Hackers issued commands in Chinese, suspected of breaching over a hundred e-commerce websites with the help of DeepSeek, only to find their own backend was also left unlocked.

Beating AI News Flash: A hacker using Chinese commands handed almost the entire intrusion process over to AI. Starting September 25, the system launched successive attacks on e-commerce sites in the United States, Japan, Australia, and other countries, making more than 1,200 attempts in total, with attack records showing that over 100 websites were breached. A Reuters verification found that affected companies include U.S. agricultural machinery giant John Deere and well-known home appliance brand SharkNinja, among others.

The hacker first used automated browsers to screen e-commerce sites that could process orders normally and had a certain amount of traffic, then handed the targets to the open-source AI framework Cairn. It can dispatch multiple Agents simultaneously, continuously seeking ways to reach the target and placing discovered clues on a shared record board so that subsequent tasks can continue advancing. The hacker only needed to use fewer than 100 Chinese characters to specify the attack target and methods, and the AI would scan and test vulnerabilities on its own, then switch to another path and keep trying after failure.

On one occasion, when the AI could not find a vulnerability on a large company's public website, it followed network records to trace associated servers and unexpectedly discovered an externally exposed management panel. It then spent several hours studying how the panel processed data, and after repeated attempts, finally reported that it had successfully made the server execute malicious commands. The security firm NorForge also personally verified on another vendor's website the web backdoor left by the AI, confirming that these attacks were not merely claimed as successful in logs.

Researchers found that the executor of the attack tasks was named `claudecode_deepseek-v4.1-flash`, and inferred that the hacker invoked DeepSeek V4.1 Flash through Claude Code. The overall task success rate of the operation is estimated at about 10%, with successful intrusions taking less than 23 hours on average. Based on the scale of the tasks and model pricing, the total model invocation cost was about $5,000, averaging only about $50 to breach one website.

More ironically, the hacker's own Cairn control backend had not been properly protected against access. NorForge found 14 backends suspected of belonging to the same Chinese-speaking attack cluster, allowing it to view the commands issued by the hacker, the AI's execution records, and some attack results. Researchers also found other attackers using Cairn, some specifically targeting credit cards and cryptocurrency.