One operator, more than 1,200 targeted websites and AI agents doing much of the work. On October 19, 2026, security researchers at NorForge published an investigation into exposed control panels for Cairn, an open-source agent framework that attackers had repurposed for cyber intrusions. In a separate investigation, Reuters identified websites associated with Deere, SharkNinja and Cummins among the affected targets and reported that more than 100 sites had been compromised.
The remarkable part is not simply the number of targets. It is the operating model: a human could provide a short objective, leave software agents to investigate websites for hours and return to a log of what they found. The same investigation also revealed a serious mistake by the attackers themselves: some had left their AI-agent dashboards publicly accessible.
What happened: the NorForge investigation
NorForge researcher Snorre Fagerland investigated publicly reachable control panels for Cairn, a general-purpose, state-based problem-solving framework. The team identified more than 20 panels it considered likely malicious, along with additional exposed panels associated with apparently legitimate security testing. The report, titled Inside Cairn: Open Windows into massive AI-Driven Cyber Operations, was published on October 19.
One Chinese-language activity cluster, labeled AIA0001 by the researchers, accounted for more than 1,100 attack projects across 14 dashboards. Reuters, which separately reviewed records from the hacker's activity, reported attempts against more than 1,200 websites and compromises affecting over 100 sites. These are related but differently scoped figures: the NorForge project count is not a separate tally of confirmed successful breaches.
Researchers described a particular emphasis on shopping websites and payment-related infrastructure in the United States, Canada, Japan and Australia. The observed objective appeared to be obtaining persistent access that could potentially be exploited later. That does not mean the researchers confirmed widespread theft of customers' payment information in this specific campaign.
How Cairn's AI agents worked
Cairn is not inherently a hacking tool. It is a framework in which a project begins with a defined starting point and a desired end state. Agents record discoveries as facts, propose next actions and share information through a common project workspace. A human operator can add guidance without manually performing every intermediate step.
That structure is well suited to legitimate multi-step problem solving. Misused against third-party websites without authorization, however, it can also sustain long-running intrusion attempts. In the campaign described by NorForge, agents carried out automated investigation, tested possible weaknesses and reported whether they had reached the operator's objective. Researchers examined project histories rather than relying only on the attacker's claims.
NorForge said it independently checked at least one reported successful intrusion and found that a malicious upload interface was indeed reachable on the affected server. It also documented a separate compromise chain in a retailer case study. Those spot checks strengthen the report, but they are not equivalent to independent forensic confirmation of every reported breach.
The numbers: 1,200 targets, 100-plus reported breaches and an estimated $5,000
The campaign's scale attracts attention, but each number requires context:
- More than 1,200 websites targeted: Reuters' reported count of attempted intrusions, not a count of sites where data was stolen.
- More than 100 websites compromised: the reported outcome based on the observed campaign. Public reporting does not establish the full impact at each organization.
- About 23 hours: the average time from starting a successful AIA0001 project to reaching its recorded goal, according to NorForge. This was autonomous working time, not proof of a 23-hour human workday.
- Roughly $5,000 in AI usage: Fagerland's estimate of the campaign's total model-token spending, equivalent to about $50 per reported successful intrusion. It is an estimate, not an independently verified billing statement.
NorForge separately estimated around $5 of model costs for an average task when unsuccessful attempts were included. It explicitly warned that those calculations carry considerable uncertainty because it did not have actual token-usage records. A rough success rate near 10% also depends on how the agents' stated goals are defined; it is not a universal success rate for AI-powered hacking.
What Deere, SharkNinja and Cummins said
Reuters identified the companies by independently examining records linked to the campaign, while NorForge's public write-up withheld victim names and sensitive technical identifiers. The organizations' statements are not interchangeable.
Deere said it had taken remediation action and had no indication that sensitive information had been accessed. SharkNinja said the affected property was a separate product-support website and that the incident had been contained. Cummins said it was investigating a possible attack involving a website operated by a third-party vendor.
These statements matter because a compromised website is not automatically evidence of a breach of the company's core network or customer database. Reuters said it could not determine how much unauthorized data extraction, if any, had resulted from the reported intrusions.
