🔍 Read the full analysis: What Changes When AI Agents Help Target 100+ Company Websites? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Reuters, citing the operators’ records, reports that an unknown Chinese-speaking actor used Cairn, an open-source AI-agent platform, in a campaign that tried more than 1,200 websites and broke into sites belonging to more than 100 companies. NorForge observed exposed Cairn control panels and estimated the campaign’s AI costs at about $5,000, but the amount of data accessed or taken has not been established.
An unknown Chinese-speaking operator used the open-source Cairn platform to coordinate AI agents that tried more than 1,200 websites and recorded break-ins at sites belonging to over 100 companies, according to Reuters’ review of the operator’s activity and research by security firm NorForge. The campaign, which began on September 25, included websites associated with Deere, SharkNinja and Cummins; how much information, if any, was taken remains unclear.
NorForge researcher Snorre Fagerland searched for internet-exposed Cairn dashboards, which operators can use to coordinate agents. NorForge said it found more than 20 panels it linked to likely malicious use, with new panels appearing over time. The research firm grouped the activity into three clusters. Reuters independently reviewed Cairn activity and identified company websites named in its reporting; NorForge’s report did not name those victims.
The largest cluster, which NorForge labeled AIA0001, used Chinese-language task instructions. NorForge counted more than 1,100 attack projects across 14 panels in that cluster, aimed largely at the United States, Japan and Australia. Reuters reported that the campaign’s records showed attempts against more than 1,200 sites overall and successful intrusions at websites of more than 100 companies. Those counts describe the activity reported by the sources; they do not establish that every attempted site was compromised or that customer databases were accessed.
NorForge measured a little under 23 hours from start to goal for successful AIA0001 projects, with one project lasting more than five days. The firm estimated AI expenses for the campaign at roughly $5,000, or about $50 per successful intrusion, while stressing considerable uncertainty around the estimate. These figures are NorForge’s assessment, not independently confirmed accounting of the operator’s spending.
One operator, a swarm of agents
The campaign in numbers
What the researcher and Reuters report about the busiest group NorForge found. Counts come from the attackers’ own exposed panels; cost and success figures are estimates.
The price tag estimates
NorForge / Fagerland, “uncertainty considerable”
- ~$5 per task on average, including tasks that fail early
- $100+ for long projects with more than 1,000 intents and facts
- ~$5,000 in AI costs for the campaign, about $50 per successful hack
- ~10% success rate, NorForge’s “reasonable assumption”
How the swarm runs
Simplified, no attack details
- Shop websites are ranked by traffic and checked automatically in a browser
- Each target becomes a Cairn project: a starting point and a goal
- Agents post facts and next steps on a shared board and build on each other
- Goal: a hidden way back in to shop and payment systems, for later
- 22 SepGambit reportGambitCairn found among three AI harnesses on a criminal’s staging server (separate campaign)
- 25 SepCampaign startsReutersA Chinese-speaking operator turns agents on shops in the US, Canada, Australia and Japan
- ≈ 2 OctOpen panels foundReutersFagerland starts finding Cairn panels in malicious use, about two dozen
- mid-Oct1,200+ sites triedReutersBreaks into websites of 100+ companies, incl. Deere, SharkNinja, Cummins
- 19 OctReport and investigationNorForge · ReutersNorForge publishes “Inside Cairn”; Reuters publishes its investigation
Sources: NorForge, Inside Cairn (19 Oct 2026); Reuters (19 Oct 2026); Gambit Security (22 Sep 2026). Numbers as published, same rounding as the article.
Powered by Thorsten Meyer AI
Why Automated Patience Matters
The reported campaign points to a change in the scale and persistence of website attacks: one operator could delegate repeated probing to agents rather than personally perform each step. That can make it less costly to test many potential targets and keep an effort running for hours or days. NorForge’s estimated cost per intrusion is uncertain, but the reported pattern suggests defenders may face more activity spread across more sites.
The reports also draw attention to less prominent web properties, including product-support and third-party vendor sites. Such sites can be connected to a company’s services without being its main customer-facing domain. A breach there may warrant investigation, but the available reporting does not show that attackers gained access to each parent company’s core systems or sensitive records.
