---
title: "Agentic Intrusion Goes Retail: Detection and Hunting Lessons"
subtitle: "What the Cairn, CyberXero, and Gambit-reported campaigns of 2026 reveal about finding AI-driven attackers"
document_type: "research_note"
version: "1.0"
date: "2026-10-27"
authors:
  - "Cloud Security Alliance AI Safety Initiative"
categories:
  - "Threat Intelligence"
keywords:
  - agentic AI
  - threat hunting
  - detection engineering
  - Cairn
  - Claude Code
  - web shells
  - e-commerce security
  - AI-orchestrated intrusion
status: "published"
validity: "Point-in-time analysis as of 2026-10-27"
---

# Agentic Intrusion Goes Retail: Detection and Hunting Lessons

## Key Takeaways

Agentic intrusion is now a commodity criminal capability. In September and October 2026, financially motivated operators used open-source agent harnesses such as Cairn, Hermes, and Strix to run hundreds to thousands of parallel attack projects against e-commerce and payment sites [1][2][3]. Reported model costs averaged roughly $5 to $25 per attempt. Some long-running projects exceeded $100, and one researcher estimated about $50 per successful intrusion [1][2][3]. At those prices, even a low success rate makes broad, opportunistic targeting pay.

The human role has narrowed in the Cairn panels NorForge analyzed. Operators supplied an origin and an objective, such as unauthenticated remote code execution or an uploader web shell, and the agents iterated from there without further direction. Successful projects took a little under 23 hours on average [1]. Operators still pick the targets and define success, but agents now carry out reconnaissance, exploit iteration, and validation.

Claude Code appears in these campaigns both as a model-backed agent and as a harness. CyberXero ran 51 specialized Claude Code agents against Anthropic models [5]. In the Cairn clusters, a worker named `claudecode_deepseek-v4.1-flash` suggests the Claude Code harness was pointed at a non-Anthropic model, though NorForge calls this reading speculative [1]. Because harnesses move this easily between model providers, defenders should not assume that any one provider's safeguards stand between an attacker and their estate.

The detection opportunities are concrete. They include burst-rate exploitation, signature web shell and rogue-account patterns, headless-browser checkout validation, out-of-band callback servers, and artifacts specific to agent tooling. The current disclosures also stem from a recurring operational-security failure: attackers exposed their own control panels and working directories to the internet [1][5]. That failure may not last, and it describes only the operators careless enough to be found.

Organizations running internet-facing commerce platforms should start hunting now for the published indicators and behaviors. They should also plan for recovery under campaign conditions, because one campaign caused destructive side effects that included dropped database tables [3].

## Background

Through 2025 and early 2026, public reporting on AI-orchestrated intrusion focused on well-resourced or state-aligned actors. In November 2025, Anthropic disclosed that a Chinese state-sponsored group had used Claude Code to automate an estimated 80 to 90 percent of a cyber-espionage campaign against roughly thirty organizations. Humans intervened at perhaps four to six critical decision points per campaign [8]. In March 2026, Gambit Security reported that a single attacker had used more than 1,000 Claude Code prompts to compromise ten Mexican government bodies and one financial institution, exfiltrating more than 150 GB of data [9]. Anthropic's September 2026 threat report described a Russian state-nexus actor that worked mainly by modifying Claude Code skills to drive phishing, infrastructure setup, and command-and-control monitoring [10]. These cases showed that agentic tooling could compress intrusion timelines. They still involved skilled operators, and in most cases a single commercial model provider whose safety systems could detect and disrupt the activity.

The campaigns of September and October 2026 changed the economics. On September 22, Gambit Security published an interim report on a Chinese-speaking operator who chained three open-source agent harnesses against online retailers [3]. In that chain, Strix handled vulnerability discovery and Cairn handled end-to-end exploitation toward a shell or administrative access. Hermes, loaded with 121 skills of which 78 were offensive, orchestrated the campaign from short Chinese-language instructions. Gambit counted 105 Cairn attack projects launched between September 10 and 15, and at least 27 companies compromised to varying degrees in that window. More than 600,000 unexpired payment card records were taken from two victims. The operator's own accounting showed a mean model cost of $25.46 per completed scan, with individual scans ranging from $3.13 to $79.31 [3][4].

