The task list behind these AI agent attacks on online stores was written for shops like yours. On October 19, the security firm NorForge published what it found on more than 20 exposed control panels for Cairn, an open-source tool that points teams of AI agents at a goal. One Chinese-language group ran more than 1,100 attack projects across 14 of those panels. Its typical instruction named its targets as “confirmed real shopping/e-commerce websites in four countries (US/CA/JP/AU), with traffic of 200,000–1.5 million.” CA is Canada.
That traffic band is a mid-sized store: big enough to have customers and card flows worth stealing, small enough that nobody is watching the server logs full time. If you sell online, AI agent attacks on online stores are now a line item on your risk list, and the defence is mostly work you already know you should be doing.
What did the agents actually do?
According to NorForge, the group fed in sites that had been ranked by traffic and checked with Playwright, Microsoft’s browser automation framework, to confirm that orders could be placed. The agents were then told to find a way to run code without logging in.
The listed priorities were login SQL injection, unauthenticated endpoints, file uploads, deserialization, authentication bypass and account takeover. The goal was an uploader web shell, a small hidden form that lets the attacker put files on your server later.
NorForge checked one claimed break-in, at a large hardware parts vendor, and found the shell live. The agent’s own notes blamed unauthorized write access to a memcached session store, unsafe PHP deserialization and old Zend Framework code. Tools found on one worker included a lab for testing a Magento flaw. None of this is exotic. It is a list of the usual weak spots, worked through patiently by software that does not get bored. Agents on the buying side are also submitting real web forms, so test what your checkout accepts.
How often did it work, and what did it cost?
NorForge puts the average success rate across the tools it saw at about 10%. Successful projects in the busiest group took a little under 23 hours from start to goal. Its rough cost estimate is about US$5 per task, including the ones that failed or stopped early, and it says the uncertainty is considerable.
Those three numbers are the whole story for a store owner. One attempt in ten lands, each attempt costs about as much as a coffee, and the attacker does not have to be awake for any of it. The economics favour trying every store in the band.
Why does your agency’s tooling matter here?
NorForge also found what looked like legitimate penetration-testing work on the same kind of open panels. Its warning is blunt: having your site tested on an open Cairn instance “is often a serious security issue, regardless of outcome of the test.”
When it ran a secrets scanner over the exposed data, it found hundreds of credentials and API keys, with 11% verified as still valid.
If you hire a firm to test your store, ask where the test runs and who can see the results. A report that sits on an unsecured dashboard is a gift to the next visitor.
Which controls cover most of this?
The Canadian Centre for Cyber Security’s baseline controls for small and medium organizations were written before AI agents, yet they still cover most of this attack. Automatic patching, fixes for common web flaws, two-factor login on admin and cloud accounts, and a written incident plan line up against what the agents went after. The mapping:
The Canadian Centre for Cyber Security’s baseline controls for small and medium organizations were written before AI agents, and they still map well onto the attack described above.
| What the agents went after | Cyber Centre control |
|---|---|
| Known flaws in platform code and plug-ins | BC.2.1: enable automatic patching, or run full patch management |
| Login injection, file uploads, authentication bypass | BC.11.1: address the OWASP top 10 vulnerabilities on your websites |
| Admin panels and account takeover | BC.5.1: two-factor authentication for financial, admin and cloud accounts |
| Hosting and cloud dashboards | BC.10.5: two-factor on cloud admin accounts, separate from internal accounts |
| A shell left in place for weeks | BC.1.2: a written incident plan with names and phone numbers |
Hosted platforms handle the first two rows for their own code. Your theme, custom plug-ins and any self-hosted Magento, WooCommerce or PHP add-ons are still yours. Our PHP2Shell patch plan covers how to find out who can actually push a fix to your site.
What would change our view
NorForge’s figures come from what it could see on open panels, and better-run attackers lock theirs. The real success rate against Canadian stores could be higher or lower. A Cyber Centre advisory or a public victim count for Canada would give a firmer base than one researcher’s snapshot.
Try This Week
Block out about two hours across five days. You need whoever manages your store and your hosting login.
- Monday: List every piece of code on your store that your platform does not patch for you: theme, plug-ins, custom scripts. Note who updates each one.
- Tuesday: Turn on automatic updates wherever they exist. For anything without them, put a monthly update date in a calendar with a name next to it.
- Wednesday: Check that every admin, hosting and payment account has two-factor authentication. Remove logins for former staff and old contractors.
- Thursday: Ask your developer or agency to look for files in upload folders that should not be there, and to confirm the date of the last security test and where its results are stored.
- Friday: Write one page: who to call if the store is breached, how to take it offline, and where the backups are. Print it.
If Thursday turns up an unexpected file, treat it as an incident, not a curiosity. More practical guides are in Practical AI Tips. Fake bots are part of the same attack, and fake AI crawlers are asking for password files.
FAQ
Are AI agent attacks on online stores targeting Canada?
Yes. NorForge’s October 2026 report quotes one attack group’s instructions naming shopping sites in the US, Canada, Japan and Australia with 200,000 to 1.5 million in traffic.
How successful were the AI agent attacks NorForge found?
NorForge estimates an average success rate of about 10% across the tools it observed, with successful break-ins in the busiest group taking a little under 23 hours.
What is the first thing a small online store should do?
Turn on automatic updates for any code your platform does not patch for you, and require two-factor authentication on every admin, hosting and payment account.
