AI Agents Breached 100 Websites, Plus 3 Stories
Today’s Brief starts with a change in the economics of hacking. One person didn’t suddenly become a team of brilliant security researchers. They gave autonomous AI agents enough tools, time, and targets to keep working until something broke. That difference matters.
AI agents turned one hacker into a 24-hour attack crew
Security firm NorForge says it found more than 20 exposed control panels for Cairn, an open-source, state-based problem-solving system that can coordinate several AI workers. A human gives Cairn a starting point and a goal. The workers gather facts, post them to a shared “blackboard,” decide what to try next, and continue. In the campaign NorForge studied, that meant scanning ecommerce sites, looking for vulnerable applications or related infrastructure, and trying attack chains until the goal was met.
Reuters independently reviewed the attacker’s activity and identified victims including Deere, SharkNinja, and Cummins. The campaign attempted more than 1,200 sites and reportedly compromised more than 100. A successful intrusion took a little under 23 hours on average. NorForge estimated the whole run consumed roughly $5,000 in AI tokens, although the researchers are explicit that the cost estimate is rough.
This is the part I’d keep: the AI-assisted cyberattack wasn’t a new kind of magic. It combined familiar reconnaissance and exploitation tools with agents that don’t get bored. One example began with a public application that appeared secure. The agents searched for connected infrastructure, found a separate control panel, identified a weakness, and eventually got the server to execute commands. That’s exactly why a forgotten support site or vendor-operated portal can matter as much as the homepage everyone remembers to maintain.
There are important limits to the reporting. NorForge could see attacker dashboards and validated several claimed compromises, but Reuters couldn’t determine how much data, if any, was extracted. Deere said it found no indication that sensitive information was accessed. SharkNinja said the affected site was a standalone support site, and Cummins said a third-party vendor operated the site it was investigating.
For website operators, the response isn’t to buy something with “AI defense” stamped on the box. Inventory every public-facing application, including old admin panels, campaign sites, development hosts, and vendor systems. Patch what must stay, remove what doesn’t, restrict administrative access, and monitor for new files, changed accounts, and unexpected outbound traffic. As I wrote in this week’s Digest, the supposedly secondary system often becomes the path in. Assume the scanner has time, not brilliance.
WordPress security & maintenance
Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.
A grocery cyber incident became an operations outage
Ahold Delhaize said on October 19 that malicious activity led it to take websites, apps, and other systems offline across most of its European and US brands. Stores stayed open, but the effects reached online ordering and distribution. Dutch chain Albert Heijn expected its delivery outage to last at least 11 days. Reuters reported that US brand websites, including Stop & Shop, Giant Food, Hannaford, and Food Lion, had remained offline for about a week.
The company says it has no evidence that customer, employee, or partner data was taken. That’s reassuring, but it doesn’t make the incident small. A security decision can be correct and still be expensive. Taking systems offline may stop an attacker from moving further while also stopping orders, fulfillment, and normal supply flow.
Small businesses should read this as a continuity problem, not only a breach problem. Trace one ordinary order from the website through payment, inventory, picking, customer notice, and refund. Which steps can continue if the main system is unavailable? Who has the current customer and product information? How long can the manual process operate before it becomes its own mess? Backups matter, but a backup doesn’t answer any of those questions by itself.
Business IT goes well beyond the website
Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.
Safari blocks email-based identity tracking
Apple’s WebKit team has explained a privacy change already shipping in iOS, iPadOS, macOS, and visionOS 27. Safari now blocks network access to “identity resolution” services. These services can receive an email address when someone logs in or joins a newsletter, turn it into a durable identifier, and use that identifier to connect activity across websites and devices.
The identifier may look anonymous, but the resolver still has the email address that ties the pieces together. Logging out or unsubscribing doesn’t necessarily remove it. WebKit’s block works at the domain level, so changing a request path isn’t supposed to bypass it. Apple says first-party personalization, such as a store remembering a signed-in customer’s preferences, isn’t the target.
For Safari users, there’s nothing special to configure beyond keeping devices updated. For publishers and small-business marketers, the practical change is less comfortable: some cross-site audience matching and attribution will stop working. Test the reports you use, expect gaps, and put more weight on consented first-party data and outcomes you can actually verify. Trying to disguise the tracker until Safari misses it would be a poor privacy strategy and, frankly, a tedious product roadmap.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
Older adults reported $3 billion in fraud losses
The FTC’s new report on fraud affecting people 60 and older says reported losses rose from about $600 million in 2020 to roughly $3 billion in 2025. Investment-scam losses exceeded $1 billion, up 42% in one year, and victims often said the first contact came through social media. People 80 and older reported a median individual loss of $2,000.
The agency also estimates that unreported losses could put the real total somewhere between $13.3 billion and $119.5 billion. That range is so wide that it shouldn’t be repeated as a precise measurement. The solid conclusion is simpler: the reports capture only part of the harm, and a relatively small number of very large losses are driving the increase.
The most useful protection is procedural. Families can agree now that no one sends money, buys cryptocurrency, or grants remote access because of an unexpected call, message, or social-media contact without pausing and checking with another person. Use a phone number you already trust, not the one in the message. Businesses and financial institutions should make that second check easy and respectful. A verification step is a control, not an accusation.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- NorForge: Inside Cairn, an investigation of AI-driven cyber operations
- Reuters: How one hacker used AI agents to breach scores of sites
- Ahold Delhaize: October 19 cybersecurity incident update
- Reuters: Ahold Delhaize reports incident and extended outages
- WebKit: Blocking Identity Resolution Infrastructure
- FTC: Annual report on protecting older adults
- FTC: Protecting Older Consumers 2025–2026 report
Photo by Chris Ried on Unsplash.