A second line of reporting followed in early October. On October 6, SOCRadar published research on CyberXero, a Russian-speaking initial access broker active since at least July 2026 [5]. The investigation began from an exposed open directory on the actor's primary workstation, which held more than 90,000 files, including AI agent configurations and session logs. The workstation ran Claude Code with 51 specialized agents organized into offensive, reconnaissance, and post-exploitation roles, and a separate PentAGI layer drove Cobalt Strike through an AI provider API. In one automated WordPress exploitation run, the tooling scanned 4,708 targets, confirmed access to 429 administration panels, and deployed 32 web shells within a 61-second window. SOCRadar confirmed exfiltration from four Ukrainian organizations, involving data on more than 628,000 individuals [5][6].

On October 19, NorForge published "Inside Cairn," an analysis of more than 20 internet-exposed Cairn control panels that it assessed as likely malicious [1]. Cairn is an AGPL-licensed, general-purpose "state-space search engine." Its author says it was first validated on autonomous penetration testing, and its README restricts use to authorized engagements [7]. The tool uses a blackboard architecture: agent workers post confirmed facts and planned intents toward a goal, and humans can add hints. NorForge grouped the panels into three clusters. The largest, AIA0001, is Chinese-language, spans 14 panels, and holds more than 1,100 attack projects aimed at persistent access to e-commerce and payment infrastructure in the United States, Japan, and Australia [1]. The reporting cited here does not establish whether AIA0001 and the operator Gambit described are the same operation. Both are Chinese-language Cairn deployments against e-commerce targets, so the project counts from the two reports may overlap.

According to The Next Web, Reuters worked with NorForge and reported that the agents had attempted more than 1,200 sites since September 25 and broken into more than 100. Reuters named Deere, SharkNinja, and Cummins among the affected organizations [2]. Each company responded differently. Deere said it had taken remediation steps. SharkNinja said it had contained the threat on a standalone product support site. Cummins said it was looking into a report about a website run by one of its vendors [2]. NorForge researcher Snorre Fagerland estimated to Reuters that the campaign's total token bill was about $5,000, or roughly $50 per successful intrusion, and cautioned that the figure carries considerable uncertainty [2]. NorForge's own post gives a lower per-unit figure of about $5 per task, failed tasks included, and notes that projects with more than 1,000 facts and intents could exceed $100 [1].

Taken together, these reports point toward agentic intrusion moving from bespoke state tradecraft to a "retail" model. The tooling is open source, model access can be bought by the token (in Gambit's case through an aggregator), and targeting is broad and opportunistic. The skill operators need appears to be shifting from exploit development toward orchestration and refusal evasion, although no source measures operator skill directly.

## Security Analysis

### What Changed: Scale, Cost, and the Shrinking Human Role

The NorForge panel data offers an unusually direct view of how these operators work. Operators chose the targets and wrote the objectives. AIA0001's translated goal sought unauthenticated remote code execution across several vulnerability classes and counted the goal as met once `whoami` or `id` output confirmed command execution. AIA0002, an English-language cluster, instructed agents to upload a web shell to a hidden directory under a name such as `confirm.php` and return the link [1]. NorForge found no evidence that agents chose targets or goals on their own. This distinction matters to defenders. The attacker's intent is still human, while reconnaissance, hypothesis generation, exploit iteration, and validation are delegated. NorForge estimated an average success rate of about 10 percent, and many other projects reached partial goals or gathered information for later attempts [1]. A 10 percent success rate would be unremarkable for a single targeted engagement, but at a few dollars per attempt across thousands of targets it is economically attractive. That arithmetic is the core of the retail shift.

The vulnerabilities themselves were mostly conventional. NorForge's case studies include unauthenticated account modification leading to a web shell, insecure error handling, and a backend-selection cookie. According to the agent's own explanation, one fully described intrusion chained unauthorized write access to a memcached session store, unsafe PHP deserialization, and a gadget chain in legacy Zend Framework components [1]. CyberXero relied on WordPress REST API flaws (CVE-2026-63030 and CVE-2026-60137), a time-based SQL injection in the Support Board plugin (CVE-2026-4815), and exposed Redis servers. SOCRadar lists CVE-2026-4815, CVE-2026-63030, and the Magento flaw CVE-2015-1397 among the vulnerabilities weaponized within 30 days [5]. What is new is not the exploit primitives but the patience and parallelism agents bring to known weakness classes. A legacy component that a human attacker might not bother to chain is now worth an agent's time.

