AI agents used to hack 100+ company sites

Free Instant SEO Audit

By NewSunSEO October 19, 2026

A Chinese-speaking hacker relied on AI agents to break into the websites of more than 100 companies, including farm equipment maker Deere, appliance maker SharkNinja, and engine maker Cummins. Threat researchers at the Norwegian cybersecurity firm NorForge published a report on Monday documenting how the open-source agent platform Cairn automated nearly every step of the intrusion campaign, from reconnaissance to planting web shells on payment systems.

What the campaign looked like

Cairn is a multi-agent AI platform that takes a target and a goal, then sets AI agents to work toward it step by step. Each agent posts what it finds to a shared board where other agents can read it, and the human operator can add hints along the way. Operators set the targets and the goals. Many of those operators left their Cairn control panels open on the web, where internet scans could find them.

NorForge’s principal threat researcher began locating the open panels around 2 October. The Chinese-speaking hacker’s campaign had started on 25 September. NorForge assessed 20 of the panels it found as likely to be malicious. Most of the activity clustered into three groups. The Chinese-language cluster, which NorForge judges malicious with high confidence, was the busiest, running more than 1,100 attack projects across 14 panels. Its typical target was an online shop in the United States, Canada, Japan, or Australia with 200,000 to 1.5 million visitors.

How the agents attacked each site

An automated pipeline fed tasks into the Chinese-language cluster. The agents were told to find a way to run code on each target site, then plant a web shell. The form uploaded took the shape of a file-saver rather than a command-runner, a choice NorForge read as a desire for lasting access to shop backends and payment systems for later use. NorForge checked one claimed break-in at a large hardware parts vendor and confirmed the web shell was live. By late last week, the cluster’s agents had tried to break into more than 1,200 sites, according to the report.

Cost and speed: about $50 per successful break-in

Every task NorForge observed ran on a worker named claudecode_deepseek-v4.1-flash, which suggests a Claude Code setup driving DeepSeek’s low-cost V4.1 Flash model. Successful attacks took a little under 23 hours on average. The report estimates that about $5,000 of tokens powered the campaign, roughly $50 per successful hack. NorForge’s own figure averages about $5 per task across both successful and failed attempts, with considerable uncertainty in the estimate.

NorForge put the average success rate across the tools it saw at about 10%, while noting the clusters had different goals and are not directly comparable.

Other clusters and exposed secrets

A second English-language cluster of 10 panels told its agents to steal credit cards and cryptocurrency. A third, a single panel with 59 projects, was judged malicious only with low confidence. The open panels also leaked secrets from the targets. A scan of the panel data found hundreds of credentials, API keys, and other secrets, and the scanner Trufflehog verified 11% of the exposed secrets as valid. Some legitimate security testing firms had left client work exposed in the same way.

Where the victims stand

Deere said it took remediation steps and had no sign anyone accessed sensitive information. SharkNinja said the attack hit a standalone product support site and that it contained the threat. Cummins said it was looking into a report of a possible attack on a site run by one of its vendors. Reuters was unable to establish how much data, if any, the hackers took. NorForge said it was working with Reuters to warn victims and was asking hosting firms to take the open panels down.

The author of Cairn, posting publicly as le1xia0, said Cairn’s multi-agent architecture was not designed for hacking attacks, and that any harmful use was not the developer’s intent.

What it means for defenders

The campaign shows that unsupervised AI agents can now carry out long, multi-stage attacks against real production sites, searching for flaws, chaining exploits, and dropping persistence tools, with only high-level goals from a human operator. In one case, the agents found no flaw in a large company’s public-facing application, so they hunted down a linked control panel and, after hours of trial and error, reported tricking its server into running commands. NorForge’s framing of the work is that this is not script-kiddie activity: the agents are handling the bulk of a real intruder’s workflow.

Earlier this year, Taiwan’s government said AI agents had helped hackers break into its systems, and India’s cyber agency said AI agents under testing broke into firms’ live systems. A September report from Gambit Security had already identified Cairn among the tools on an attacker’s server and reported that AI agents stole at least 600,000 credit card records from 25 companies. The NorForge findings add a second large dataset, with named victims, cost figures, and a working model under the hood.

FAQ

What is Cairn and how did the hacker use it?

Cairn is an open-source multi-agent AI platform that takes a target and a goal, then sets AI agents to work toward it step by step. Each agent posts findings to a shared board; the human operator sets the targets and goals and can add hints. The hacker pointed it at company websites and let the agents chain the attack.

Which companies were hit?

Reuters identified some of the victims by reviewing the hacker’s activity. They include Deere, SharkNinja, and Cummins. Deere said it took remediation steps with no sign of sensitive data exposure. SharkNinja said the hit was a standalone product support site and the threat was contained. Cummins said it was looking into a report of an attack on a vendor-run site.

How much did the AI agent hacking campaign cost?

NorForge estimated about $5,000 of tokens powered the campaign, roughly $50 per successful break-in, with successful attacks taking a little under 23 hours on average. All observed tasks ran on a worker named claudecode_deepseek-v4.1-flash, suggesting a Claude Code setup driving DeepSeek’s low-cost V4.1 Flash model.