Autonomous AI Agents And Cyberattacks: What SMBs Should Do Now
· 9 min read
What Reuters and NorForge observed about Cairn agent workflows, and the CCCS baseline controls SMBs can prioritize for website risk.
What Reuters And NorForge Actually Observed
A recent set of observations described by Reuters and detailed by NorForge points to a shift many small businesses have been anticipating, but rarely see documented this clearly: one operator can run long, autonomous web attack cycles against many targets at once.
For SMB owners and lean marketing leads, the practical risk is simple. Your public website, its plugins, its admin access, and the third parties who touch it can become the easiest way into brand damage, lost leads, and costly cleanup. This post breaks down what was actually observed, how Cairn-style agent workflows operate, and which Canadian Centre for Cyber Security baseline controls map directly to this scenario.
Reuters reported, via an article republished by StreetInsider, that over the past couple of weeks a cybersecurity researcher watched a Chinese-speaking hacker break into websites belonging to more than 100 companies. Reuters listed examples that included Deere, SharkNinja, and Cummins.
Reuters attributed the observation to Snorre Fagerland, a principal threat researcher at NorForge. Reuters said Fagerland saw the activity while scanning the web for inadvertently exposed instances of Cairn, and that beginning around October 2 he found about two dozen instances of Cairn being used for malicious activity.
The same reporting sets an important boundary on what “breach” means in this context. Reuters said it could not ascertain the degree to which the breaches resulted in unauthorized extraction of data. In other words, access and impact were not shown as the same thing in every case.
Several company responses Reuters included reinforce that point. Deere said it took necessary remediation actions and had no indication that sensitive information was accessed. SharkNinja said the incident affected a standalone site carrying only product support information and that the threat had been contained. Cummins said it was investigating the report of a potential cyber-attack on a website operated by one of its third-party vendors.
NorForge’s own write-up adds operational context from what it describes as more than 20 exposed Cairn panels. NorForge said these panels provide an unusually detailed view of how threat actors select targets, direct autonomous agents, exploit vulnerabilities, and establish persistent access to compromised systems. NorForge also explained why details are redacted, stating that panels can reveal who they are, what weaknesses have been uncovered, account secrets and API keys, and whether they have been compromised or not.
How Cairn Turns A Short Goal Into Autonomous Work
The Core Model In The Cairn Repository
In the official GitHub repository, Cairn is described as a general-purpose problem-solving engine. It is framed as a system that, given an origin and a goal, searches for a path through an unknown state space.
The repository uses penetration testing as an example problem type with an origin (such as a target IP or target system), a defined goal (such as get a shell or capture the flag), and an unknown path. Cairn also defines three primitives used to coordinate work: Fact, Intent, and Hint. A Fact is described as a confirmed, objective finding written to the board. An Intent is described as a declared direction of exploration, not yet executed. A Hint is described as human judgment injected at any time, absorbed by agents on the next read.
Coordination is described as concurrent agent workers running an OODA loop, observing the full graph, orienting to the current state, deciding on next intents, acting to explore, and writing findings back as new facts. The repository also describes agents coordinating exclusively through the shared board (stigmergy), with no direct communication and no information silos.
From a business risk perspective, one detail matters more than any buzzword. The system is designed so a project can keep producing new attempts and new findings over time, without a person manually driving each small step, while still allowing a human operator to inject hints if they choose.
What NorForge Says It Looked Like In Real Operations
NorForge describes Cairn work as organized into projects. In Cairn, each separate task is considered a project, and every project has a start point called an origin and a predefined end goal. Between start and end, NorForge describes cycles of intents and facts, with the agent posting every fact onto a project-internal blackboard. NorForge also notes that a human operator can add their own hints to the same blackboard.
NorForge gives a concrete example of how aggressive a “goal” can be. It described one task that explicitly demanded a webshell to be installed in order for the goal to be reached. NorForge said it verified one case by fetching the shell URL, and that the URL did indeed serve an uploader webshell.
NorForge also provides metrics that help calibrate the “one person can do everything instantly” narrative. It reported an average success rate hovering around 10%. It also reported “Start to goal, AIA0001 <23h” and “Facts per project 140,” and wrote that the average time from project start to goal met was a little under 23 hours, with a wide range, and that the view was a snapshot.
What This Changes For SMB Website Risk
The most practical shift in the Reuters and NorForge material is operational speed and scale. Reuters described autonomous agents spending hours probing and breaking into targeted sites. Reuters also framed the observed set as more than 100 companies over the past couple of weeks.
NorForge’s panel-based view adds a second-order risk that SMBs often miss because it sits outside the victim website itself: the control infrastructure. NorForge said panels were left unsecured on the open web and can expose account secrets and API keys. Even where an attempted intrusion fails, exposed tooling and exposed admin surfaces can create additional ways for attackers to chain access across systems and vendors.