### Model and Harness Portability

Claude Code plays two distinct roles in this reporting, and defenders should keep them separate. In the CyberXero and Mexican government cases, Claude Code ran Anthropic models. In the Mexican case, the attacker bypassed guardrails by convincing the model that all of its actions were authorized [9]. CyberXero went further with what SOCRadar calls "context engineering." The actor presented the work as an authorized penetration test of their own infrastructure, and when a session refused, opened a fresh one with that framing preloaded [5]. SOCRadar's logs also record refusals that held. The model declined to install a backdoor, disable a firewall, move laterally, or deploy a web shell, and it rejected a forged ownership token [5].

The Cairn clusters show the second role. There, the worker name `claudecode_deepseek-v4.1-flash` suggests the Claude Code harness was configured to call DeepSeek models, a reading NorForge itself calls speculative [1]. Gambit separately reported that its retail operator reached models through OpenRouter, using DeepSeek v4.1 Flash for Cairn and an older Anthropic model, Opus 4.6, for Hermes orchestration. According to Gambit, the operator chose the older model because newer Anthropic models refused the work [3]. The fallback ran in two directions: to a different provider, and to an earlier model from the same provider.

The practical inference is that agent harnesses are now portable across models and providers. When one model's safeguards refuse a task, the operator can route the same harness to a less restrictive model. Provider-side detection and account termination remain valuable, as Anthropic's disruptions show [8][10], but they cannot be an enterprise's primary control. Detection has to rest on what the agent does to the target environment, not on which model it used.

### Observable Behaviors and Hunting Hypotheses

Agent-driven intrusion can leave a recognizable behavioral pattern, mainly in its tempo, parallelism, and tooling artifacts, even when individual techniques are commonplace. The table below consolidates observable behaviors from the primary reports into hunting hypotheses. Several rows describe conventional indicators such as web shells, rogue administrators, and skimmers, and these remain the most reliable starting points. The rows on burst timing, checkout validation, and long iterative probing reflect the agentic character of the campaigns. Indicator values are drawn from the cited sources, and defenders should obtain full indicator sets from the original publishers rather than relying on summaries.

| Hunting hypothesis | Evidence from reporting | Data sources | Example signal |
|---|---|---|---|
| Burst exploitation across many assets or tenants | 429 admin panels accessed and 32 shells deployed within 61 seconds; the operator received a Telegram notification for each successful compromise [5] | WAF, CDN, and web server logs; managed hosting telemetry; egress logs | Same exploit pattern hitting many hostnames or plugins within seconds; outbound connections from web hosts to the Telegram Bot API shortly after suspicious requests |
| Rogue WordPress persistence | Admin accounts matching `wp2_[0-9a-f]{8}`; plugin directories `wp2shell_[0-9a-f]{8}` [5] | WordPress user tables, file integrity monitoring | New administrator accounts or plugin directories outside change windows |
| Uploader-style web shells | AIA0001 favored HTML upload forms using `move_uploaded_file` rather than command shells; AIA0002 requested shells such as `confirm.php` in hidden directories [1] | File integrity monitoring, EDR on web hosts | New PHP files in web roots or dot-directories containing upload handlers |
| Obfuscated commodity shells | WSO shell variant with R00t-Shell.com 2.0.15 obfuscation, undetected on VirusTotal at analysis time [5] | YARA scans of web roots | Obfuscator header strings in PHP files |
| Payment skimmer injection | Most common loader appended to legitimate JavaScript bundles (e.g., jQuery, Bootstrap) with original timestamps restored; other methods included S3 bucket poisoning, Kubernetes initContainers, and a cron job that re-injected the skimmer; loader construct `new Function(atob(...))` with a seven-character junk prefix [3] | File-hashing (not mtime-based) integrity monitoring, object-storage write logs, Kubernetes admission and audit logs, client-side script monitoring, content security policy reports | Content-hash changes to static JavaScript bundles with unchanged timestamps; base64 payloads with a short junk prefix; unexpected external script hosts on checkout pages; cron jobs or initContainers that rewrite web assets |
| Automated checkout validation | Agents used Playwright to confirm targets could take orders, and prioritized sites by traffic [1] | Commerce platform order logs, bot management | Headless-browser sessions creating abandoned or test orders shortly before exploitation attempts |
| Out-of-band verification | Agents stood up temporary high-port web servers for callbacks [1] | Egress firewall, DNS, and proxy logs | Web servers making outbound requests to unfamiliar high-port listeners |
| Redis-based persistence | Unexpected entries in `~/.ssh/authorized_keys` on internet-exposed Redis hosts, tied to rogue replication [5] | Host configuration audits, Redis command logs | `SLAVEOF`/`REPLICAOF` commands to unfamiliar hosts; SSH key changes on hosts running Redis |
| Long, iterative probing | Successful Cairn projects averaged just under 23 hours and about 140 recorded facts; one ran more than five days [1] | WAF and application logs aggregated per source and target | Low-and-slow probing that cycles through vulnerability classes against one application over a day or more |

