AI agents hack 1,200+ sites as researchers defend LLM-powered robots

Agents are being handed credentials, identities and now credit cards, and on the same day we learn that other people are already using agents to break into over 1,200 websites. I don't think that's a coincidence of timing so much as a preview of how this year ends.

Start with the uncomfortable part. Exposed Cairn control panels revealed attackers running autonomous AI agents against those sites, with confirmed breaches and stolen credentials in the leak. What strikes me is less the scale than the sloppiness: the attackers' own infrastructure was left open to the internet. Offensive automation is clearly cheap enough that people deploy it before they secure it. Defenders should assume this is the baseline now, not the exception.

Meanwhile, the industry is building the plumbing that lets legitimate agents act with real authority. Amazon Web Services published a walkthrough on giving agents a verifiable identity using X.509 public key infrastructure, which is the same certificate machinery that already underpins TLS and enterprise device trust. I find this a sensible, almost boring answer, and I mean that as praise. Agents touching databases and APIs need to prove who they are, and reusing mature cryptography beats inventing something new. By the way, Mastercard's early access to Agent Pay for Machines is the other half of this story. If an agent can authenticate and also pay for digital services on its own, you have the beginnings of a machine economy, and every weakness in identity becomes a weakness in money. Is a stolen agent credential just a stolen card by another name?

The third thread is the one I'd watch most closely as a builder. Researchers warn that hidden trigger words could make LLM-powered robots behave dangerously, much like a backdoor planted in training or fine-tuning, and they've developed a defense. Software agents misbehaving is bad enough, but a robot acting on a poisoned model has physical consequences. The research is early, and I'd treat any single defense as a first step rather than a fix, but it matters because it moves the supply-chain worry from "which model did you download" to "what is hiding inside it."

Not everything today is about risk. The llm-d project has shipped version 1.0, aimed at running LLM inference in production in a cost-efficient, open source way, and that is the kind of unglamorous infrastructure that decides who can afford to deploy at scale. GoTo's 27-billion-parameter open model covering five Indonesian languages extends its Sahabat-AI effort from 2024, and it's a reminder that language coverage is a strategic question, not just a technical one. Tools like Flozic's natural-language agent builder and Fulcra's skill for sharing agent-made apps, by the way, lower the barrier to creating agents even further, which means more agents with more access, built by more people who may never think about identity or poisoning.

So here's what I keep coming back to: the capability side is racing ahead of the trust side. Over the next year, I expect the interesting companies won't be the ones with the cleverest agents, but the ones that can prove what their agents are, who they answer to, and what they're allowed to spend.