AI Agent Attack Turns One Exposed Endpoint Into a Full Server Takeover in Under 24 Hours
Do Son 
Example Cairn project view, showing how agents record findings and next steps | Image: ReliaQuest
| At a glance | |
| Malware family | None new; public tools GodPotato and PrintSpoofer plus built-in Windows utilities |
| Threat actor | Unknown; no attribution to any group |
| Target | One organization’s Apache Tomcat server running a Spring Batch application |
| Delivery vector | A job-submission endpoint exposed to the internet without a login |
| Key capabilities | In-app code execution, credential theft, SYSTEM escalation, backdoor admin accounts |
| Source | ReliaQuest Threat Spotlight |
TL;DR
ReliaQuest says AI agents ran most of an attack that seized a server in under 24 hours. The attacker used one exposed job feature, no new malware, and no zero-day. A live Cairn agent orchestration panel sat on the same IP address that launched the AI agent attack.
A first for ReliaQuest
ReliaQuest calls this the first incident it has seen where LLM-driven agents did much of the work. In its words, “This went well beyond an attacker consulting an AI assistant.” Commands ran, results came back, and the agents fixed their own mistakes.
The researchers rate this AI agent attack assessment as high confidence. Still, they could not tell how many agents took part or which model drove them. They also could not tell how often a person approved each step.
Delivery
The attacker entered through an Apache Tomcat server. Its Spring Batch application accepted job requests from anyone, with no login. That single misconfiguration carried the whole server takeover.
Before first contact, the attacker had already staged Java exploit material on its own host. Similarly, a commercial vulnerability scanner ran on that host. ReliaQuest believes this setup was built to work through many targets, not just one.
Infection chain
Code running inside the app
The attacker submitted jobs that called Nashorn, the JavaScript engine built into Java. That code ran inside the application and spawned no new process. As a result, process-based detection saw nothing for some time.
To read results, the attacker triggered errors on purpose and read the error messages. Each message held little data, so output came back in fixed 1,800-byte slices across hundreds of requests.
From database to SYSTEM
Next, the attacker found plaintext database credentials in configuration files. Those credentials held SQL Server sysadmin rights. The attacker turned on xp_cmdshell to run operating system commands.
A privilege check then showed SeImpersonatePrivilege. Both PrintSpoofer and GodPotato abuse that right, so the attacker staged both tools in advance. When the first failed, the second delivered SYSTEM access. Afterward, the attacker saved the SAM, SYSTEM, and SECURITY registry hives for offline password cracking. Finally, it created local admin accounts.
Command-and-control and data exfiltration
The job feature served as the command channel. Meanwhile, a separate address pulled job results in bulk. Because of that split, blocking only the attack source would not have stopped data theft.
ReliaQuest mapped three attacker hosts. One ran the Cairn panel, a parallel agent console, and a scanner. Another held the escalation tools, a model proxy, and a rotating proxy pool. A third collected output. Notably, every part was open source or commercial, so ReliaQuest warns the setup “is therefore not a fingerprint for any one group.”
Signs a machine was in charge
Several clues mark this as an AI agent attack rather than a person at a keyboard. About half the gaps between commands lasted five seconds or less. Job names tracked file offsets and part numbers with no gaps. Output used pipe-delimited records and hard row caps, built for a program to parse.
The one-time scripts also carried comments explaining choices that no human would ever read. Moreover, each failed payload got a quick fix aimed at its exact error. According to ReliaQuest, that is “the clearest sign that something was reading the output and acting on it.”
The attacker made little effort to hide. Cleanup came late and left one backdoor account in place.
Who is behind it
Attribution remains open. ReliaQuest has not tied the activity to any named group or country. The AI agent role is an assessment, not a confirmed fact, though ReliaQuest rates it as high confidence.
Defense and detection guidance
ReliaQuest stresses that agent speed calls for controls that work without an analyst awake. Key steps include:
- Require authentication on every exposed job or batch endpoint.
- Keep job history. In this case, it outlasted every file the attacker deleted.
- Remove plaintext database credentials from application configuration files.
- Keep xp_cmdshell disabled and alert when anyone turns it on.
- Strip SeImpersonatePrivilege from service accounts where possible.
- Watch for spikes in script engine errors, which tracked the malicious jobs here.
- Alert on registry hive exports and new local admin accounts.
- Use automated containment, since agents can move faster than human responders.
In short, this AI agent attack used old techniques at machine pace. Defenders should hunt for the behaviors, not for one tool’s signature.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