Another important correction is definitional. In this reporting, “broke into” does not automatically mean customer data was extracted, and Reuters explicitly said it could not ascertain the degree of unauthorized data extraction. For leaders, this shifts the focus from debating labels to managing blast radius. A contained incident on a standalone site that carries only product support information still consumes time, creates reputational risk, and can create downstream problems if the same credentials or admin patterns appear elsewhere.
Controls To Prioritize, Mapped To The Scenario
The Canadian Centre for Cyber Security publishes “Baseline cyber security controls for small and medium organizations (V1.2).” Several controls map directly to the kind of website and vendor exposure described by Reuters and NorForge.
Incident Response Readiness
Under “3.1 Develop an Incident Response Plan,” the guidance includes BC.1.1 (a basic plan for responding to incidents of varying severity) and BC.1.2 (a written incident response plan, plus an up-to-date hard copy). It also includes BC.1.3, which says organizations should consider purchasing a cyber security insurance policy that includes coverage for incident response and recovery activities or provide rationale for not purchasing one.
For a marketing lead or an external web partner, this is where operational clarity beats security theater. The fastest containment often depends on having accurate contacts and responsibilities ready for the domain registrar, hosting, the CMS vendor, and any third-party vendors operating parts of the web presence, a scenario Reuters surfaced in the Cummins statement about a third-party vendor’s site.
Strong User Authentication For Privileged Accounts
Under “3.5 Use Strong User Authentication,” BC.5.1 says organizations should implement two-factor authentication wherever possible, document instances where they make the business decision not to do so, and require two-factor authentication for important accounts such as financial accounts, system administrators, cloud administration, privileged users, and senior executives.
BC.5.2 adds a specific operational point: organizations should only enforce password changes on suspicion or evidence of compromise.
This matters because agentic workflows are built to keep trying paths until something works. Anywhere your website administration or cloud administration relies on password-only access, you are relying on the same thin control across many hours of automated probing.
Backups Designed For Recovery
Under “3.7 Backup and Encrypt Data,” BC.7.1 says organizations should consider storing backups offline at a secure offsite location or provide a rationale for not doing so. BC.7.2 says long term backups (for example weekly backups) must be stored offline, while frequent backups (for example daily backups) may be stored online.
NorForge’s example of a webshell goal makes this concrete. When persistence is part of the attempted end state, restoration becomes a business continuity issue, not a technical preference.
Basic Perimeter Defences And Remote Access
Under “3.9 Establish Basic Perimeter Defences,” the baseline includes dedicated firewalls at the boundaries between corporate networks and the Internet, a DNS firewall solution, and for remote access it calls for a VPN using two-factor authentication. It also includes Wi-Fi guidance (WPA2, preferably WPA2-Enterprise), separation of guest Wi-Fi from internal resources, and mentions DMARC to reduce the risk of phishing.
Cloud And Outsourced IT Accounts
Under “3.10 Secure Cloud and Outsourced IT Services,” BC.10.5 says organizations should ensure administrative accounts for cloud services use two-factor authentication and differ from internal administrator accounts.
This is where many SMB web and SEO setups drift into risk. A single shared admin identity across internal staff and external partners can turn a contained website issue into broader access if credentials are reused across environments.
Secure Websites As A Contract Requirement
Under “3.11 Secure Websites,” the baseline says organizations should ensure that sensitive information handled by their websites is secure by following the Level 1 guidelines of Open Web Application Security Project (OWASP) Application Security Verification Standard (ASVS). It summarizes this as BC.11.1 (websites meet the OWASP ASVS Level 1 guidelines) and BC.11.2 (understand the ASVS level needed for each website).
For any SMB using an external partner for all-in-one digital execution, this is a practical procurement hook. The guidance explicitly connects meeting ASVS to outsourced websites as a contractual requirement. A clear standard does two things: it raises the floor for routine work, and it limits “we thought the other party handled it” failures when something goes wrong.
Access Control And Least Privilege
Under “3.12 Implement Access Control and Authorization,” the baseline includes BC.12.1 (minimum functionality and restricting administrator privileges), BC.12.2 (administrator accounts only for administrative activities), BC.12.3 (removing accounts or functionality when no longer required), and BC.12.4 (consider a centralized authorization control system or provide a rationale).
NorForge’s description of establishing persistent access makes this control set especially relevant. When a foothold is achieved, smaller permission boundaries reduce what a compromise can touch, including marketing tooling, publishing workflows, and connected third-party services.
Agentic cybersecurity threats change the economics of repeated probing, and the Reuters and NorForge material shows why “small target” is not a defense. The practical response is disciplined basics: an incident plan, two-factor authentication for privileged access, backups that support recovery, and explicit website security standards in vendor agreements.
If you want a second set of eyes on the way your website, content publishing, and lead capture systems are set up across internal staff and vendors, IN-STORE can help you map ownership and tighten the operational gaps as part of ongoing execution. Explore IN-STORE.
Sources: