AI Agents Hacking Websites: What Cairn Means for Your App
Two security firms described AI agents used against online stores in 2026. This page covers what they reported and six checks for a site or app you built with AI.
Founder, Newly
Published Last updated
Cairn is an AI agent platform that the security firm Norforge saw attackers directing at online stores in 2026. The reports describe agents that scan a site, try known weakness types and keep access, usually in under a day. The defenses are the old ones. Ordinary gaps in input handling, uploads, keys and recovery matter more, because they now get tried at scale.
What is Cairn?
Norforge describes Cairn as a state-based problem solving engine: you give it a starting point and a goal, and agents work through cycles of finding things and planning the next step. The same tool can serve a legitimate red team or an attacker. Norforge could study it because operators left the control panels of their Cairn installations open to the internet. It counted 25 panels, which showed how operators picked targets and what they got.
Gambit Security had reported in September on an operator who used Cairn alongside two other AI tools against online retailers. SecurityWeek summarised the October findings and, citing Reuters, put the number of affected organizations above 100. We could not open the Reuters report, so treat that count as second-hand.
Key facts at a glance
| Fact | What the source says | Source and date |
|---|---|---|
| Exposed panels | 25 exposed Cairn panels in three actor clusters | Norforge, October 19 |
| Largest cluster | 1,100+ attack projects across 14 panels; average project under 23 hours | Norforge, October 19 |
| Targets | E-commerce and payment infrastructure, mostly in the US, Japan and Australia | Norforge, October 19 |
| Stolen secrets | Hundreds seen, 11% verified as still valid | Norforge, October 19 |
| Retail campaign | At least 27 companies compromised; access usually in under a day; mean cost of $25.46 per scan | Gambit Security, September 22 |
Dates and limits
Sources checked on October 24, 2026. Both firms describe operators who ran agents against targets they chose. The reports name victims and indicators that this page leaves out on purpose.
What did the reports find, and what do they mean for a small site?
Norforge lists the weakness types its panels showed: SQL injection, unauthenticated code execution, file uploads that turn into web shells, server-side request forgery and authentication bypass. All of them are old categories with published fixes. Gambit added that the operator went after shops with custom code, which it assumed were more likely to be vulnerable than shops on major hosted or open source platforms. It then used cloud keys it found to reach more. In several cases it injected card-stealing scripts into checkout pages.
Two points matter for a builder. First, the cost per target was low, which makes small sites worth the effort. Second, Gambit warned that the operator's own cleanup routine destroyed some victims' data. A break-in can end in lost data even when nobody wanted it. Norforge makes a related point in a separate October post: fixing a framework default removes many findings at once, and patching speed matters more when agents find flaws in hours.
What should I check in my own app or site?
Newly builds a real iPhone and Android app with React Native and Expo, and you can download the code or connect your own repository. The code, its database rules and its keys are then yours to read. The table lists where each weakness type from the reports shows up in an app like that and what each finding means.
| Weakness in the reports | What to look for | What a finding means |
|---|---|---|
| SQL injection | Server code that builds query text by joining in user input. OWASP names parameterized queries as the primary defense. | Detected. Change each place to pass input as a parameter and give the database account only the rights it needs. |
| File upload to web shell | An upload feature with no type allowlist, stored where the server can run it, using the visitor's file name. See the OWASP upload guidance. | Detected. Allow only needed types, store files outside the code folder, generate the name. |
| Authentication bypass | An endpoint that returns another account's data when called with a second test account. Missing or open row level security on a table. | Detected. Add the server-side check or the policy, then retest with both accounts. |
| Stolen cloud and API keys | A secret in an EXPO_PUBLIC_ variable, which Expo says is visible in plain text in the compiled app, or a key with broader rights than its job. | Detected. Rotate it, move it to the server, and use restricted keys where the provider offers them. |
The Norforge figure of 11% valid secrets is a reminder that keys are reused far longer than people expect. The OWASP secrets management guidance asks for rotation, least privilege and monitoring for misuse. If you find a key where it should not be, work through our guide to a leaked AI service key and the rotation order for app teams.
What about checkout pages and getting data back?
Gambit reported card-stealing scripts added to existing JavaScript files, to checkout pages and to tag manager blocks. Two browser features reduce that risk. A Content Security Policy limits where scripts may load from, and MDN suggests trying it first in report-only mode. Subresource Integrity makes the browser reject a third-party file whose content changed, though it cannot cover scripts that change on purpose.
If you take card payments through a provider's hosted payment page, the card number never touches your own pages, which narrows what a planted script can reach. Check your provider's documentation for how your integration works.
Gambit's own advice was resilience: decide which systems the business cannot run without, keep backups the application cannot overwrite, and rehearse a restore. The 15-minute check for AI-built apps covers the first pass, and the pre-launch review goes deeper. For stores and sites, red.run.cloud has an October 2026 incident roundup for ecommerce stores and a website incident response playbook.
Where do you stand?
Everything starts as unknown, which is what an unchecked item is. Move an item to confirmed only when you hold the evidence listed under it. Also read our security hub for the other incidents this month.
Your agent-attack check
- Detected: You found the problem.
- Unknown: Not checked yet, or the check could not tell.
- Confirmed by owner evidence: You checked and kept the proof.
Your answers stay in this browser tab. Nothing is saved or sent.
Frequently asked questions
Can an AI agent hack my app on its own?
Reports from October 2026 show people directing agents at targets, with the agents doing the scanning, trying and note keeping. The reports describe human operators choosing targets and goals. What the agents try are known weakness types, so the checks on this page apply whoever or whatever is on the other end.
Does a mobile app built with React Native and Expo face this?
The app on the phone is not the main target in these reports. The reports describe online stores and the servers, databases and cloud keys behind them. If your app talks to a backend or you run a web store beside it, the checks on this page apply to those parts.
Is a hosted store builder less exposed than custom code?
Gambit Security reported that the operator filtered out shops on major hosted or open source commerce platforms and kept shops with custom code. That is one campaign in one report and it does not show any platform is out of reach. If you wrote or generated your own server code, you own its input handling, uploads and keys.
What should I do first if I find a leaked key?
Rotate it, then read the provider's request log for use you do not recognise. Deleting the key from the code leaves it in builds already shipped and in repository history. The guide linked in the self-test section walks through the order.
Will a scan tell me whether I am affected?
A scan from outside can show what your site serves and match versions to known vulnerabilities. It cannot see code paths that never answer a public request, and a version match is a lookup, not proof of exposure. Treat what it cannot see as unknown until you hold owner evidence.
How likely is it that I am a target?
No source gives odds for a single small site. Gambit Security described an operator who spent about 25 dollars per target, which makes small sites worth trying. Assume your site is reachable and work through the checks.
Sources
- AI platform Cairn abused to hack over 100 organizations, SecurityWeek, October 20, 2026
- Inside Cairn: Open Windows into Massive AI-Driven Cyber Operations, Norforge, October 19, 2026
- Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target, Gambit Security, September 22, 2026
- AI hackbots found another hundred vulnerabilities. Who fixes them?, Norforge, October 12, 2026
- SQL Injection Prevention Cheat Sheet, OWASP Cheat Sheet Series
- File Upload Cheat Sheet, OWASP Cheat Sheet Series
- Secrets Management Cheat Sheet, OWASP Cheat Sheet Series
- Environment variables in Expo, Expo docs
- Row Level Security, Supabase docs
- Best practices for managing secret API keys, Stripe docs
- Content Security Policy (CSP) implementation, MDN Web Docs
- Subresource Integrity, MDN Web Docs