🔍 Read the full analysis: What A Swarm Of AI Agents Means For Company Website Security on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A Chinese-speaking operator used the open-source Cairn agent platform to direct automated probes at online shops from late September, according to NorForge and Reuters. Reuters counted breaches at more than 100 companies from the attacker’s records, but the amount of data accessed or taken is unknown. The case highlights how exposed support and vendor sites can become entry points, while cost and scale estimates remain uncertain.
An operator used the open-source Cairn AI-agent platform to target online shops from late September, with Reuters counting breaches at websites of more than 100 companies from the attacker’s records. NorForge researcher Snorre Fagerland monitored exposed Cairn control panels used in the campaign; the reporting shows how automated agents can conduct prolonged probing, while leaving unresolved whether sensitive data was taken from the affected sites.
NorForge says Fagerland found more than 20 exposed Cairn panels that the firm linked to likely malicious activity. The panels lacked passwords in some cases, allowing the researcher to observe activity. NorForge grouped the activity into three clusters. Its largest cluster, AIA0001, used Chinese-language task instructions and recorded more than 1,100 attack projects across 14 panels, the firm reported. The activity began around Sept. 25 and targeted sites in the United States, Japan, Australia and other countries.
Reuters said it independently reviewed Cairn activity to identify affected companies and contacted them. It counted attempts against more than 1,200 sites by mid-October and reported successful intrusions at websites belonging to more than 100 companies. Among the named companies were Deere, SharkNinja and Cummins. NorForge’s report did not name victims. Two smaller businesses acknowledged compromises, Reuters reported; some other companies did not respond.
NorForge measured successful AIA0001 projects as taking a little under 23 hours from start to goal on average, with about 140 recorded facts per project. One lasted more than five days. The firm estimated the campaign’s AI costs at roughly $5,000, or about $50 per successful intrusion, while describing the estimate as highly uncertain. These figures are estimates from the research, not independently confirmed accounting of the operator’s expenses.
One operator, a swarm of agents
The campaign in numbers
What the researcher and Reuters report about the busiest group NorForge found. Counts come from the attackers’ own exposed panels; cost and success figures are estimates.
The price tag estimates
NorForge / Fagerland, “uncertainty considerable”
- ~$5 per task on average, including tasks that fail early
- $100+ for long projects with more than 1,000 intents and facts
- ~$5,000 in AI costs for the campaign, about $50 per successful hack
- ~10% success rate, NorForge’s “reasonable assumption”
How the swarm runs
Simplified, no attack details
- Shop websites are ranked by traffic and checked automatically in a browser
- Each target becomes a Cairn project: a starting point and a goal
- Agents post facts and next steps on a shared board and build on each other
- Goal: a hidden way back in to shop and payment systems, for later
- 22 SepGambit reportGambitCairn found among three AI harnesses on a criminal’s staging server (separate campaign)
- 25 SepCampaign startsReutersA Chinese-speaking operator turns agents on shops in the US, Canada, Australia and Japan
- ≈ 2 OctOpen panels foundReutersFagerland starts finding Cairn panels in malicious use, about two dozen
- mid-Oct1,200+ sites triedReutersBreaks into websites of 100+ companies, incl. Deere, SharkNinja, Cummins
- 19 OctReport and investigationNorForge · ReutersNorForge publishes “Inside Cairn”; Reuters publishes its investigation
Sources: NorForge, Inside Cairn (19 Oct 2026); Reuters (19 Oct 2026); Gambit Security (22 Sep 2026). Numbers as published, same rounding as the article.
Powered by Thorsten Meyer AI
Why Exposed Sites Matter
The case points to a security problem beyond an organization’s main website. Product-support pages, vendor-operated sites and overlooked online services may be connected to a company’s systems but receive less attention than its primary storefront. Reuters reported that Cummins was investigating a potential attack on a site run by a third-party vendor, while SharkNinja said a standalone product-support site was affected. These examples show why companies need to account for external web properties as part of their security work.
AI agents can also make it easier to keep a large number of probes running over long periods. That does not mean the agents independently make every decision or that every target is breached. In this campaign, the operator supplied instructions and the software coordinated steps across agents. Still, the reported pace and duration raise practical demands for defenders: they may need to distinguish automated malicious activity from routine traffic, investigate alerts, and contain compromises across sites operated by suppliers as well as their own teams.
