Cybersecurity researcher Snorre Fagerland at NorForge discovered a large-scale hacking campaign in which a Chinese-speaking attacker deployed AI agents to break into websites belonging to more than 100 companies, including farm equipment manufacturer John Deere, appliance maker SharkNinja, and engine manufacturer Cummins. The campaign, which began on September 25, targeted e-commerce and related websites in the United States, Canada, Australia, and Japan, with the AI agents carrying out the intrusions with little direct human involvement beyond initial instructions.
Fagerland uncovered the campaign while scanning the internet for exposed instances of Cairn, an open-source AI problem-solving platform that uses autonomous agents to complete tasks by documenting their progress on a shared board. The hacker left control panels for the platform inadvertently exposed on the web, allowing Fagerland to observe the attack activity beginning around October 2. In total, Fagerland found approximately two dozen instances of Cairn being used for malicious purposes, though the Chinese-speaking hacker was by far the most prolific, with agents attempting to break into more than 1,200 sites by late the following week.
The hacker's instructions to the AI agents were remarkably brief, consisting of fewer than 100 Chinese characters outlining preferred intrusion tactics. The agents then autonomously probed targeted websites for vulnerabilities and attempted to gain access. Successful breaches typically took around 23 hours of automated probing and trial-and-error attempts. Fagerland estimated the campaign consumed approximately $5,000 worth of AI tokens—the units of text that AI models process and charge for—translating to roughly $50 per successful hack. The attacks appeared to use a combination of Anthropic's Claude Code running DeepSeek's low-cost V4.1 Flash model.
The sophistication of some techniques impressed Fagerland, who has worked in cybersecurity for nearly three decades. In one case, when AI agents found no vulnerability in a large company's public-facing application, they independently researched and located an associated control panel, discovered a subtle weakness in its data processing, and after hours of trial and error, reported successfully tricking the server into executing malicious commands. "It's not script kiddie stuff," Fagerland said, referring to the relatively advanced nature of the attacks.
The targeted companies provided varying assessments of the breach impact. John Deere stated it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the attack impacted a standalone website containing only product support information and that it had contained the threat. Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Two smaller businesses acknowledged being compromised. Reuters reported it could not establish the extent to which the breaches resulted in unauthorized data extraction.
Fagerland's discovery revealed additional malicious activity on the exposed Cairn platforms. One hacker was observed stealing credit card data, while another attempted to use AI agents to target a cryptocurrency exchange. Across all observed instances, NorForge estimated an average success rate of approximately 10%, though clusters with different objectives were not directly comparable. The exposed control panels also leaked hundreds of credentials, API keys, and other secrets associated with targeted companies.
Cairn's creator, identified by the social media handle @le1xia0, did not immediately respond to questions about the findings but acknowledged receiving a message from Reuters. In a post on social media, the creator stated that Cairn was "an innovative type of multi-agent architecture" and "was not designed for hacking attacks," adding that "misuse is a human decision, not a feature of the engine." NorForge indicated it was working to have the malicious Cairn instances removed from the internet. The discovery underscores growing concerns about the security implications of autonomous AI tools as the technology advances.
