More than 100 websites belonging to businesses large and small were hit by a hacking collective over the last couple of weeks, stealing data, credit card numbers, and cryptocurrency. Except the collective wasn’t a group of script kiddies, but just one person and their AI agents, according to Reuters, citing a recent report from cybersecurity firm NorForge.

The report, published Monday, follows an unnamed Chinese-speaking hacker who allegedly outsourced almost all of their attempts to breach the lax cybersecurity of dozens of websites to AI agents—specifically, ones available through Cairn, an open-source AI problem-solving and state-management engine available through GitHub that has become popular among hackers.

Per NorForge’s report, Cairn can coordinate AI agents and give them tasks to identify weaknesses and vulnerabilities in specific systems, and even break into those systems. Given the vibe-hacking nature of the platform, though, many hackers have left their Cairn panels exposed, allowing security researchers not only to identify them but to watch their actions, including the back-and-forth of prompt-and-response between the hackers and the AI model.

One of the exposed operations that NorForge spotted involved the aforementioned Chinese-speaking hacker, who launched an elaborate campaign to hit e-commerce sites across the United States, Canada, Australia, and Japan. The hacking spree started on September 25 and, as of last week, had attempted to hit more than 1,200 sites—though not every attempt resulted in a successful breach. In fact, only about 10% got through, but that’s still a ton of breached sites.

Source link