Short answer: A single Chinese-speaking hacker used largely autonomous AI agents running on an open-source platform called Cairn to break into the websites of more than 100 companies, including John Deere, SharkNinja and Cummins. The attacker typed fewer than 100 Chinese characters of instruction, and the agents attempted more than 1,200 breaches at an estimated cost of about $5,000 in AI tokens, roughly $50 per successful break-in. The campaign was discovered by AI security firm NorForge, which found the operation through exposed Cairn control panels, and was first reported by Reuters on October 19, 2026.
What happened
NorForge, an AI security company, published a report shared with Reuters on October 19, 2026, describing one of the clearest real-world demonstrations yet of AI agents being used as the primary workforce in a cyberattack campaign. A single operator used the open-source platform Cairn to coordinate fleets of AI agents that probed websites, hunted for weaknesses and attempted intrusions with minimal human steering.
The scale was striking. NorForge says the agents tried to breach more than 1,200 websites, mostly online shops in the United States, Canada, Australia and Japan, starting around September 25, 2026. Reuters independently examined the hacker activity and identified victims including farm equipment maker Deere (John Deere), appliance company SharkNinja and engine manufacturer Cummins. In total, more than 100 websites were compromised.
NorForge principal threat researcher Snorre Fagerland began finding the exposed Cairn instances around October 2 by scanning the internet for deployments of the platform that could be viewed from outside. He found more than 20 such panels that NorForge believes were used maliciously. Because the control panels were exposed, they laid bare the targets, the tactics and even the stolen credentials. A Trufflehog scan of the panels turned up hundreds of secrets, of which 11 percent were verified as valid.
How the Cairn AI agents worked
Cairn describes itself as a general-purpose problem-solving engine. A user gives its agents a starting point and a desired endpoint, and the agents work through the task step by step, documenting their progress along the way. Coding agents read a shared board of confirmed facts, propose next steps, try them, and post the results, repeating the loop until the goal is reached. Penetration testing was its first validated domain, according to the project.
In the hands of this attacker, that same loop became a ready-made intrusion framework. The human operator supplied a short statement of preferred intrusion tactics, written in fewer than 100 Chinese characters. One instruction captured by NorForge told the agents to upload a web shell into a hidden directory, typo included. From there the agents carried out the campaign mostly on their own: investigating targets, searching for security weaknesses, attempting break-ins and recording what worked.
NorForge describes the setup as an AI-powered hacking system. The agents investigated each target, tried to find weaknesses and attempted to get in, with the human setting only the target and the goal. One Chinese-language cluster alone ran more than 1,100 attack projects across 14 exposed panels, with the apparent objective of gaining lasting access to shop and payment systems.
The numbers behind the campaign
NorForge and Reuters put several concrete figures on the campaign that illustrate why security researchers find it so concerning:
- More than 1,200 websites probed since late September, with more than 100 successfully breached.
- Roughly a 10 percent success rate. Most attempts failed, but failures were cheap.
- About 23 hours per successful intrusion, spent on automated probing and testing rather than skilled human labor.
- About $5,000 in AI tokens total, roughly $5 per attempt and about $50 per successful break-in, by Fagerland’s estimates.
Fagerland stresses the cost figures are rough estimates, not billing records, and that the uncertainty around them is considerable. Even so, the labor math is what makes the case significant. The campaign reportedly used China’s DeepSeek models and Anthropic’s Claude Code. A success rate of one in ten stops being a problem when each attempt costs a few dollars and the agent army never sleeps. Fagerland, who has worked in cybersecurity for nearly three decades, said the discovery showed that commercially available AI agents could carry out complex cyberattacks from start to finish without human intervention. He summed it up bluntly: it is a new world now, and the development in this field is astounding.
For context on how quickly agentic attacks are maturing, see our coverage of the four rogue agent incidents OpenAI disclosed and the CERT-In advisory on rogue AI agents warning about agents operating beyond their authorization.
What the victims said
NorForge’s report did not name the companies it found in the panels, but Reuters identified several victims through its own examination of the hacker activity, and the companies responded:
- Deere (John Deere) told Reuters it had taken the necessary remediation actions and had no indication that sensitive information was accessed.
- SharkNinja said the breach affected a standalone website containing product-support information, and that the threat had been contained.
- Cummins pointed to a third-party vendor’s website in connection with the incident.
The responses suggest the confirmed effects varied and that, in at least some cases, the breached web properties were secondary sites rather than core production systems. That is consistent with an opportunistic campaign aimed at lasting access to shop and payment systems, where the agents worked through large lists of e-commerce targets rather than carefully selected high-value marks.
