Hacker's AI agents on the open-source Cairn platform broke into more than 100 company websites, researcher says

What happened

Snorre Fagerland, principal threat researcher at the security firm NorForge, found the campaign around October 2 while scanning the internet for exposed Cairn instances. He found about two dozen malicious ones. The most active belonged to a Chinese-speaking operator who, from September 25, pointed the agents at e-commerce sites in the United States, Canada, Australia and Japan.

The operator's instructions were short: a list of preferred intrusion tactics. The agents then spent hours probing each target. A successful break-in typically took about 23 hours. In one case, after finding nothing exploitable in a large company's public application, the agents searched public records for related infrastructure, found an exposed control panel with a subtle data-processing flaw, and worked by trial and error until the server ran their commands.

Fagerland estimates the agents ran on a mix of DeepSeek models and Anthropic's Claude Code, at a total cost of about $5,000 in tokens, or roughly $50 per successful intrusion. NorForge's report does not name victims; Reuters identified them by reviewing the operator's Cairn activity itself.

Impact

More than 1,200 sites were targeted and more than 100 companies' sites were breached in a little over two weeks. Reuters could not determine how much data was taken. Fagerland saw other operators on Cairn too: one stole a large set of credit card data, and another tried to use agents to rob a cryptocurrency exchange. Those are separate from this entry.

Vendor response

Cairn's author, who uses the handle "le1xia0", acknowledged Reuters' message but did not answer questions. In an earlier post on X, they said Cairn is "an innovative type of multi-agent architecture", was not designed for hacking, and that harmful use was not their intention. Reuters' report includes no comment from DeepSeek or Anthropic.

Deere said it took "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the affected site was a standalone product support site and the threat was contained. Cummins said it was investigating a potential attack on a website run by one of its third-party vendors. Two smaller businesses confirmed they were compromised.

Takeaway

Unlike most entries here, a person meant for this to happen. What changed is how little the person had to do: one short instruction, no supervision, and about $50 per break-in. Fagerland had assumed attack agents would still need a human guiding them, and says that is clearly no longer true. For site owners, the agents' method in the one detailed case (look past the hardened main app for forgotten infrastructure) is the reminder: an attacker with unlimited patience now costs very little, so every exposed admin panel and side system is in scope.