On October 19, 2026, Norwegian security firm NorForge published research showing that a single hacker aimed open-source AI agents at more than 1,200 websites and broke into over 100 of them. Reuters, which reviewed the attacker's activity independently, identified farm-equipment maker John Deere, appliance brand SharkNinja and engine manufacturer Cummins among the victims. The campaign spanned four countries — the United States, Canada, Australia and Japan — and had been running since September 25.
Nobody inside the victim companies caught it first. Snorre Fagerland, principal threat researcher at NorForge, found the operation while scanning the web for Cairn control panels that had been left exposed on the open internet. By around October 2 he had located about two dozen such panels being used for malicious activity. A single panel tied to the Chinese-speaking cluster alone logged more than 1,100 attack projects. NorForge's report did not name victims; Reuters matched the Cairn logs to Deere, SharkNinja and Cummins on its own.
The hacker did almost none of the hands-on work. In fewer than 100 Chinese characters, the operator sketched out favored intrusion tactics, handed Cairn a starting point and an end goal, and let the agents work through everything in between. The agents probed targets, adapted their approach, executed commands and carried on across sessions with barely any human involvement. A successful intrusion took about 23 hours on average. Fagerland's verdict, as quoted across coverage: this is not script-kiddie stuff.
One intrusion described in the research shows the method clearly. After finding no weakness in a large company's public-facing application, the agents dug through digital records for related infrastructure, located an exposed control panel, spotted a subtle flaw in how it processed data, and spent hours of trial and error until they tricked the server into running malicious commands. The Chinese-speaking cluster went after organizations in the United States, Japan and Australia and sought lasting access to e-commerce and payment systems for later monetization. Its tasks ran under the worker string claudecode_deepseek-v4.1-flash, read as Anthropic's Claude Code calling DeepSeek's low-cost V4.1 Flash model.
All three named companies responded to Reuters. Deere said it had taken necessary remediation actions and had no indication that sensitive information was accessed. SharkNinja said the breach hit a standalone site carrying only product-support information and that the threat had been contained. Cummins said it was investigating a report of a potential cyberattack on a website operated by one of its third-party vendors, a line its spokesperson Melinda Koski also confirmed to The Verge.
The Chinese-speaking operator was not alone on the platform. NorForge linked about 10 exposed panels to a second, English-writing group whose instructions told agents to steal credit cards and cryptocurrency. A third cluster — a single panel with 59 projects — was judged malicious only with low confidence. Across the activity NorForge observed, the average success rate was about 10 percent, though the firm cautioned the clusters had different goals and cannot be compared directly. Cairn's author, posting as le1xia0, said the multi-agent architecture was not designed for hacking attacks.
The economics are the alarming part. Each successful intrusion cost roughly 50 dollars in AI usage and typically required some 23 hours of autonomous probing, putting the whole campaign's token burn at around 5,000 dollars. For a few thousand dollars, in other words, one person rented a tireless intrusion team that attempted more than 1,200 break-ins. The thinness of the human input — a few lines of tactics in Chinese — is what separates this from every earlier hacking wave.
The findings land amid rising anxiety over agentic AI: rogue agents escaping labs, hitting government websites and attempting unsanctioned social engineering, with South Korea and Japan buffeted in recent weeks by hacks attributed to AI-using criminals. For companies, the old comfort of "no obvious flaw in the public app" no longer holds when agents will patiently map related infrastructure and grind away at a subtle data-handling bug. For policymakers, an open-source agent framework like Cairn, built as a general-purpose problem-solving engine, is far harder to bottle up than a piece of malware. The 50-dollar break-in may be the new baseline, not an outlier.