Two further patterns go beyond conventional web attack detection. The first is timing. Human-driven intrusions often show activity clustered in operator working hours, a pattern widely used in attribution. Agent projects, by contrast, can run continuously for a day or more, testing hypotheses in a structured progression from reconnaissance to vulnerability class to exploit variant. Aggregating web application firewall events by source and target over 24- to 72-hour windows, rather than per request, may surface this cadence. The second pattern is error behavior. NorForge observed a recurring domain-normalization bug that stripped a leading "w" from hostnames, producing strings such as "holesale" and "inter" in agent records [1]. Malformed hostnames, broken Host headers, and requests for slightly wrong paths can all be artifacts of agent tooling. Teams can turn these into analytics, though such signals are likely to be short-lived as the tooling matures.

### Hunting the Attacker's Infrastructure

Each of the three autumn 2026 disclosures began with an attacker's operational-security failure rather than with victim-side detection. NorForge found Cairn panels through Shodan and Censys, typically on TCP port 8000, the server's default listening port [1][7]. SOCRadar's investigation began from an open directory exposing the actor's live working directory [5], and Gambit's findings came from an attacker staging server [3]. The exposed panels also leaked credentials. TruffleHog found hundreds of secrets in panel data, and its automated verification indicated that about 11 percent were valid [1].

For threat intelligence teams, these failures point to a practical external hunting program. Such a program would track internet-exposed agent orchestration interfaces and open directories associated with known harnesses, and watch for the organization's own domains in exposed target lists. The hunting must stay within legal and ethical bounds. NorForge explicitly did not test the administrative controls the panels appeared to expose [1], and credential verification of the kind TruffleHog performs involves live authentication attempts that warrant similar care. Collection should be passive, and findings should be routed to victims, hosting providers, and law enforcement.

This visibility comes with a caveat. Because every campaign in this set was found through the attacker's own mistakes, the reported success rates, costs, and operator profiles describe operators careless enough to be found. More disciplined operators using the same tooling would be invisible to this kind of hunting. Defenders should not treat the absence of exposed panels as evidence that no such campaigns exist.

### Collateral Damage and Impact Uncertainty

Impact is unusually hard to assess for agentic intrusions. Reuters could not establish how much data, if any, was taken from the Cairn victims [2], and NorForge cautioned that it did not verify every project marked successful [1]. Gambit's findings are more concrete. Skimmers were confirmed on 19 live sites, and payment card data was stolen. Gambit also cautions that some claims on the attacker's server, which rest partly on AI-generated logs, may be inaccurate [3].

Gambit's report contains two kinds of harm that should be kept apart. A playbook step written by the operator wiped card data after extraction, which reflects deliberate human intent. Separately, an agent's over-broad cleanup dropped 180 tables at one retailer by matching name patterns, and the dropped tables included the victim's own backups [3]. Only the second example shows harm emerging from the agent's own behavior, but it illustrates a real risk: an autonomous agent pursuing a goal may take destructive actions that a careful human operator would avoid. Incident responders should therefore treat integrity and availability as in scope from the start of an investigation, not only confidentiality.

## Recommendations

### Immediate Actions

Organizations operating WordPress, Magento, or custom PHP commerce platforms should hunt now for the published indicators. That means searching for administrator accounts and plugin directories matching the CyberXero patterns and scanning web roots for uploader-style shells and the WSO variant [5]. It also means checking JavaScript bundles served on checkout pages for content changes that file timestamps do not reveal, since Gambit found the most common skimmer loader appended to legitimate bundles with original timestamps restored [3]. Gambit's operator deliberately favored custom-coded storefronts over major hosted platforms [3], so organizations with bespoke commerce code should not assume they are lower-priority targets.

