An attacker who issued concise instructions in Chinese used Carin, an open-source AI agent platform, to direct automated agents in intrusion attempts against over 1,200 websites belonging to more than 100 companies by October 18, 2026, Reuters reports.
Tooling: Carin and automated agents
The campaigns relied on Carin, a popular open-source framework that enables AI-driven problem-solving agents. Carin is known in some attacker communities as a convenient way to orchestrate multi-step automated operations, including reconnaissance and exploitation.
Discovery by NorForge researcher
Snorre Fagerland, lead researcher at NorForge cybersecurity firm, noticed the activity while investigating a Carin instance that had been accidentally exposed. Fagerland observed multiple attackers using the platform, and identified a particularly prolific Chinese-language operator.
Targets and tactics
The attacker targeted businesses in the United States, Canada and Australia, as well as e-commerce sites in Japan. According to the researcher, the actor used fewer than 100 Chinese characters to control the AI agents, which then performed structured actions: they enumerated digital records tied to the target infrastructure, discovered a publicly accessible control panel, identified a vulnerability and used it to run malicious commands. The behavior indicates the agents were following purposeful sequences rather than “spray-and-pray” attempts.
Impact and examples
By October 18, 2026 the agents had attempted intrusions on more than 1,200 websites. The consequences varied by target: SharkNinja stated the attacker only reached its support page, while other incidents were more serious — one attacker exfiltrated bank card data, and another attempted to withdraw funds from a cryptocurrency trading site, though reports do not confirm whether the crypto-related attempt succeeded.
Expert observations and broader implications
Fagerland commented that building and operating such solutions is not trivial, yet the attack technique appeared to operate at a level accessible to less sophisticated threat actors because of the automation: with minimal input the AI agents executed complex sequences. The episode highlights how open-source AI agent frameworks can scale and accelerate offensive operations, underscoring the need for defenders to adapt.
Regulatory context
The story also comes amid ongoing policy discussions about AI safety. Firms such as Anthropic have proposed measures to U.S. legislators aimed at improving AI security. This incident illustrates why regulators and security teams are focusing on both technical controls and policy responses to mitigate AI-enabled cyber threats.