For security teams, the challenge is not simply that an AI agent can discover a vulnerability. It is that automated probing may generate a volume of activity that is hard to review, while findings and attempted access can be passed between agents. Organizations may need visibility into smaller web properties and vendor-operated services, as well as a way to distinguish authorized automation from hostile activity. The reporting does not establish that AI agents make an attack technically more capable than a human-led operation; it documents how they were used to automate and coordinate this campaign.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How Cairn Panels Exposed Activity
The investigation followed a separate report from Gambit Security in September. Gambit said it recovered a criminal staging server containing three AI-agent tools, including Cairn, and documented a separate campaign involving at least 27 compromised companies. Gambit also reported that at least 600,000 card records were taken from two companies in that separate operation. Those findings concern a different campaign and should not be treated as evidence that card data was stolen in the later activity described by Reuters and NorForge.
NorForge then searched for Cairn dashboards indexed on the public internet. The firm said most panels require authorization, but it found some that did not. From around October 2, Fagerland identified roughly two dozen panels he associated with malicious activity, Reuters reported. NorForge published its analysis on October 19, the same day Reuters published its investigation. The exposed panels gave researchers a view of the operators’ activity, although the reporting does not establish who was behind it.
Cairn is an open-source, general-purpose agent platform, not a tool NorForge describes as built specifically for hacking. Its workflow lets agents record findings and proposed next steps in shared state so other agents can continue the task. The platform’s author, who uses the name le1xia0, told Reuters that Cairn was not designed for hacking attacks and that harmful use was not the author’s intention. The reported campaign illustrates misuse of a general-purpose tool, not proof that its developer directed the operation.
““Most need authorization to access. Most.””
— NorForge report
What Victim Impact Remains Unknown
The operator’s identity has not been established. The source material describes the actor as Chinese-speaking, but that does not confirm nationality, location or affiliation. No arrest or charge was reported. Reuters could not establish how much data, if any, was accessed or taken, and a recorded successful intrusion does not by itself show that sensitive information was stolen.
Companies also gave different levels of detail. Deere told Reuters it had no indication sensitive information was accessed. SharkNinja said a standalone product-support site was affected and the threat was contained. Cummins said it was investigating a potential attack on a website run by a third-party vendor. Two smaller businesses acknowledged compromise to Reuters, while other companies did not respond. The precise access achieved at each site and any lasting effects remain unsettled.
NorForge’s cost and timing figures are estimates based on observed projects, not a complete accounting of the operation. It is also unclear whether the attackers monetized access, sold it, or returned to compromised sites. NorForge interpreted the activity as an effort to secure persistent access to e-commerce or payment infrastructure for possible later monetization; that is the firm’s assessment, not a confirmed outcome.
Investigations and Remediation Continue
The companies named in the reporting may provide further information as their investigations progress. Cummins said it was investigating the potential attack, while SharkNinja said the threat had been contained. Reuters’ reporting did not establish whether all affected organizations had completed forensic reviews or whether any compromised access remained active.
Security researchers may continue monitoring exposed Cairn panels and related activity. For affected organizations, the next confirmed details would be whether investigations identify data access, service disruption or connections to other systems, and whether remediation is complete. Until companies or investigators release those findings, the number of affected records and the campaign’s financial impact remain unknown.
Key Questions
What did the AI agents target?
According to Reuters and NorForge, the campaign tried more than 1,200 websites, including online shops and company-related sites. Reuters reported successful break-ins at websites belonging to more than 100 companies.
Who was behind the campaign?
The operator’s identity is unknown. NorForge described the activity as Chinese-language, and the source material characterizes the actor as Chinese-speaking; this does not establish the operator’s nationality or affiliation.
Was customer or payment data stolen?
The reporting does not establish how much data, if any, was accessed or taken in this campaign. Deere said it had no indication sensitive information was accessed; the effect on other sites remains under investigation or was not detailed.
Was Cairn created as a hacking tool?
No. Cairn is described as an open-source, general-purpose agent platform. Its author told Reuters it was not designed for hacking and said harmful use was not the author’s intention.
How does this differ from the September campaign?
Gambit Security’s September report described a separate operation involving at least 27 compromised companies and at least 600,000 card records taken from two of them. Those reported card records are not evidence of theft in the later campaign covered by Reuters and NorForge.
Source: ThorstenMeyerAI.com
