One person launches an attack, and a dozen or so AI agents spend hours checking websites, hunting for weaknesses and trying to gain access to servers. This is no longer just something demonstrated in a lab. Researchers have uncovered control panels used by criminals to direct real attacks against online shops and web applications. Some successful breaches have been independently verified. But the main lesson isn’t that “AI has learnt to hack”. It’s that old security mistakes can now be exploited far more persistently, with very little human involvement.

On 19 October 2026, security research company NorForge published its “Inside Cairn” report on exposed AI-agent control panels. Reuters independently checked some of the material and contacted organisations whose infrastructure appeared in the attack records. Together, the findings point to something beyond the automated scanning we’ve seen for years: prolonged operations in which the software decides what to try next based on what it has just discovered.

More than 20 exposed dashboards, over 1,100 attack projects in one cluster

Cairn is a platform that lets AI agents carry out multi-step tasks. You define an objective, a starting point and a set of available tools. The system then plans its next steps in response to earlier results. That technology isn’t inherently criminal. The same approach can be used for legitimate, authorised security testing. In the campaigns examined here, however, operators were using it to try to break into other people’s websites.

WebsiteGarage / Services

Explore our services.

Researchers found more than 20 publicly accessible control panels that they believed were probably connected to malicious activity. The most active cluster contained 14 panels and records of over 1,100 attack projects. Targets were concentrated in e-commerce, payments and other services exposed to the public internet.

A few figures need separating before they turn into a dramatic but misleading headline. 1,100 projects don’t mean 1,100 successful breaches. According to Reuters, the most active operator attempted attacks against more than 1,200 websites, while the records suggested over 100 compromises. Researchers independently verified some outcomes, but not every “objective achieved” status reported by an agent was corroborated from outside.

NorForge estimated a success rate of around 10% for the campaigns it could observe. That’s an approximation based on tasks with differing objectives and definitions of success. It’s not the success rate of every AI agent, and it certainly doesn’t mean that one in ten randomly selected businesses could be taken over.

What were the agents actually doing? Much more than trying passwords

A simple traditional scanner sends a predefined sequence of requests, checks the responses against rules and finishes. The agents observed in this investigation ran through much longer sequences. When an attempt failed, they gathered more information, looked for related systems, changed their approach and tested further possibilities. The process resembled the work of a human penetration tester, except the agents could carry on for hours without fresh instructions from their operator.

In the busiest group, tasks that reached their stated objectives took just under 23 hours on average. NorForge reported roughly 140 recorded findings and intermediate steps per project. This wasn’t a burst of traffic lasting a few seconds. It was a sustained effort to investigate one possibility after another.

One documented case involved a business selling spare parts. After signs of unauthorised activity emerged, researchers checked whether the indicated location really contained a mechanism that allowed files to be uploaded to the server. They confirmed it did. In another case study, they checked whether commands could be executed on a web server. These were findings that supported real compromises, not simply claims made by a model.

That still doesn’t mean customer data was stolen in every case. Reuters could not establish the full extent of any unauthorised data downloads. Some organisations confirmed incidents or remedial action, but the impact varied and wasn’t always known.

The real worry is the cost – and how many attacks can run at once

Investigating multiple websites over many hours used to take people, time and considerable expertise. AI agents don’t magically make an attack successful. They do, however, let one person launch many more attempts at low cost and keep pursuing leads that would previously have seemed hardly worth the effort.

NorForge estimated an average cost of around $5 per task in the busiest cluster, while stressing the considerable uncertainty involved. Reuters cited an estimate of roughly $50 per successful intrusion, also based on cost modelling rather than the operator’s actual bills. Neither figure is a fixed price for “taking over any website”.

The more important trend is that repeated attempts and investigations of additional sites are becoming much cheaper. For administrators, that means an attack can last a long time, proceed in stages and still generate relatively little noise. Watching only for enormous spikes in request volumes won’t be enough.

And the criminals? They left their own dashboards wide open

There’s an almost absurd detail in this investigation. The people automating intrusions into other people’s systems left some of their own control panels publicly accessible. That gave researchers a view of the targets, the agents’ activity logs, the outcomes of their attempts and sometimes even secrets uncovered along the way.

In the exposed data, researchers found hundreds of different credentials. An automated checker confirmed that around 11% of the secrets tested were still valid. That’s not the proportion of successful breaches. It’s evidence of another problem: poorly secured agent tools can expose both their operators’ information and their victims’ secrets.

Similar mistakes were also found in panels apparently associated with legitimate penetration testing. So the warning applies to companies running their own agents too: a tool designed to test security must not turn into a publicly accessible directory of passwords, tokens and audit findings.

What does this mean for WordPress and smaller online shops?

First, don’t jump to the conclusion that “AI has discovered a new vulnerability in every WordPress site”. The report isn’t about a single WordPress vulnerability. It documents campaigns against different applications, servers and technologies, including e-commerce infrastructure. The risks came from specific flaws in configuration, applications, permissions and data handling.

A business website with a contact form, a WooCommerce shop or a custom web application doesn’t become vulnerable simply because it uses a particular platform. It becomes vulnerable when a security flaw allows unauthorised activity and no one fixes it. An AI agent may just find it faster or keep trying for longer.

