🔍 Read the full analysis: One Hacker, 100+ Company Websites: The Role Of AI Agents on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Reuters reported that an operator used Cairn, an open-source AI-agent platform, in a campaign that attempted to reach more than 1,200 websites and broke into websites of more than 100 companies, based on the attackers’ records. NorForge researchers monitored exposed control panels, while affected companies gave differing accounts of the incidents. The amount of data accessed or taken has not been established.
An operator used AI agents to probe online shops and break into websites belonging to more than 100 companies, according to Reuters’ review of the attacker’s records and research by security firm NorForge. The campaign began around Sept. 25 and targeted sites in the United States, Canada, Australia and Japan; the amount of data accessed or taken remains unknown.
NorForge researcher Snorre Fagerland found internet-facing control panels for Cairn, a free, open-source platform that coordinates AI agents. He identified more than 20 panels that the firm linked to likely malicious activity and monitored some of their operations. NorForge reported three activity clusters; its largest, labeled AIA0001, used Chinese-language task instructions.
NorForge counted more than 1,100 attack projects across 14 panels in that cluster. Reuters separately reviewed the attacker’s Cairn activity and reported that the agents had tried more than 1,200 sites by mid-October, with successful intrusions at websites of more than 100 companies. Reuters identified companies including farm-equipment maker Deere, appliance maker SharkNinja and engine maker Cummins. NorForge’s report did not name victims.
NorForge measured successful AIA0001 projects as taking a little under 23 hours from start to goal. Researcher estimates put AI costs at about $5,000 for the campaign, or roughly $50 per successful intrusion; NorForge cautioned that uncertainty around the estimate was considerable. Those figures describe the researchers’ estimates, not independently verified accounting of the operator’s spending.
One operator, a swarm of agents
The campaign in numbers
What the researcher and Reuters report about the busiest group NorForge found. Counts come from the attackers’ own exposed panels; cost and success figures are estimates.
The price tag estimates
NorForge / Fagerland, “uncertainty considerable”
- ~$5 per task on average, including tasks that fail early
- $100+ for long projects with more than 1,000 intents and facts
- ~$5,000 in AI costs for the campaign, about $50 per successful hack
- ~10% success rate, NorForge’s “reasonable assumption”
How the swarm runs
Simplified, no attack details
- Shop websites are ranked by traffic and checked automatically in a browser
- Each target becomes a Cairn project: a starting point and a goal
- Agents post facts and next steps on a shared board and build on each other
- Goal: a hidden way back in to shop and payment systems, for later
- 22 SepGambit reportGambitCairn found among three AI harnesses on a criminal’s staging server (separate campaign)
- 25 SepCampaign startsReutersA Chinese-speaking operator turns agents on shops in the US, Canada, Australia and Japan
- ≈ 2 OctOpen panels foundReutersFagerland starts finding Cairn panels in malicious use, about two dozen
- mid-Oct1,200+ sites triedReutersBreaks into websites of 100+ companies, incl. Deere, SharkNinja, Cummins
- 19 OctReport and investigationNorForge · ReutersNorForge publishes “Inside Cairn”; Reuters publishes its investigation
Sources: NorForge, Inside Cairn (19 Oct 2026); Reuters (19 Oct 2026); Gambit Security (22 Sep 2026). Numbers as published, same rounding as the article.
Powered by Thorsten Meyer AI
Automation Changes the Attack Economics
The campaign illustrates how AI agents can automate repeated reconnaissance and probing across many websites, reducing the need for an operator to guide every step manually. NorForge describes Cairn as a general-purpose, state-based problem-solving platform rather than a tool built specifically for hacking. Its use in this campaign shows how broadly available agent software can be adapted for harmful activity.
The reported targets included online shops and related infrastructure. That raises concerns for companies whose support sites, third-party vendor pages or less-maintained web properties may have weaker defenses than their main systems. A successful website intrusion does not, by itself, establish that payment details or other sensitive information were accessed. Reuters said it could not determine how much data, if any, was taken.
