AgentsAutonomy & tool use
Hacker used open-source Cairn AI agents to breach more than 100 websites, including John Deere and SharkNinja sites
Security firm NorForge found exposed control panels showing one operator used Cairn, an open-source multi-agent engine, to attempt over 1,200 websites and breach more than 100, including John Deere and SharkNinja sites, at an estimated $50 in tokens per success.
From the The Verge · AI article of October 19, 2026 and cited sources: The attack took little skill or money. [1] [2] [6]
SOURCES[1] The Verge: A hacker broke into John Deere and SharkNinja… theverge.com[2] TNW: AI agents broke into 100+ sites for one hacker at $50… thenextweb.com[6] NorForge: Inside Cairn norforge.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- Original source
- The Verge · AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- October 19, 2026 article published
- Covered
- Oct 20 edition
- Evidence
- 8 sources across 8 sites
- 1The Verge: A hacker broke into John Deere and SharkNinja…theverge.com
- 2TNW: AI agents broke into 100+ sites for one hacker at $50…thenextweb.com
- 3BleepingComputer: Malicious AI agents steal 600K credit…bleepingcomputer.com
- 4Computing: AI agents used to steal credit card recordscomputing.co.uk
- 5AI Weekly: Hacker's AI agents breached 100+ sites at $50…aiweekly.co
- 6NorForge: Inside Cairnnorforge.com
RisingHow it’s measured
Hacker News · 59 likes · 3 comments
Reach blends public engagement (views, likes, comments, shares, stars) from the platforms where the story or its original source lives: YouTube, Hacker News, GitHub, Substack and similar. A video and the article written from its transcript share one score, taken from the video. Platforms with no data are left out rather than counted as zero, and the age of a story never lowers its score.
The attack took little skill or money. The operator described preferred intrusion tactics in fewer than 100 Chinese characters. The main cluster's panels pointed to Claude Code driving DeepSeek V4.1 Flash. NorForge's panel data show roughly a 10% success rate at about $5 per project. Reuters-based coverage puts the total at about $5,000, or roughly $50 per successful hack. [1] [2] [6]
Cairn's agents coordinate through a shared blackboard. They post confirmed findings and planned next steps, and humans can add hints. In this campaign the agents tried to plant webshells for lasting access. They used common web flaws such as SQL injection, file uploads, deserialization, authentication bypass and SSRF. [6] [7]
Victims included peripheral systems as well as core ones. Deere reported remediation and no sign that sensitive data was accessed. SharkNinja said a standalone product-support site was hit and the threat is contained. Cummins is investigating a website run by one of its vendors. [1]
companies confirmed limited incidents, and panel data show ordinary web flaws exploited cheaply at scale.
Read the full assessment
Implication: patch windows for common vulnerabilities shrink, and vendor-hosted sites, support sites and agent control panels need the same hardening as core systems.
Executive brief
A single Chinese-speaking operator used Cairn, an open-source multi-agent "problem-solving engine," to break into more than 100 websites, Reuters reports, citing the security firm NorForge. Reuters puts the token cost at about $50 per successful hack. Reuters names John Deere, SharkNinja and Cummins among the victims. NorForge found the campaign because the attackers' Cairn control panels were open to the internet with no login. That exposed their targets, tactics and stolen credentials. Deere and SharkNinja confirmed limited incidents. Cummins says it is investigating a website run by one of its vendors (The Verge; TNW).
What changed and event timeline
A Cairn-linked card-theft campaign begins
Gambit Security later tracked an actor whose tool chain was Strix for scanning, Cairn for exploitation and Hermes for orchestration. Skimmers ended up on 119+ sites ().
Gambit's five-day spree
Gambit counted 105 attack waves and 27 companies compromised. More than 600,000 card records were taken from two companies (;).
The NorForge-observed campaign starts
The operator attempted more than 1,200 sites, according to Reuters-based coverage (;).
NorForge finds open panels
Prompted by Gambit's report, NorForge searched Shodan and Censys and found exposed Cairn interfaces with no authentication (;).
Report and Reuters exclusive published
NorForge published its analysis and worked with Reuters to notify victims. Reuters named Deere, SharkNinja and Cummins (;).
Capabilities and access
- Tool: Cairn, published on GitHub under oritera by @le1xia0. It is licensed AGPLv3 for personal and educational use, with commercial licenses on request.
- Models seen in the attacker panels: The main cluster's worker string was
claudecode_deepseek-v4.1-flash, which NorForge reads as Claude Code driving DeepSeek V4.1 Flash. - Operator effort: The attacker described "preferred intrusion tactics" in fewer than 100 Chinese characters (The Verge).
Read the full section
- Tool: Cairn, published on GitHub under oritera by @le1xia0. It is licensed AGPLv3 for personal and educational use, with commercial licenses on request. It can run Claude Code, Codex or Pi as worker backends (README).