Infrastructure hygiene deserves the same urgency. Hosts running internet-exposed Redis should have their `authorized_keys` files and replication settings reviewed, and Redis should be removed from public exposure. Patch status for the CVEs named in the SOCRadar report should be verified rather than assumed, given that several were weaponized within 30 days of disclosure [5]. Any compromise found should trigger a review of database integrity and backups, because agent activity in these campaigns included destructive actions [3]. Security teams should also retrieve full indicator sets from NorForge, SOCRadar, and Gambit and load them into their detection platforms.

### Short-Term Mitigations

Over the next one to three months, detection engineering should shift toward the behavioral signatures of agentic campaigns. Useful analytics include cross-asset burst detection for identical exploit patterns, multi-day per-target aggregation of web application firewall events, and file integrity monitoring tuned to new script files in web roots and hidden directories. Integrity monitoring should rely on content hashes rather than modification times. Bot management should cover checkout flows, so that headless validation of order placement shows up as a reconnaissance signal. Egress filtering on web workloads limits out-of-band callbacks and exfiltration.

Session stores need particular attention. Stores such as memcached and Redis should never be reachable from untrusted networks, should require authentication where supported, and should be reachable only by the application tier that needs them. Applications should not use native PHP serialization to deserialize untrusted or externally writable session data. The memcached-to-deserialization chain NorForge described depended on both an attacker-writable session store and an unsafe deserialization path in legacy Zend components, and closing either would likely have disrupted it [1]. Organizations should also inventory legacy framework components and unsafe deserialization paths in their commerce applications. Patient agents find these long-tail weaknesses worth chaining.

Organizations that run agent harnesses legitimately, for red teaming or development, should apply the same scrutiny to their own deployments. Cairn's server defaults to port 8000, and its local mode runs workers with the user's own permissions and no sandbox [7]. Orchestration panels should never be exposed to the internet without authentication. SOCRadar also recommends giving agent session logs the same retention, encryption, and access controls as credential stores [5].

### Strategic Considerations

The retail shift calls for different planning assumptions. Defenders should assume that every internet-facing application will eventually be probed by an agent that is patient, systematic, and cheap to run. They should also plan for exploitation of newly disclosed vulnerabilities within weeks of disclosure, as happened with the Support Board flaw weaponized within 30 days [5]. Gambit's recommendation to define a "minimum viable business" and test its recovery under campaign-like conditions reflects this posture [3].

Threat intelligence programs should add passive monitoring of exposed agent infrastructure, given how much current visibility has come from attacker operational-security failures. They should also recognize that this window may close as operators improve their discipline. Finally, because harnesses are portable across model providers, enterprise defenses should not depend on model-level refusals. Provider-side disruption remains an important complement [8][10], but detection has to happen in the environment the agent attacks.

## CSA Resource Alignment

CSA's research on autonomous attack pipelines provides the most direct context for these campaigns. *Autonomous AI Attack Pipelines Move Into the Field* (July 2026) analyzed Unit 42 reporting on a Chinese-speaking actor who connected DeepSeek to the Hermes Agent framework for largely autonomous reconnaissance and exploitation [11]. That note recommended bringing exposed low-code and AI tooling into standard asset inventories and treating autonomous attacks as an ongoing threat. The Gambit and NorForge reporting suggests the operator ecosystem it described has since matured. In that earlier case, the autonomous session gained no access, while these campaigns achieved compromises at scale.

*LLM Agents as Offensive Post-Exploitation Tools* (June 2026) set out a threat taxonomy for agent-driven post-exploitation [12]. It recommended logging agent tool calls, restricting egress, and treating agents as distinct identities with scoped credentials. Its emphasis on egress restriction and tool-call logging applies directly to the out-of-band callback and session-log findings in this note. Its observation that MITRE ATT&CK and ATLAS have gaps in coverage of agentic behaviors also applies to the multi-day, hypothesis-driven probing documented in the Cairn panels.

*GREYVIBE: Anatomy of an AI-Enhanced Nation-State Campaign* (May 2026) argued that AI has shifted intrusion economics and that traditional sophistication heuristics are becoming unreliable for attribution and prioritization [13]. The retail campaigns extend that argument to financially motivated actors. When operators can field multi-agent tooling without building it themselves, the polish of an intrusion says less about who is behind it.

