One attacker used AI agents to break into 100+ company sites

On 19 October NorForge principal threat researcher Snorre Fagerland published a report on a campaign run with AI agents. Reuters reviewed it before publication and identified some victims. A Chinese-speaking attacker began on 25 September and has since breached more than 100 company websites, including sites linked to Deere, SharkNinja and a Cummins vendor.

The attacker used Cairn, an open-source multi-agent platform: give it a target and a goal, and agents work toward it step by step on a shared board. Instructions were fewer than 100 Chinese characters. Every task ran on a worker called "claudecode_deepseek-v4.1-flash", which NorForge says may mean Claude Code driving DeepSeek's V4.1 Flash model. Successful attacks averaged just under 23 hours, at roughly $50 each, about $5,000 in total.

Many operators left their Cairn panels exposed online. NorForge found them with internet scanners from around 2 October and judged more than 20 likely malicious. The Chinese-language cluster held over 1,100 projects aimed at mid-sized online shops in the US, Canada, Japan and Australia, trying to plant web shells for lasting access. An English-language cluster targeted card and crypto theft. The open panels also leaked hundreds of credentials and API keys.

Deere said it took remediation steps and saw no sign of access to sensitive data. SharkNinja said a standalone support site was hit and the threat contained. Cummins is investigating a vendor-run site. Reuters could not determine how much data was taken. Cairn's author said the platform was not built for hacking.

The economics changed. Even with a success rate near 10%, each attempt costs a few dollars, so scale beats skill. Gambit Security found Cairn on an attacker's server in September in a campaign that reportedly took 600,000 card records from 25 companies. Mid-sized shops without security teams are the most exposed.

The exposed panels themselves became a security problem. They leaked hundreds of credentials and API keys; the scanner tool Trufflehog verified about 11% as valid. Some security firms' client work was also visible. NorForge's own estimate puts the average cost near $5 per task including failures, with considerable uncertainty, while Fagerland's rough figure of about $50 per successful hack reflects the roughly 10% success rate. Taiwan's government and India's cyber agency have separately reported AI agents being used to break into live systems.

• Automate plugin and theme updates. Agents scan for known holes.
• Remove unused upload points, admin panels and test pages.
• Monitor your checkout scripts for unexpected changes.
• Keep API keys out of repos and open panels; rotate them if in doubt.