So sensible protection isn’t about buying another plugin labelled “AI Security”. It’s about getting the fundamentals right, whether AI is involved or not: updates, administrator access, application security, backups, logs and a plan for responding to incidents.

Six things worth checking before someone else finds them

  • 1. Updates and known vulnerabilities. Review WordPress, your theme, plugins, PHP and integrations. Check which components are actually in use and whether their developers still maintain them. Critical vulnerabilities need attention even between scheduled maintenance checks.
  • 2. Admin and API access. Remove unnecessary accounts, restrict administrator privileges, enable multi-factor authentication wherever available and review connections to external systems. Give API tokens and keys particular attention, especially those left behind in older projects.
  • 3. Backups you can actually restore. An off-site backup and a tested restore process matter more than the sheer number of archives. For a shop, you also need to know how many orders and data changes you might lose if you have to restore an earlier version.
  • 4. A WAF and sensible rate limits. Protective rules, restricted admin access and sensible limits on automated requests can block some suspicious traffic. They won’t fix a vulnerability, though, or guarantee you’ll detect a slow, multi-stage attack.
  • 5. Logs and monitoring. Watch for unexpected file changes, new privileged accounts, unusual connections and suspicious requests to sensitive functions. An uptime alert won’t detect an intrusion that leaves the website running normally.
  • 6. An incident response plan. Agree who has access to hosting, DNS, backups and logs, who can disable a suspicious integration, and who decides when the live site can be restored. A crisis is no time to start looking for the server password.

Ongoing maintenance is not the same as recovering from a hack

That’s the difference between maintenance and an emergency repair. If your WordPress site is working normally, the priority is to reduce the risk: manage updates carefully, monitor the site, check backups and respond to critical vulnerabilities. At WebsiteGarage, that’s what WP Care, our ongoing WordPress maintenance and technical support service is for. It isn’t about blindly clicking “Update”. It’s about making sure the site still works properly afterwards.

It’s also important to understand where that service stops. WP Care covers detecting an issue, an initial investigation, containing the threat and restoring from a working backup when that’s the safe option. Full post-incident forensics, extensive malware removal and rebuilding a compromised server are not automatically covered by a standard maintenance subscription. Those jobs require separate work.

If something has already broken, you need a different kind of help. A WordPress admin area that won’t load, conflicts after an update, PHP errors or a broken feature are jobs for WordPress Fix, which focuses on diagnosing and repairing a specific problem. Malicious redirects, unknown administrator accounts, altered files or confirmed malware, on the other hand, call for WordPress Recovery: restoring a website after a security incident.

Online shops also need closer attention to orders, payments, customer sessions and third-party integrations. That’s why WooCommerce maintenance is a separate service, Woo Care, rather than an automatic extra in standard WP Care. If you’re not sure whether you need a repair, incident recovery or ongoing maintenance, tell WebsiteGarage what’s happening. The symptoms and scale of the problem come first. Then we can work out which service makes sense.

What if you think your website has been compromised?

If you suspect a break-in, one of the worst things you can do is start deleting files at random and installing five scanners in succession. You could destroy evidence needed to work out what actually happened. The priorities depend on the incident, but a sensible sequence usually looks like this:

  • Contain the damage. If appropriate, temporarily disable the vulnerable feature or restrict access to the application. For a shop, account for the impact on orders and payments too.
  • Preserve the evidence. Keep relevant logs, backups and records of any changes you’ve discovered before removing them. If personal data may have been exposed, the legal obligations need to be assessed separately.
  • Establish how far the attacker got. Don’t stop at WordPress. Depending on the findings, check accounts, the database, hosting, scheduled tasks, plugins, files and connected services.
  • Close the entry point and remove what was left behind. An update may fix the original vulnerability, but it won’t remove added accounts, backdoors or credentials copied during the intrusion. You may also need to rotate credentials and restore components from a trusted source.
  • Test before returning to normal operations. Check forms, logins, redirects and the most important user journeys. On WooCommerce, also verify checkout, order statuses and payment integrations.

Not every infection calls for a complete rebuild. Equally, not every infection can be dealt with responsibly in half an hour. What needs doing should be based on what was actually compromised, not a blanket promise of “100% clean” after a single scan.

AI didn’t invent most of these weaknesses. It changed how quickly they can be exploited

This investigation didn’t uncover a new universal technique for breaking into any website. The attacks still relied on familiar problems: faulty access controls, unsafe data handling, dangerous functionality and other well-known classes of weaknesses. What’s new is the scale and persistence of the automation. One person can launch many tasks while an agent spends hours looking for further opportunities, even when the first attempt fails.

That doesn’t mean WordPress, or the entire internet, is a lost cause. It does mean it’s time to stop treating website security as a one-off job ticked off on launch day. A website is a live system, with users, data, connections and dependencies. And live systems need maintenance, along with a plan for fixing things when something goes wrong.

Sources and limits of the findings

Information current as of 19 October 2026. Projects visible in the dashboards, objectives reported as achieved by agents, independently verified compromises and proven data loss are different things. They must not be treated as equivalent.