- Models seen in the attacker panels: The main cluster's worker string was
claudecode_deepseek-v4.1-flash, which NorForge reads as Claude Code driving DeepSeek V4.1 Flash. A second cluster usedpi_openrouter_deepseek(NorForge). - Operator effort: The attacker described "preferred intrusion tactics" in fewer than 100 Chinese characters (The Verge).
Technical analysis for researchers and developers
- Architecture: Cairn uses a shared "blackboard." NorForge's projects averaged 140 facts each (NorForge).
- Tactics: The agents tried to plant webshells for lasting access rather than run one-off commands.
- Method and reproducibility: The evidence comes from passive internet scanning and reading the exposed panels.
Read the full section
- Architecture: Cairn uses a shared "blackboard." Agents post facts (confirmed findings) and intents (planned next steps), and humans can add hints. Workers repeat an observe-orient-decide-act loop and coordinate only through the board, not by messaging each other (README). NorForge's projects averaged 140 facts each (NorForge).
- Tactics: The agents tried to plant webshells for lasting access rather than run one-off commands. Techniques included SQL injection, file uploads, deserialization, authentication bypass and SSRF, plus memcached and cookie manipulation (NorForge).
- Method and reproducibility: The evidence comes from passive internet scanning and reading the exposed panels. NorForge withheld panel addresses and victim identities, so outsiders cannot replicate the analysis.
Claims and evidence
- About 10% average success rate; under 23 hours per successful intrusion; about $5 per project, with some over $100.
- About $5,000 in total tokens and about $50 per successful hack. These figures come through Reuters-based coverage (TNW).
- Victims: Deere says it took remediation steps and saw "no indication" that sensitive data was accessed. Cummins is investigating a vendor-run site (The Verge).
Read the full section
- About 10% average success rate; under 23 hours per successful intrusion; about $5 per project, with some over $100. These are NorForge's own measurements from the panels (NorForge).
- About $5,000 in total tokens and about $50 per successful hack. These figures come through Reuters-based coverage (TNW). They do not appear in NorForge's summarized report.
- Victims: Deere says it took remediation steps and saw "no indication" that sensitive data was accessed. SharkNinja says a standalone product-support site was hit and the threat is contained. Cummins is investigating a vendor-run site (The Verge). These company statements are the only confirmation of NorForge's findings from outside NorForge. No one has independently checked the success-rate or cost figures.
Context and prior work
- Gambit's September report described Cairn as the exploitation engine in a skimming campaign. Reported costs for that campaign conflict: $8,000 (Computing) versus $12,000–$18,000 (BleepingComputer).
- Before this, Cairn was best known for solving all 54 challenges in Tencent Cloud's hackathon penetration-testing contest (README).
Read the full section
- Gambit's September report described Cairn as the exploitation engine in a skimming campaign. Reported costs for that campaign conflict: $8,000 (Computing) versus $12,000–$18,000 (BleepingComputer). The reviewed sources do not establish that Gambit's actor and NorForge's cluster are the same.
- Before this, Cairn was best known for solving all 54 challenges in Tencent Cloud's hackathon penetration-testing contest (README).
Limitations, safety and contested findings
- NorForge rates two clusters as high-confidence malicious and one (59 projects) as low-confidence (NorForge).
- Hundreds of secrets leaked from the exposed panels. A Trufflehog scan verified 11% of them as valid (NorForge).
- Removing the malicious panels depends on hosting providers responding to takedown requests (NorForge).
Read the full section
- NorForge rates two clusters as high-confidence malicious and one (59 projects) as low-confidence (NorForge).
- Hundreds of secrets leaked from the exposed panels. A Trufflehog scan verified 11% of them as valid (NorForge).
- Removing the malicious panels depends on hosting providers responding to takedown requests (NorForge).
- Cairn's creator says it "was never a 'hacking tool'" and that misuse is a human choice (The Verge). The README states it is for authorized use only.
Business and practitioner implications
- Exposure is wider than core systems. Peripheral and vendor-hosted sites, such as support portals, are real targets. Cummins' incident involved a third party's website.
- Patch timelines are shorter. Assume ordinary web flaws (SQL injection, upload, SSRF) will be found quickly.
- Detect webshells, not only intrusions. The agents sought persistent access, so watch for persistent footholds.
Read the full section
- Exposure is wider than core systems. Peripheral and vendor-hosted sites, such as support portals, are real targets. Cummins' incident involved a third party's website.
- Patch timelines are shorter. At roughly $5 a project, a 10% success rate across more than 1,200 targets pays off for attackers. Assume ordinary web flaws (SQL injection, upload, SSRF) will be found quickly.
- Detect webshells, not only intrusions. The agents sought persistent access, so watch for persistent footholds.
- Lock down your own agent tooling. Agent control panels left unauthenticated leak targets, credentials and operations, and that applies to defenders' instances too.