Automated attacks also create a workload for defenders: repeated activity across many sites can generate alerts and investigative leads faster than staff can review them. The campaign’s reported pace and scale make it relevant to organizations that rely on public-facing sites, but the available reporting does not establish that AI agents make every stage of an intrusion faster or more effective.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How Researchers Found Cairn Panels
The investigation began after a separate September report by Gambit Security described another agent-driven campaign. Gambit said it found three AI harnesses—software that allows AI models to take actions—on a criminal staging server. NorForge then searched for exposed dashboards associated with Cairn, one of those platforms. Some panels required no password, according to the researchers’ account.
From around Oct. 2, Fagerland identified roughly two dozen Cairn panels associated with malicious activity, Reuters reported. NorForge grouped activity into three clusters and published its report on Oct. 19, the same day Reuters published its investigation. The companies and incident details were identified through different reporting: NorForge analyzed the exposed panels, while Reuters said it independently reviewed Cairn activity and contacted potential victims.
Gambit’s September findings concerned a separate campaign, not proof that the same operator was responsible. The firm reported at least 27 companies compromised and at least 600,000 payment-card records taken from two of them. Those figures should not be attributed to the later campaign tracked by NorForge and Reuters.
“Cairn was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention.”
— Cairn author le1xia0, quoted by Reuters
Victim Impact Is Still Unclear
The operator’s identity has not been established. The reporting describes the activity as linked to a Chinese-speaking actor, but that does not identify the person or prove where they were located. No arrest or criminal charge is reported in the supplied material.
The extent of access and any data loss are also unsettled. Reuters said it could not establish how much information, if any, was taken. Deere reported no indication that sensitive information was accessed; SharkNinja said it contained the threat; and Cummins said it was investigating a potential incident involving a third-party vendor site. These statements do not provide a single, complete account of the campaign’s impact.
The cost estimate and the reported scale depend on available records and researchers’ methods. NorForge described considerable uncertainty in its cost estimate, and the more-than-100 figure comes from Reuters’ review of the attacker’s records rather than a public list of independently verified incidents for every affected company.
Incident Reviews and Attribution Continue
Companies named in the reporting may continue to assess affected websites, confirm whether information was accessed and review the security of vendor-operated pages. Cummins said it was investigating a potential attack on a vendor’s website. The available source material does not give a public deadline for the investigation or announce a later technical report.
Security researchers and companies will also need to distinguish activity across exposed Cairn panels and determine whether the campaign’s operators retained access or sought to monetize it later. NorForge interpreted the largest cluster’s objective as gaining persistent access to e-commerce and payment infrastructure for possible later monetization; that is the firm’s assessment, not confirmation that such access was used or sold.
Further updates should clarify the number of affected organizations, whether data was taken, and whether any company systems beyond public-facing websites were reached. Until those findings are disclosed, the confirmed picture is a large, automated campaign and an unresolved account of its consequences.
Key Questions
What did the AI agents do?
According to Reuters and NorForge, agents coordinated through Cairn probed online shops and other websites. Reuters reported that they tried more than 1,200 sites and that the attacker’s records showed successful intrusions at websites of more than 100 companies.
Who operated the campaign?
The operator has not been identified. The reporting describes a Chinese-speaking actor, but does not establish the person’s name or location, and reports no arrest or charge.
Was customer or payment information stolen?
That has not been established for this campaign. Reuters could not determine how much data, if any, was taken. A separate campaign described by Gambit Security involved payment-card records, but those figures should not be confused with this incident.
What is Cairn?
Cairn is a free, open-source platform for coordinating AI agents. Its author said it was not designed for hacking attacks. Researchers reported that some exposed Cairn control panels were used in malicious activity.
What did the named companies say?
Deere said it took remediation actions and had no indication sensitive information was accessed. SharkNinja said a standalone product-support site was hit and the threat contained. Cummins said it was investigating a potential attack on a website operated by a third-party vendor.
Source: ThorstenMeyerAI.com
