja told Reuters the attack affected one site used for product support information and no other system. One of the other hackers stole credit card data, and another tried to take funds from a cryptocurrency exchange. Fagerland's team could not confirm whether the exchange attempt succeeded.

The incidents show how a small prompt can produce broad action across many targets. Carin served as the execution layer for the attack chain. Traditional vulnerability scanners issue predefined requests, while an agent can choose which exposed service to inspect and which weakness to test. That adds a control-plane risk to each exposed deployment.

The reporting gives few details the scale of data theft, the exposed accounts or the affected customer records. The figures with the most force for security planning remain the exposed instances, more than 100 breached websites and more than 1,200 attempted targets.

Controls for agent platforms

Agent platforms need controls designed for privileged automation. Administrators should remove anonymous access and expose management interfaces through authenticated paths. They should rotate exposed credentials and keep agent tools separate from production credentials.

Runtime policies can restrict shell commands and file access. They can limit browser sessions and outbound network requests. They can require human approval for credential use and data deletion. The same approval gate can cover high-impact API calls.

Teams should log prompts and tool calls. They should retain outbound traffic records so investigators can reconstruct each chain. Rate limits and spending caps can stop runaway loops. Sandboxing can isolate repeated scans from company systems.

Teams should treat each agent runtime as a privileged service account. They should apply least privilege to every tool and scope each credential to one task. Administrators should patch public control panels before an attacker maps them. They should remove exposed demo instances when teams retire a test environment.

The open-source repository gives defenders a way to inspect prompt handling and tool permissions. Reviewers can trace execution boundaries in the source. Security teams can use the OWASP Top 10 for LLM Applications to review model and tool risks. The NIST AI Risk Management Framework offers a structure for deployment controls.

Supply-chain and market effect

AI agents use the permissions granted to their connected services. A weak admin panel can become one step in an attack path that starts with a public prompt. A reused credential or an unfiltered network route can extend that path. The security boundary spans the model gateway and agent runtime. It includes connected tools and their credentials. The host sits inside the same boundary.

NorForge's monitoring shows that exposed general-purpose agents can serve as reusable attack infrastructure for several operators. Deployment controls carry more weight than prompt filtering in this threat model.

Cloud and platform teams should map those connections before deployment. They should identify which tools agents can call and which destinations they can reach. Teams need a decision on which actions require human approval and where logs will travel.

Vendor selection should account for these controls. Security buyers should ask whether a platform authenticates every operator. They should ask whether it logs tool activity and limits privileges. Buyers should press suppliers for proof that these controls work in production.

Security vendors can build runtime guardrails and tools for discovering exposed agents. Cloud providers can add deployment checks that flag public admin panels and open outbound routes.

The operator entered fewer than 100 Chinese characters, and the agents attempted more than 1,200 sites during the week ending Oct. 18, 2026. That ratio shows the amplification: a short instruction set produced more than 1,200 attempts. A public agent instance can operate at a scale that exceeds the operator's manual reach, and a weak web control panel can turn that scale into unauthorized access.

Defenders can use the observed chain as a threat model. They should hunt for exposed agent instances and public management interfaces. They should review tool permissions and outbound access.

AI agent deployments add a control plane to the corporate attack surface. Teams that expose those deployments without authentication give attackers a path. Missing isolation and logging leave that path outside the operator's view. Organizations should treat an exposed agent as a security defect. Agents that remain exposed give attackers a ready-made hacking platform.

Source : tomshardware.com