AI Agent Intrusions: The Cairn Campaign Against Online Retailers

Since September 25, a Chinese-speaking operator has used AI agents on Cairn, an open-source orchestration platform, to target about 1,200 online stores. It has breached more than 100 across the US, Canada, Australia, and Japan (Reuters). Victims include Deere, SharkNinja, and a website run by one of Cummins’s vendors. Two teams documented the campaign independently: Breachcache through 75 recovered agent transcripts, and NorForge through more than 20 exposed Cairn control panels.

What happened

NorForge’s most active cluster, AIA0001, is Chinese-speaking, runs 14 panels, and has launched more than 1,100 attack projects against online retailers. A second, English-speaking cluster, AIA0002, ran 10 panels aimed at payment services and crypto. Breachcache describes matching operators it calls Backdoor and Cashout, and both reports record the same agent label, claudecode_deepseek-v4.1-flash, though neither says the two teams saw the same actors.

NorForge and Reuters estimate the campaign cost about $5,000 in tokens, roughly $50 per successful breach, with about 10% of attempts succeeding in under 23 hours on average. The operator’s instructions to the agents ran under 100 characters.

Deere says it took remediation actions and has no indication that sensitive information was accessed. SharkNinja says the breach hit a standalone product-support site and is contained, and Cummins is investigating its vendor’s site. Reuters could not confirm that data was taken, and NorForge also found exposed panels belonging to legitimate red teams.

Breachcache’s transcripts include one full intrusion into an unnamed retailer’s cloud. Over 80 reasoning steps and 9 hours 44 minutes, the agent moved from a leaked environment file and a password reset to the retailer’s internal AI agent platform. On the second day it turned the platform’s flow worker against the cloud account, decrypted 50 parameters including payment gateway keys for 3 processors, and listed 108 storage buckets.

How it could have been caught

The retailer’s flow worker fetched URLs for workflows and wrote the results to storage. A baseline would have flagged its first request to the cloud metadata service, an address that worker had never contacted. Agents that spend most of a day on each target leave hours of new behavior before a breach succeeds, and every step after that request followed from the credential it returned.

What this looks like in Trace

Here is the retailer case traced inside its cloud. Times for the forged request, the metadata read, the instance launch, and root come from Breachcache’s transcript; workload names, process ancestry, and other timings are illustrative.

Network trace. Workload ai-platform/flow-worker, the container the agent turned against its own account.

The parameter decrypts and bucket listing ran from the operators’ infrastructure using the stolen credential. The instance they launched ran inside the account, and its first process chain had no deploy behind it.

Inference. The attacking agents called DeepSeek from the operators’ servers, so their model traffic stayed outside the retailer’s network. The retailer’s own AI platform sent its model calls through the proxy as usual, and none of those calls asked the flow worker to reach the metadata service.

Traceback. At 03:43 the triage agent opens a case and follows the chain:

metadata request → python3 (flow worker) → no workflow change → no deploy → no commit → no author

The chain ends at the flow worker with no change behind it, and that dead end is the finding.

Verdict: an outside intrusion that turned the retailer’s AI workflow worker into a key to its cloud account. The case goes to the retailer’s security team with the metadata request and the worker’s process chain at 03:43 on day 2, 35 minutes before the attacker’s instance launched.

This analysis reconstructs the incident from public reporting and walks through where Trace would have raised the first alert inside the retailer’s cloud. Detection times are illustrative.