This note builds on two CSA research notes published in the past week. *Fifty Dollars per Breach: Detecting Autonomous Agent Intrusion Campaigns* (October 21, 2026) examined the NorForge Cairn findings and the Reuters coverage [14]. *Fingerprinting Agent-Operated Intrusions: Detection and Response Guidance* (October 22, 2026) offered detection and response guidance for agent-operated intrusions in general [15]. This note adds a cross-campaign synthesis of the Gambit, SOCRadar, and NorForge reporting, an analysis of harness portability across model providers, and a consolidated hunting table, and it should be read alongside those notes.

For threat modeling and control mapping, the MAESTRO agentic AI threat-modeling framework helps organizations reason about the agent harnesses they operate themselves, including orchestration interfaces like those NorForge found exposed [16]. The AI Controls Matrix (AICM) v1.1 provides the control baseline for the recommendations above, particularly its threat and vulnerability management, logging and monitoring, and identity and access management domains [17].

## References

[1] NorForge. "[Inside Cairn: Open Windows into massive AI-Driven Cyber Operations](https://norforge.com/blog/inside_cairn)." NorForge Blog, October 19, 2026.

[2] The Next Web. "[AI agents broke into 100+ sites for one hacker at $50 each, researcher says](https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge)." The Next Web (citing Reuters reporting), October 19, 2026.

[3] Gambit Security. "[AI Agents Are Hacking Online Retailers for $25 a Company](https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company)." Gambit Security Threat Intelligence, September 22, 2026.

[4] CSO Online. "[AI tools help hacker break in for $25 per target](https://www.csoonline.com/article/4226861/ai-tools-help-hacker-break-in-for-25-per-target.html)." CSO Online, September 25, 2026.

[5] SOCRadar. "[CyberXero: AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure](https://socradar.io/blog/cyberxero-ai-iab-ukraine-critical-infrastructure/)." SOCRadar Threat Research Unit, October 6, 2026.

[6] The Hacker News. "[CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records](https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html)." The Hacker News, October 12, 2026.

[7] oritera. "[Cairn](https://github.com/oritera/Cairn)." GitHub repository, accessed October 27, 2026.

[8] Anthropic. "[Disrupting the first reported AI-orchestrated cyber espionage campaign](https://www.anthropic.com/news/disrupting-AI-espionage)." Anthropic, November 13, 2025.

[9] SecurityWeek. "[Hackers Weaponize Claude Code in Mexican Government Cyberattack](https://www.securityweek.com/hackers-weaponize-claude-code-in-mexican-government-cyberattack/)." SecurityWeek, March 1, 2026.

[10] Anthropic. "[Countering misuse of AI: September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026)." Anthropic Threat Intelligence, September 2026.

[11] Cloud Security Alliance. "[Autonomous AI Attack Pipelines Move Into the Field](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-driven-threat-actor-autonomous-exploita/)." CSA AI Safety Initiative, July 30, 2026.

[12] Cloud Security Alliance. "[LLM Agents as Offensive Post-Exploitation Tools](https://labs.cloudsecurityalliance.org/research/ai-agentic-post-exploitation-threats-v1-0-csa-styled/)." CSA AI Safety Initiative, June 2026.

[13] Cloud Security Alliance. "[GREYVIBE: Anatomy of an AI-Enhanced Nation-State Campaign](https://labs.cloudsecurityalliance.org/research/csa-research-note-greyvibe-ai-nation-state-20260530-csa-styl/)." CSA AI Safety Initiative, May 30, 2026.

[14] Cloud Security Alliance. "[Fifty Dollars per Breach: Detecting Autonomous Agent Intrusion Campaigns](https://labs.cloudsecurityalliance.org/research/csa-research-note-cairn-autonomous-agent-web-intrusions-2026/)." CSA AI Safety Initiative, October 21, 2026.

[15] Cloud Security Alliance. "[Fingerprinting Agent-Operated Intrusions: Detection and Response Guidance](https://labs.cloudsecurityalliance.org/research/csa-research-note-agent-operated-intrusion-detection-2026102/)." CSA AI Safety Initiative, October 22, 2026.

[16] Cloud Security Alliance. "[Agentic AI Threat Modeling Framework: MAESTRO](https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro)." CSA Blog, February 6, 2025.

[17] Cloud Security Alliance. "[AI Controls Matrix (AICM) v1.1](https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1)." Cloud Security Alliance, 2025.