🔍 Read the full analysis: How AI Agents Could Make Website Break-Ins Cheaper To Attempt on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A Reuters investigation, drawing on attacker records and research by NorForge, says an operator used the open-source Cairn platform to direct AI agents at more than 1,200 websites, with break-ins reported at sites of more than 100 companies. The estimated campaign cost and number of affected companies are based on available records; the amount of data accessed or taken has not been established.
An operator using the open-source Cairn agent platform directed software agents to probe more than 1,200 websites, with break-ins reported at websites linked to more than 100 companies, according to Reuters and security firm NorForge. The activity, which began on September 25, raises concerns that automated agents can reduce the time and cost of repeatedly testing online businesses for weaknesses; the amount of data accessed or taken remains unknown.
NorForge researcher Snorre Fagerland found exposed Cairn control panels while searching for internet-facing dashboards. The firm said it identified more than 20 panels it linked to likely malicious activity, with new panels appearing during its monitoring. NorForge grouped the activity into three clusters and published its report on October 19. Reuters reported its findings the same day.
The largest cluster, which NorForge labels AIA0001, used Chinese-language task instructions. NorForge counted more than 1,100 attack projects across 14 associated panels, while Reuters said the operator’s records showed attempts against more than 1,200 sites by mid-October. Reuters independently reviewed Cairn activity and identified company websites, including those of Deere, SharkNinja and Cummins. NorForge’s report did not name victims.
NorForge measured successful projects in the cluster as taking a little under 23 hours from start to goal on average. Fagerland estimated the campaign’s AI costs at roughly $5,000, or about $50 per successful intrusion, but NorForge described the estimate’s uncertainty as considerable. Those figures are estimates, not audited spending or a confirmed cost for each breach.
One operator, a swarm of agents
The campaign in numbers
What the researcher and Reuters report about the busiest group NorForge found. Counts come from the attackers’ own exposed panels; cost and success figures are estimates.
The price tag estimates
NorForge / Fagerland, “uncertainty considerable”
- ~$5 per task on average, including tasks that fail early
- $100+ for long projects with more than 1,000 intents and facts
- ~$5,000 in AI costs for the campaign, about $50 per successful hack
- ~10% success rate, NorForge’s “reasonable assumption”
How the swarm runs
Simplified, no attack details
- Shop websites are ranked by traffic and checked automatically in a browser
- Each target becomes a Cairn project: a starting point and a goal
- Agents post facts and next steps on a shared board and build on each other
- Goal: a hidden way back in to shop and payment systems, for later
- 22 SepGambit reportGambitCairn found among three AI harnesses on a criminal’s staging server (separate campaign)
- 25 SepCampaign startsReutersA Chinese-speaking operator turns agents on shops in the US, Canada, Australia and Japan
- ≈ 2 OctOpen panels foundReutersFagerland starts finding Cairn panels in malicious use, about two dozen
- mid-Oct1,200+ sites triedReutersBreaks into websites of 100+ companies, incl. Deere, SharkNinja, Cummins
- 19 OctReport and investigationNorForge · ReutersNorForge publishes “Inside Cairn”; Reuters publishes its investigation
Sources: NorForge, Inside Cairn (19 Oct 2026); Reuters (19 Oct 2026); Gambit Security (22 Sep 2026). Numbers as published, same rounding as the article.
Powered by Thorsten Meyer AI
Lower Costs, More Repeated Probing
The reported campaign matters because it suggests an attacker can use agents to carry out lengthy, repetitive website probing while providing relatively little direct instruction. According to the source material, the operator supplied fewer than 100 Chinese characters of instructions, after which agents worked through targets and passed findings between tasks. That could make it easier to pursue many sites in parallel, though it does not show that AI agents can breach every site or replace human expertise.
For companies, the cases point to risks beyond primary customer-facing systems. The campaign targeted online shops, and the reported victims include a standalone product-support site and a website operated by a third-party vendor. A breach at a less prominent site can still create questions about access to company systems or customer information. In this campaign, however, Reuters could not establish how much data, if any, was taken.