The attackers exposed their own AI dashboards
The investigation's most revealing twist is that researchers could observe the activity because some operators had failed to protect their agent-management interfaces. Exposed panels revealed project instructions, progress logs, target information and, in some cases, secrets. NorForge scanned the material and reported that 11% of the detected secrets were validated as still usable by its tooling.
This creates a second security problem. An unsecured agent console may expose information about organizations being tested, even when the testing is legitimate and authorized. Depending on an agent's permissions, it can also become an attractive control point for anyone who gains access. NorForge did not test whether every exposed administrative control could be abused and withheld certain identifiers while coordinating notifications and takedown attempts.
Did DeepSeek or Claude Code conduct the attacks?
NorForge observed an agent-worker label resembling claudecode_deepseek-v4.1-flash in the most active cluster. The researchers interpreted that as a possible Claude Code-style harness using a DeepSeek model, but the label alone does not prove the precise model configuration. Reuters likewise described the campaign as apparently using a mixture of DeepSeek and Claude Code.
That distinction is important. Neither the model provider nor the agent framework should be described as having launched or authorized the attacks. Cairn's developer has said the framework was not designed for hacking. The documented story is about criminal misuse of general-purpose agent technology, not an official feature or action by an AI vendor.
Why this changes the economics of website security
Traditional intrusion campaigns can demand sustained attention from skilled operators. Agent-based systems may lower the marginal labor needed to investigate many targets simultaneously. A human still defines goals, provides resources and chooses how to use any access obtained, but much of the repetitive exploration can continue without constant supervision.
For defenders, the worrying development is not a mythical AI that instantly defeats every website. The observed campaigns were imperfect, produced failures and even exposed the attackers' own operations. The concern is that inexpensive, persistent automation can keep testing neglected web applications and third-party services until something works.
This is especially relevant for online stores, support portals, older web applications and external services that may sit outside an organization's best-monitored infrastructure. The practical risk comes from ordinary security weaknesses being tested more frequently and at greater scale.
What website owners and security teams should do
The report does not describe a single new vulnerability that can be fixed with one universal patch. It instead illustrates why consistent defensive hygiene matters:
- Inventory public-facing properties. Include customer-support microsites, older storefronts, staging environments and vendor-operated domains, not just the primary website.
- Patch and test high-risk web flows. Prioritize authentication, uploads, administrative endpoints, outdated dependencies and server-side input handling. Use authorized testing and established application-security review procedures.
- Watch for persistent automated activity. Review access patterns and alerts for repeated probing, unexpected administrative changes and newly created server-side files. Investigate suspicious events rather than assuming automation is harmless traffic.
- Protect agent consoles like privileged infrastructure. Require strong authentication, restrict network access, isolate credentials and avoid putting security-testing dashboards directly on the public internet.
- Treat agent logs as sensitive records. They may contain discovered weaknesses, tokens, passwords and information about clients. Restrict retention and access, and rotate any secrets known to have been exposed.
- Coordinate with third parties. Make sure hosting vendors, payment integrators and support-platform operators have clear incident reporting and remediation processes.
What is confirmed, and what is not
The core finding is well documented: NorForge examined exposed Cairn panels, found multiple apparently malicious operations and validated selected intrusion outcomes; Reuters independently reviewed the activity and contacted affected companies. The investigation supplies concrete evidence that AI agents are being used for real-world cyberattacks.
There are still limits to what can be concluded. The precise count of independently verified breaches is smaller than the broader number reported from agent records. Public reporting does not establish the amount of stolen data across all targets, the final cost of the campaign or the exact model configuration behind every task. There is also no evidence in this reporting that the Chinese language of one operator establishes state sponsorship.
The lesson for AI development and cybersecurity is specific: the same ability that makes agents useful for sustained, multi-step tasks can be misused to scale attempts against poorly secured systems. The response is not to treat every agent as hostile, but to limit privileges, secure control surfaces and reduce the opportunities that unattended automation can exploit.