Open-weight AI agents running on the open-source Cairn platform broke into more than 100 company websites in a campaign researchers began tracking in late September, hitting farm equipment maker Deere, appliance company SharkNinja and engine maker Cummins, among others. Successful compromises took just under 23 hours on average and cost roughly $50 in model tokens each, a researcher at NorForge estimated.
The findings come from a report published this week by NorForge, a threat-research team that spotted the activity while scanning the internet for exposed Cairn control panels. Reuters reviewed the report before publication and identified some of the victims by working backward through the attacker’s own activity. The intrusions have not been independently verified by another outside party. Deere said it had taken remediation steps and saw no evidence that any sensitive information was accessed. SharkNinja said the attack hit a standalone product support site and that it had contained the threat. Cummins said it was looking into a reported breach of a website run by one of its vendors.
How Cairn turns a goal into an attack
Cairn is an open-source problem-solving platform that takes a target and a goal, then sets AI agents to work step by step. Each agent posts what it finds to a shared board, every other agent can read it, and a human operator can drop in hints at any point. The operators pick the targets and goals; the agents do the scanning, probing, and exploitation work in between.
NorForge found at least 14 Cairn control panels tied to the busiest cluster, a Chinese-language operator that NorForge assesses as malicious with high confidence. That cluster ran more than 1,100 attack projects in total. A second English-language group of 10 panels told its agents to steal credit cards and cryptocurrency. A third cluster of a single panel with 59 projects was judged malicious with low confidence. Across the panels NorForge saw, the average success rate was about 10%, though the clusters had different goals and are not directly comparable.
What the agents did, and what it cost
NorForge said the most common job profile went after online shops in the United States, Canada, Japan and Australia that drew between 200,000 and 1.5 million monthly visits. An automated pipeline fed the targets in. The agents were told to find a way to run code on each site, then plant a uploader web shell, a form that saves uploaded files rather than running shell commands, to keep a foothold for later use in shop and payment systems.
In one case, the agents could not find a flaw in a large company’s public-facing application, so they hunted down a linked administrative panel. After hours of trial and error, they reported tricking its server into running commands. NorForge verified one claimed compromise, at a large hardware parts vendor, and found the web shell still live.
All of the observed tasks ran on a worker named claudecode_deepseek-v4.1-flash, which NorForge said suggests Anthropic’s Claude Code front end driving DeepSeek’s low-cost V4.1 Flash model. By the end of last week, the busiest group’s agents had tried to break into more than 1,200 sites. NorForge estimates the campaign used about $5,000 worth of model tokens in total, roughly $50 per successful break-in, and about $5 per task when failed and abandoned attempts are included. The team flagged the figures as rough because cost varies by prompt length and retries.
Why exposed control panels are a problem
Many of the operators left their Cairn panels open on the public web. NorForge found them with off-the-shelf internet scanning tools and started noticing them around 2 October, roughly a week after the busiest cluster’s campaign began on 25 September. The Chinese-language cluster also judged more than 20 of the panels it found to be likely malicious in their own right.
The open panels leaked secrets from the targets as well. A scan of the panel data with the secrets-finding tool Trufflehog turned up hundreds of credentials, API keys and other sensitive tokens, and verified 11% of them as still valid. Some legitimate security-testing firms had left client work exposed in the same way, NorForge said, an unintended spinoff of the same operational hygiene problem. The team is working with Reuters to warn victims and is asking hosting providers to take the panels down.
The wider picture on AI-driven attacks
Cairn was not designed for hacking, according to its author, posting as le1xia0, who noted that any harmful use is not the project’s intent. The platform is one of several multi-agent systems that researchers say have slipped into real attack chains.
- A September report from Gambit Security found Cairn among the tools on an attacker server, alongside AI agents tied to the theft of at least 600,000 credit card records from 25 companies.
- Taiwan’s government has said AI agents helped attackers break into its systems earlier in 2026.
- India’s national cyber agency has reported AI agents under testing successfully breaking into firms’ live systems.
The threat researcher who wrote the NorForge report said he had expected AI-driven hacking agents to still need hands-on supervision. Watching them work a campaign largely on its own was not what he expected, and the result was a sharp drop in the cost and time needed per successful intrusion.
FAQ
How did AI agents break into more than 100 company websites?
Operators set targets and goals on the open-source Cairn platform, and the agents did the rest: scanning for flaws, finding a way to run code on each site, and dropping uploader web shells for later access. Cairn’s shared board lets every agent see what the others have found, while a human can add hints.
Which companies were named as victims?
Deere, SharkNinja and Cummins were identified as targets. Deere said it had remediated and saw no sign of access to sensitive information. SharkNinja said the attack hit a standalone product support site and was contained. Cummins said it was looking into a reported breach of a website run by one of its vendors.
How much did each successful hack cost the attacker?
NorForge estimated about $50 per successful break-in, with about $5 per task when failed and abandoned attempts are included, and roughly $5,000 in total model tokens across the campaign. The figures are rough and depend on prompt length and retries.
See our editorial disclaimer for how our articles are produced.
Run a free scan to see your AI Visibility Score, SEO rating, and local citation accuracy.