What Cairn’s creator said
Cairn’s creator, who goes by the handle @le1xia0, said earlier in October that the platform was never intended as a hacking tool, adding that misuse is a human decision rather than a feature of the engine. The defense mirrors arguments made around earlier dual-use tools: the same general-purpose agent framework that automates legitimate problem-solving, including sanctioned penetration testing, can be pointed at criminal targets with almost no modification.
NorForge says it is working to get the malicious Cairn instances taken down. But takedowns address the infrastructure of this campaign, not the underlying dynamic. The platform is open source, the models are commercially available, and the method is now documented in detail.
Why this changes the economics of hacking
For years, the practical barrier to this kind of campaign was human effort. A sustained intrusion campaign against hundreds of targets needed skilled operators, and skilled operators are scarce and expensive. This case shows that labor being replaced by software that costs dollars per attempt.
Three shifts matter for defenders. First, the attacker’s skill floor collapsed: the operator did not hand-drive exploits but supplied a brief strategy and let the agents iterate. Second, patience became free: a 23-hour automated probing cycle is only viable when no human has to watch it. Third, the targeting became industrial: more than 1,200 sites in a few weeks, with the agents documenting progress on a shared board and reusing what worked.
Security teams have been watching this convergence for some time. Automated credential theft from development infrastructure, as seen in the GhostAction campaign that turned GitHub Actions into a credential-stealing machine, shows attackers scaling collection through automation. On the defensive side, initiatives like Anthropic’s Cyber Mission, which offers free AI-powered vulnerability scans for open source projects, and OpenAI’s Daybreak effort, represent the industry trying to give defenders comparable leverage. The Cairn case is the clearest evidence yet of the offensive side moving just as fast.
What website owners should do now
The campaign targeted web applications, especially e-commerce shops, and gained entry through the same classes of flaws that have always plagued them. Nothing about the AI involvement changes the fundamentals of defense, but it does shorten the time defenders have to apply them:
- Patch public-facing software aggressively. The agents probe for known weaknesses at scale; unpatched CMS, shop and plugin vulnerabilities are exactly what they find first.
- Hunt for web shells and hidden directories. The attacker’s standing instruction was to drop web shells somewhere inconspicuous. Review upload directories, check for unexpected files and monitor for outbound connections from the web server.
- Rotate credentials and audit secrets. Exposed panels in this case contained verified-valid secrets. If any part of your infrastructure touched this campaign, assume credentials are burned and rotate them.
- Rate-limit and monitor login and probe traffic. A 23-hour probing cycle leaves a long, distinctive trail. Web application firewalls and anomaly detection catch exactly this kind of slow, persistent scanning.
- Segment payment systems from the web front end. The campaign’s apparent goal was lasting access to shop and payment systems, so isolation limits what a breached storefront can reach.
- Get a vulnerability scan. Free and low-cost scanning options, including the AI-assisted scanning programs now offered to open source projects, can find the flaws these agents look for before the agents do.
Frequently asked questions
What is Cairn?
Cairn is an open-source AI platform that coordinates teams of AI agents to solve tasks with minimal human guidance. It calls itself a general-purpose problem-solving engine: a user supplies a starting point and a goal, and the agents work out the steps in between, logging their progress on a shared board. Penetration testing was its first validated use case.
Which companies were hacked in the Cairn AI agent campaign?
Reuters reported that the victims included Deere (John Deere), SharkNinja and Cummins, with compromised sites spanning the United States, Canada, Australia and Japan. NorForge’s report itself did not name targets; Reuters identified them by independently examining the hacker activity. More than 100 websites in total were breached out of more than 1,200 attempted.
How much did the AI agent hacking campaign cost?
NorForge estimates the campaign cost about $5,000 in AI tokens, working out to roughly $5 per attempt and about $50 per successful breach at a roughly 10 percent success rate. Researcher Snorre Fagerland cautions that these are rough estimates with considerable uncertainty.
Were the AI models themselves hacked or misused?
The models were misused, not hacked. The campaign reportedly used China’s DeepSeek service and Anthropic’s Claude Code through the open-source Cairn framework. No vulnerability in those models was reported; the issue was that a general-purpose agent platform was pointed at criminal objectives.
Is the campaign over?
NorForge says it is working to get the malicious Cairn instances taken down, and the named victims have said they remediated and contained the incidents. But the method is now public, the platform is open source, and the researchers found more than 20 exposed panels, so copycat campaigns are a realistic expectation rather than a remote risk.