The exposure of Cairn dashboards is part of the story, too. Unprotected management panels can reveal operational activity to outsiders and create risk in their own right. NorForge’s observations suggest defenders should track where agent platforms are deployed and whether their control interfaces are properly restricted. The reports do not establish that Cairn itself caused the intrusions; NorForge describes it as a general-purpose system, not solely a hacking tool.
Popular right now
Shark Rotator Lift-Away Vacuum with DuoClean PowerFins (LA555) – Dark Grey
De'Longhi 15-Bar Pump Espresso Machine with Milk Frother & Temperature Control
Breville Bambino Espresso Machine, Brushed Stainless Steel (BES450BSS)
As an affiliate, we earn on qualifying purchases.
How Researchers Traced Cairn
The reporting followed a separate investigation by Gambit Security in September. That firm said it recovered a criminal staging server containing three AI harnesses, including Cairn. Harnesses let AI models take actions through software rather than only generate text. The finding led NorForge to search for exposed agent dashboards on internet-indexing services.
Fagerland found Cairn panels that could be accessed without a password and began tracking them. NorForge identified about two dozen panels it associated with malicious activity from around Oct. 2, according to Reuters, and the number changed as additional panels appeared. NorForge published its analysis on Oct. 19, the same day Reuters published its investigation. A separate Gambit Security report described another agent-driven campaign involving at least 27 compromised companies and at least 600,000 card records taken from two companies. That was a distinct campaign, not evidence of data theft in the Cairn activity.
Cairn coordinates work by keeping a shared record of findings and intended next steps for agents. The operator can provide an initial objective and add guidance. NorForge’s account describes a process that can continue while agents build on prior results; it does not establish that the system acts without human direction at every stage.
“Most need authorization to access. Most.”
— NorForge report
Data Access and Attribution Remain Unclear
Reuters could not establish how much data, if any, was taken from the affected websites. Deere said it had no indication that sensitive information was accessed. SharkNinja said a standalone product-support site was hit and the threat was contained. Cummins said it was investigating a potential cyberattack on a website operated by a third-party vendor. Those statements do not resolve whether information was viewed or removed across the campaign’s other targets.
The operator’s identity is also unknown. NorForge characterized the activity as coming from a Chinese-speaking actor, which does not establish the person’s nationality or location. The reports do not identify an arrest or charge. NorForge’s campaign cost figure is an estimate with considerable uncertainty, and the company count and intrusion totals rely on records and analysis described in the reports rather than a complete public list of confirmed victims.
Company and Vendor Investigations Continue
The immediate next steps are for affected companies and their service providers to determine which systems were accessed, whether data was exposed, and whether any access remains. Deere, SharkNinja and Cummins offered different levels of information in their statements to Reuters; further findings from their investigations could clarify the impact. A complete accounting of affected organizations has not been published in the material available.
For security teams, the reports put attention on internet-facing support and vendor sites, as well as access controls for agent dashboards. It is not yet clear whether investigators will publish additional technical findings, whether the campaign’s operator will be identified, or whether the reported intrusions led to later misuse of access. Those questions will determine whether this activity resulted mainly in website compromises or wider impacts on company systems and customers.
Key Questions
What did the AI agents do?
According to NorForge and Reuters, agents coordinated through Cairn probed online shops and pursued access over extended periods. The operator supplied instructions; the reports do not show that the system acted without human direction throughout.
How many companies were affected?
Reuters counted breaches at websites of more than 100 companies based on the attacker’s Cairn records. The reports do not provide a complete public list of victims, and some affected companies did not respond to Reuters.
Was customer or company data stolen?
That remains unknown for this campaign. Reuters could not establish how much data, if any, was taken. Deere said it had no indication sensitive information was accessed; the separate Gambit report’s card-record theft figures concern a different campaign.
Who was behind the campaign?
The operator has not been identified publicly. NorForge described the activity as involving a Chinese-speaking actor; that description does not establish the operator’s identity, nationality or location.
Does the reporting show Cairn was built for hacking?
No. NorForge describes Cairn as a general-purpose, state-based problem-solving engine, and its author said it was not designed for hacking attacks. The reports say an operator used the platform in the campaign.
Source: ThorstenMeyerAI.com
