AI News
AI Agents Broke Into 100+ Company Sites Through the Cairn Platform
A single hacker used AI agents to break into the websites of more than 100 companies, in a campaign that came to light on October 19 through a report by the AI security firm NorForge and reporting by Reuters. The agents did most of the work on their own. The attacker chose the targets and supplied a short set of instructions; the software probed each site for weaknesses, worked out how to get in, and kept going until it succeeded or gave up. It is one of the clearest cases yet of AI agents running a complete intrusion campaign with minimal human involvement.
What happened
Snorre Fagerland, a principal threat researcher at NorForge, found the campaign while scanning the internet for exposed installations of Cairn, an open-source AI platform. From around October 2, he identified roughly two dozen Cairn instances that appeared to be used for attacks, and he could watch the activity recorded on them as it happened. The most active instance belonged to a Chinese-speaking hacker who, according to NorForge, began targeting e-commerce websites on September 25. By late last week, that hacker's agents had attempted to break into more than 1,200 websites and had successfully entered more than 100 of them — a success rate of roughly one in ten.
The exposed instances showed other actors at work as well. According to the reporting, one separate hacker used agents to steal credit card data, and another tried to direct agents to rob a cryptocurrency exchange. NorForge published its findings on October 19, and Reuters independently examined the main hacker's activity on Cairn to identify the companies that had been breached.
How the agents got in
Cairn describes itself as a general-purpose problem-solving engine. A user gives its AI agents a starting point and a goal; the agents then work toward the goal step by step, posting what they learn to a shared board that the other agents, and the operator, can read. In this campaign, the goal was to gain access to a target website — in some cases to run code on the server and plant a web shell, a small tool that can give an attacker lasting access to a shop and its payment systems.
The human contribution was small. According to Reuters, the attacker set out their preferred intrusion tactics in fewer than 100 Chinese characters. The agents then did the probing and testing themselves, and successful breaches took about 23 hours on average. Fagerland estimated that the campaign consumed about $5,000 worth of AI tokens — roughly $50 per successful breach — and that it combined China's DeepSeek models with Anthropic's Claude Code. Cairn's creator, who goes by @le1xia0, said the platform "was never a 'hacking tool,'" adding that "misuse is a human decision, not a feature of the engine." NorForge says it is working to have the malicious Cairn instances taken down.
Who was hit, and what the companies say
NorForge's report did not name the victims. Reuters identified them by examining the hacker's activity: the breached sites included farm equipment maker John Deere, home appliance company SharkNinja, and engine manufacturer Cummins, with targets in the United States, Canada, Australia and Japan. The companies' responses were measured, and none has confirmed that data was taken. Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the breach affected a standalone website holding product-support information and that the threat had been contained. Cummins, through spokesperson Melinda Koski, said the company was investigating "the report of a potential cyber-attack on a website operated by one of our third-party vendors." What was done with access to the other breached sites, and whether anything was extracted from them, remains unknown.
What it means for companies using AI agents
The importance of the case is the labor and the cost. Work that once required skilled people, and days of their time, was carried out here by software for an estimated $50 a website, directed by a human instruction shorter than a text message. Fagerland, who has worked in cybersecurity for nearly three decades, told Reuters: "It's a new world now." The lesson for companies cuts two ways. Attackers can now probe large numbers of websites at once, around the clock, which raises the cost of leaving known weaknesses unpatched. And this campaign was visible at all only because the attacker left the Cairn control panels exposed on the open internet — the same kind of basic misconfiguration that defenders are routinely warned about. As more companies deploy their own AI agents and agent platforms, securing access to those tools matters as much as securing the systems the tools can reach.