How AI Agents Turned One Exposed Endpoint into a Server Takeover

An exposed job-submission feature on an Apache Tomcat server running Spring Batch was exploited within 24 hours by attackers using AI-driven agents orchestrated via the Cairn platform. No authentication, zero-days, or new malware were required. Commands were executed through JavaScript using the Nashorn engine, with results exfiltrated in 1,800-byte chunks across hundreds of requests. The attackers recovered plaintext database credentials from configuration files, enabled xp_cmdshell, and escalated privileges to SYSTEM using PrintSpoofer and GodPotato tools. They extracted registry hives, created administrator accounts, and deleted artifacts to cover their tracks. The attack demonstrated machine-driven execution through rapid command timing, programmatic job naming, and automated error handling.

The attackers achieved full SYSTEM-level access on the compromised server, enabling them to extract sensitive data such as database credentials and registry hives, create unauthorized administrator accounts, and delete forensic artifacts. This level of access allows complete control over the affected system and potential lateral movement within the network. The exploitation required no zero-day vulnerabilities or malware, relying instead on an exposed unauthenticated endpoint and automated AI-driven attack orchestration.

No official patch or vendor advisory is provided for this specific attack. Mitigation should focus on securing exposed endpoints, especially job-submission features, by enforcing authentication and access controls. Monitoring and restricting the use of scripting engines like Nashorn and disabling unnecessary features such as xp_cmdshell can reduce attack surface. Since this attack leveraged known privilege escalation tools, applying security best practices to limit privilege escalation opportunities is recommended. Review and harden Spring Batch and Apache Tomcat configurations to prevent unauthorized job submissions.