Automated activity may also increase the volume of security alerts that defenders must review. The source material argues that low-cost, persistent probing could give attackers more chances to find overlooked weaknesses. That is a potential implication of the reported activity, not a measured change in the overall number of attacks.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How Cairn Panels Revealed Activity
The investigation developed from an earlier report by Gambit Security. In September, the firm said it had recovered a criminal staging server containing three AI harnesses, software that lets AI models perform tasks with some autonomy: Hermes, Strix and Cairn. NorForge then searched for internet-exposed dashboards used to manage Cairn agents.
NorForge said most dashboards required authorization, but some did not. Fagerland found exposed panels that he associated with malicious activity and was able to observe their tasks. The largest cluster appeared to coordinate a stream of shop websites, ranking and checking them before sending work to agents. NorForge interpreted the campaign’s goal as gaining persistent access to e-commerce or payment infrastructure for later monetization; that is the firm’s assessment, not proof that such access was sold or used.
Gambit’s September report described a separate agent-driven campaign involving at least 27 companies. The firm said at least 600,000 card records were taken from two of them. Those figures concern a different operation and should not be attributed to the Cairn campaign described by Reuters and NorForge.
“The successful projects took a little under 23 hours.”
— NorForge researcher Snorre Fagerland, as reported by Reuters
Data Access and Attribution Remain Open
The public record does not establish how much information, if any, was accessed or taken in the reported Cairn campaign. Deere told Reuters it had no indication that sensitive information was accessed. SharkNinja said a standalone product-support site was affected and the threat was contained. Cummins said it was investigating a potential cyberattack on a website run by a third-party vendor. These statements describe the companies’ responses; they do not resolve the full scope of activity.
The operator’s identity is unknown. The source material describes the actor as Chinese-speaking, but that does not establish the person’s nationality, location or identity. No arrest or charge was reported. The reported number of affected companies is based on Reuters’ review of attacker activity, and the relationship between individual site intrusions and any later use of access has not been confirmed.
The cost estimate is also uncertain. NorForge’s roughly $5,000 campaign estimate and $50-per-successful-intrusion figure are based on its analysis, and the firm explicitly cautioned that uncertainty was considerable. The source material does not provide a complete accounting of costs or independently verified records for every target.
Company Reviews and Security Findings
The immediate next step is for affected companies and their vendors to complete investigations, determine whether information was exposed, and report any confirmed impact. The statements provided to Reuters show that Deere took remediation actions, SharkNinja said it contained the threat, and Cummins was still investigating a vendor-operated site. The source material gives no timetable for final findings.
NorForge’s October 19 report and Reuters’ investigation provide a view of activity visible through exposed Cairn panels, but they do not establish the full extent of the campaign. Further company disclosures or technical findings may clarify which systems were affected and whether data was accessed. Security teams will also be watching for exposed agent dashboards and signs of automated probing, while keeping in mind that the reports do not show that every use of Cairn is malicious.
Key Questions
What happened in the reported campaign?
According to Reuters and NorForge, an operator used AI agents coordinated through Cairn to probe online shops. Reuters reported attempts against more than 1,200 sites and break-ins at websites linked to more than 100 companies, based on the available activity records.
Which companies were identified?
Reuters identified websites associated with Deere, SharkNinja and Cummins, among others. Their statements describe different circumstances: Deere reported no indication that sensitive information was accessed, SharkNinja said a support site was affected and the threat contained, and Cummins said it was investigating a vendor-operated site.
Was customer or company data stolen?
That has not been established for this campaign. Reuters could not determine how much data, if any, was taken. The separate Gambit Security report about card records concerned a different operation.
How much did the campaign cost?
NorForge researcher Snorre Fagerland estimated roughly $5,000 in AI costs for the campaign, or about $50 per successful intrusion. NorForge said the estimate carries considerable uncertainty, so it should not be treated as a verified accounting.
Who operated the agents?
The operator’s identity is unknown. The source material describes a Chinese-speaking actor, but does not establish the person’s nationality or location. It reports no arrest or charge.
Source: ThorstenMeyerAI.com
